Implement OAuth Support for Plaid Integration

[williaby]

✨ Implement OAuth Support for Plaid Integration

Summary

Plaid has confirmed that our application will need to support OAuth in order to complete the API integration for certain financial institutions. This issue tracks the work necessary to integrate and support OAuth within the LedgerBase Link + API flow.

Context

• OAuth is required for institutions that redirect users to their own login portals (e.g., Chase, Capital One).
• Our application currently uses Plaid Link without redirect handling.
• OAuth implementation is a prerequisite for production deployment and to ensure full institution coverage in Plaid.

Acceptance Criteria

• Detect when an institution requires OAuth during the link_token creation flow.
• Handle redirect flow per Plaid’s OAuth documentation, including:
  • Appending oauth_state_id to the redirect URI
  • Preserving Plaid Link session across redirect
  • Reinitializing Link on return from the institution
• Update Flask server to:
  • Handle Plaid's /oauth-return route
  • Parse and rehydrate session state using oauth_state_id
• Add local development support for OAuth using secure tunnel (e.g., ngrok or Cloudflare Tunnel)
• Enable redirect URI configuration by environment (local/dev/staging/prod)
• Extend existing Plaid-related tests to cover OAuth-related flows

Resources

• 🔗 Plaid OAuth Guide
• 📘 Plaid Redirect URI Requirements
• 🧪 Plaid Sandbox Testing for OAuth
• 📦 Flask session storage strategy

Implementation Notes

• Will require updates to both frontend JavaScript and backend Flask Python routes
• Consider use of state parameter to support CSRF protection during OAuth flow
• Redirect URIs must be registered per environment in the Plaid dashboard
• Temporary storage of oauth_state_id can be done in Flask session or Redis depending on deployment constraints

Milestone

plaid-integration-phase-2

Related Issues

• [Automation] Introduce noxfile.py to consolidate dev tooling and CI tasks #97 Add Plaid Link token creation to Flask backend
• #122 Enable GitHub OAuth for deployment flow (reference implementation for redirect-based auth)