Desktop app sends JWT token as OAuth Client ID instead of UUID, causing 500 error on self-hosted instance

[ricostap]

Version: 0.2.7
Platform: Linux (x86, tar.gz)
Instance: Self-hosted via Docker (latest image)
Description:
When configuring the desktop app with a self-hosted instance and entering the Client ID, the app sends the full JWT access token as the OAuth Client ID in the database query instead of the UUID. This causes a 500 error.
Error from Laravel log:
SQLSTATE[22P02]: Invalid text representation: 7 ERROR: invalid input syntax for type uuid: "eyJ0eXAiOiJKV1Qi..."
SQL: select * from "oauth_clients" where "oauth_clients"."id" = eyJ0eXAiOiJKV1Qi...
Steps to reproduce:

Set up a self-hosted Solidtime instance
Install the desktop app (v0.2.7, Linux)
Open Settings in the desktop app
Enter the instance URL and a valid Client ID (personal access client UUID from oauth_clients table)
Click Save — browser opens for OAuth flow
After login, server returns 500

Expected behavior:
The app should use the Client ID UUID for the OAuth client lookup, not the JWT token.
Additional context:
The oauth_clients table contains valid entries with grant_types: ["personal_access"]. The Client ID UUID is correct. The issue appears to be that the app passes the JWT token in a query that expects a UUID.

[Onatcer]

personal access client UUID from oauth_clients table
grant_types: ["personal_access"].

I'm not sure what oauth client you are using there but I'm pretty sure its the wrong one. We have a command in the setup docs that should be used to setup and get the client id that should be used and configured in the desktop app. There is no need to access the table directly.

docker compose exec scheduler php artisan passport:client --name=desktop --redirect_uri=solidtime://oauth/callback --public -n

https://docs.solidtime.io/self-hosting/guides/docker#9-activate-desktop-client-access-optional

[ricostap]

I ran the passport:client command and configured the desktop app with the correct client ID. The OAuth flow opens the browser correctly and I can log in, but the authorization step fails with:
403 - The provided auth token for the request is different from the session auth token
My setup:

Rootless Podman (not Docker Compose) on a Hostinger VPS
Nginx reverse proxy → container on port 3200
APP_URL=https://time.ptyxo.com, APP_FORCE_HTTPS=true, TRUSTED_PROXIES=0.0.0.0/0
SESSION_DRIVER=database
Desktop app on Arch Linux / Wayland

The web app itself works fine. The error only occurs during the OAuth authorization callback from the desktop app. I suspect it may be related to how Passport handles the CSRF state token across the redirect, possibly affected by my rootless Podman setup or the solidtime:// custom URI scheme callback on Linux.
Is there a known workaround for non-Docker-Compose setups?

[ricostap]

Update: Browser Extension authenticates and works so the issue seems to be specific to the desktop app on Linux/Wayland then. The browser extension seems to use a different OAuth flow that doesn't hit the same problem.