Repository: go-gitea/gitea
File: models/auth/oauth2.go (Go)

Code before:
	Locked             bool               `xorm:"NOT NULL DEFAULT FALSE"`
}

func init() {
	db.RegisterModel(new(OAuth2Application))
	db.RegisterModel(new(OAuth2AuthorizationCode))
	db.RegisterModel(new(OAuth2Grant))
}

func Init(ctx context.Context) error {
	defaultApplications := []*OAuth2Application{
		{
			Name:         "git-credential-oauth",
			ClientID:     "a4792ccc-144e-407e-86c9-5e7d8d9c3269",
			RedirectURIs: []string{"http://127.0.0.1", "https://127.0.0.1"},
			Locked:       true,
		},
		{
			Name:         "Git Credential Manager",
			ClientID:     "e90ee53c-94e2-48ac-9358-a874fb9e0662",
			RedirectURIs: []string{"http://127.0.0.1", "https://127.0.0.1"},
			Locked:       true,
		},
	}

	registeredOAuth2Apps, _ := GetOAuth2ApplicationsByUserID(ctx, 0)

	var enabledOAuth2Apps []*OAuth2Application
	for _, entry := range setting.OAuth2.DefaultApplications {
		app := util.SliceFind(defaultApplications, func(a *OAuth2Application) bool { return a.Name == entry })
		if app != -1 {
			enabledOAuth2Apps = append(enabledOAuth2Apps, defaultApplications[app])
		}
	}

	var disabledOAuth2Apps []*OAuth2Application
	for _, entry := range defaultApplications {
		app := util.SliceFind(enabledOAuth2Apps, func(a *OAuth2Application) bool { return a.ClientID == entry.ClientID })
		registeredApp := util.SliceFind(registeredOAuth2Apps, func(a *OAuth2Application) bool { return a.ClientID == entry.ClientID })
		if app == -1 && registeredApp != -1 {
			disabledOAuth2Apps = append(disabledOAuth2Apps, registeredOAuth2Apps[registeredApp])
		}
	}

	var createOAuth2Apps []*OAuth2Application
	for _, app := range enabledOAuth2Apps {
		registeredApp := util.SliceFind(registeredOAuth2Apps, func(a *OAuth2Application) bool { return a.ClientID == app.ClientID })
		if registeredApp == -1 {
			createOAuth2Apps = append(createOAuth2Apps, app)
		}
	}

Review comment (suggestion):
Since `client_id` is unique, searching by the `client_id` is the best resolution here. You can use `In` because the default applications should not too much. Gitea supports Global Applications, although there should not be too many global applications. 

Code after:
	UpdatedUnix        timeutil.TimeStamp `xorm:"INDEX updated"`
}

func init() {
	db.RegisterModel(new(OAuth2Application))
	db.RegisterModel(new(OAuth2AuthorizationCode))
	db.RegisterModel(new(OAuth2Grant))
}

type BuiltinOAuth2Application struct {
	ConfigName   string
	DisplayName  string
	RedirectURIs []string
}

func BuiltinApplications() map[string]*BuiltinOAuth2Application {
	m := make(map[string]*BuiltinOAuth2Application)
	m["a4792ccc-144e-407e-86c9-5e7d8d9c3269"] = &BuiltinOAuth2Application{
		ConfigName:   "git-credential-oauth",
		DisplayName:  "git-credential-oauth",
		RedirectURIs: []string{"http://127.0.0.1", "https://127.0.0.1"},
	}
	m["e90ee53c-94e2-48ac-9358-a874fb9e0662"] = &BuiltinOAuth2Application{
		ConfigName:   "git-credential-manager",
		DisplayName:  "Git Credential Manager",
		RedirectURIs: []string{"http://127.0.0.1", "https://127.0.0.1"},
	}
	return m
}

func Init(ctx context.Context) error {
	builtinApps := BuiltinApplications()
	var builtinAllClientIDs []string
	for clientID := range builtinApps {
		builtinAllClientIDs = append(builtinAllClientIDs, clientID)
	}

	var registeredApps []*OAuth2Application
	if err := db.GetEngine(ctx).In("client_id", builtinAllClientIDs).Find(&registeredApps); err != nil {
		return err
	}

	clientIDsToAdd := container.Set[string]{}
	for _, configName := range setting.OAuth2.DefaultApplications {
		found := false
		for clientID, builtinApp := range builtinApps {
			if builtinApp.ConfigName == configName {
				clientIDsToAdd.Add(clientID) // add all user-configured apps to the "add" list
				found = true
			}
		}