OAuth clients created by managers are not shown on the target user’s client page
>>> [!note] Migrated issue
<!-- Drupal.org comment -->
<!-- Migrated from issue #3557887. -->
Reported by: [herved](https://www.drupal.org/user/2197136)
Related to !26
>>>
<h3 id="summary-problem-motivation">Problem/Motivation</h3>
<p>A user with the "manage oauth clients" permission can create a client request on behalf of another user. The client request and corresponding client entity are created correctly, but the <strong>manager does not see the client listed</strong> when viewing the other user's OAuth clients page.</p>
<h4 id="summary-steps-reproduce">Steps to reproduce</h4>
<p>- Log in as a manager (e.g., user ID 2).<br>
- Visit <strong>another</strong> user's OAuth2 client requests page: user/3/edit/oauth_requests.<br>
- Create a new client request using the “+ New client” button and save it. (This creates an approved request and the corresponding client entity automatically.)<br>
- The new request appears under user/3/edit/oauth_requests, but the <strong>manager does not see the client</strong> under user/3/edit/oauth.</p>
<h3 id="summary-proposed-resolution">Proposed resolution</h3>
<p>The data looks ok in DB: the owner_id of the client will be the one who created it (uid 2) and the user_id will be the user this client belongs to (uid 3).<br>
But the problem is the controller, filtering on both owner_id and user_id in <code>\Drupal\oauth_client\Controller\OauthClientUserController::__invoke</code></p>
<pre>$clientIds = $storage->getQuery()->accessCheck(FALSE)<br> ->condition('owner_id', $user->id()) // removing this condition fixes it.<br> ->condition('user_id', $user->id())<br> ->condition('confidential', TRUE)<br> ->sort('label')<br> ->execute();</pre>
issue