Function refreshOAuthConnection

apps/cli/src/main.ts:753–796

(
  connection: ExecutorServerConnection,
)

const OAUTH_REFRESH_SKEW_SECONDS = 60;

const refreshOAuthConnection = (
  connection: ExecutorServerConnection,
): Effect.Effect<ExecutorServerConnection, never, FileSystem.FileSystem | PlatformPath.Path> =>
  Effect.gen(function* () {
    const auth = connection.auth;
    if (!auth || auth.kind !== "oauth") return connection;
    const now = Math.floor(Date.now() / 1000);
    if (auth.expiresAt && auth.expiresAt - now > OAUTH_REFRESH_SKEW_SECONDS) return connection;
    // Destructure so the narrowed string types survive into the deferred
    // `tryPromise` callback (where TS would otherwise re-widen the fields).
    const { refreshToken, tokenEndpoint, clientId } = auth;
    if (!refreshToken || !tokenEndpoint || !clientId) return connection;

    const refreshed = yield* Effect.tryPromise({
      try: () => refreshDeviceTokens({ tokenEndpoint, clientId, refreshToken }),
      catch: toError,
      // On a failed refresh, keep the existing token and let the eventual 401
      // surface, better than blocking the command on a transient hiccup.
    }).pipe(Effect.option);
    if (Option.isNone(refreshed)) return connection;

    const next = refreshed.value;
    const nextConnection = normalizeExecutorServerConnection({
      ...connection,
      auth: {
        kind: "oauth",
        accessToken: next.accessToken,
        refreshToken: next.refreshToken ?? refreshToken,
        ...(next.expiresAt ? { expiresAt: next.expiresAt } : {}),
        tokenEndpoint,
        clientId,
      },
    });

    const profileName = profileNameFromConnectionKey(connection.key);
    if (profileName) {
      yield* upsertCliServerConnectionProfile({
        name: profileName,
        connection: nextConnection,
        makeDefault: false,
      }).pipe(Effect.ignore);
    }
    return nextConnection;
  });

const resolveExecutorServerConnection = (
  target: ServerTarget,