(
target: {
readonly owner: Owner;
readonly name: ConnectionName;
readonly integration: IntegrationSlug;
readonly template: AuthTemplateSlug;
readonly identityLabel?: string | null;
},
client: LoadedOAuthClient,
token: OAuth2TokenResponse,
/** The scope set requested at /authorize + /token (the integration's
* declared or discovered scopes) — the recorded-scope fallback when the AS
* omits `scope`. */
requestedScopes: readonly string[],
/** The owner of `client` — persisted so refresh loads it by explicit owner. */
clientOwner: Owner,
/** Regional token endpoint override to persist when the code was redeemed
* off the client's configured host; null to use the client's token URL. */
oauthTokenUrl: string | null,
)
| 1241 | // connection row with OAuth lifecycle fields + produce its tools. |
| 1242 | // ----------------------------------------------------------------------- |
| 1243 | const mintFromToken = ( |
| 1244 | target: { |
| 1245 | readonly owner: Owner; |
| 1246 | readonly name: ConnectionName; |
| 1247 | readonly integration: IntegrationSlug; |
| 1248 | readonly template: AuthTemplateSlug; |
| 1249 | readonly identityLabel?: string | null; |
| 1250 | }, |
| 1251 | client: LoadedOAuthClient, |
| 1252 | token: OAuth2TokenResponse, |
| 1253 | /** The scope set requested at /authorize + /token (the integration's |
| 1254 | * declared or discovered scopes) — the recorded-scope fallback when the AS |
| 1255 | * omits `scope`. */ |
| 1256 | requestedScopes: readonly string[], |
| 1257 | /** The owner of `client` — persisted so refresh loads it by explicit owner. */ |
| 1258 | clientOwner: Owner, |
| 1259 | /** Regional token endpoint override to persist when the code was redeemed |
| 1260 | * off the client's configured host; null to use the client's token URL. */ |
| 1261 | oauthTokenUrl: string | null, |
| 1262 | ): Effect.Effect<Connection, StorageFailure> => |
| 1263 | Effect.gen(function* () { |
| 1264 | const provider = deps.defaultWritableProvider(); |
| 1265 | if (!provider || !provider.set) { |
| 1266 | return yield* new StorageError({ |
| 1267 | message: |
| 1268 | "No default writable credential provider is registered to store the OAuth access token.", |
| 1269 | cause: undefined, |
| 1270 | }); |
| 1271 | } |
| 1272 | const itemId = accessItemId(target.owner, target.integration, target.name); |
| 1273 | yield* provider.set(ProviderItemId.make(itemId), token.access_token); |
| 1274 | |
| 1275 | let refreshItemId: string | null = null; |
| 1276 | if (token.refresh_token) { |
| 1277 | refreshItemId = refreshItemIdFor(itemId); |
| 1278 | yield* provider.set(ProviderItemId.make(refreshItemId), token.refresh_token); |
| 1279 | } |
| 1280 | |
| 1281 | return yield* deps.mintOAuthConnection({ |
| 1282 | owner: target.owner, |
| 1283 | name: target.name, |
| 1284 | integration: target.integration, |
| 1285 | template: target.template, |
| 1286 | identityLabel: target.identityLabel ?? null, |
| 1287 | provider: String(provider.key), |
| 1288 | itemId, |
| 1289 | oauthClient: OAuthClientSlug.make(client.slug), |
| 1290 | oauthClientOwner: clientOwner, |
| 1291 | refreshItemId, |
| 1292 | expiresAt: expiresAtFrom(token), |
| 1293 | // Record the granted scope the AS echoed back. Some providers, including |
| 1294 | // Microsoft, issue a refresh token for `offline_access` but omit that |
| 1295 | // non-resource scope from the token `scope` string, so preserve it when |
| 1296 | // the refresh token proves it was granted. |
| 1297 | oauthScope: recordedOAuthScope(token, requestedScopes), |
| 1298 | oauthTokenUrl, |
| 1299 | }); |
| 1300 | }); |
no test coverage detected