(
input: CreateOAuthClientInput,
)
| 571 | // createClient — write the oauth_client row. |
| 572 | // ----------------------------------------------------------------------- |
| 573 | const createClient = ( |
| 574 | input: CreateOAuthClientInput, |
| 575 | ): Effect.Effect<OAuthClientSlug, StorageFailure> => |
| 576 | Effect.gen(function* () { |
| 577 | yield* validateClientEndpoints(input, deps.endpointUrlPolicy); |
| 578 | const keys = yield* Effect.try({ |
| 579 | try: () => deps.ownedKeys(input.owner), |
| 580 | catch: (cause) => |
| 581 | new StorageError({ |
| 582 | message: "Cannot write oauth_client for owner without a subject", |
| 583 | cause, |
| 584 | }), |
| 585 | }); |
| 586 | const now = new Date(); |
| 587 | |
| 588 | // Store the secret out-of-band in the default writable provider; the row |
| 589 | // keeps only its item id. A public/PKCE client (empty secret) stores null |
| 590 | // — there is no plaintext column to fall back to (the schema dropped it). |
| 591 | let clientSecretItemIdValue: string | null = null; |
| 592 | if (input.clientSecret.length > 0) { |
| 593 | const provider = deps.defaultWritableProvider(); |
| 594 | if (!provider || !provider.set) { |
| 595 | return yield* new StorageError({ |
| 596 | message: |
| 597 | "No default writable credential provider is registered to store the OAuth client secret.", |
| 598 | cause: undefined, |
| 599 | }); |
| 600 | } |
| 601 | clientSecretItemIdValue = clientSecretItemId(input.owner, input.slug); |
| 602 | yield* provider.set(ProviderItemId.make(clientSecretItemIdValue), input.clientSecret); |
| 603 | } |
| 604 | |
| 605 | yield* deps.fuma |
| 606 | .use("oauth_client.deleteExisting", (db) => |
| 607 | looseDb(db).deleteMany("oauth_client", { |
| 608 | where: (b: any) => |
| 609 | b.and(b("owner", "=", input.owner), b("slug", "=", String(input.slug))), |
| 610 | }), |
| 611 | ) |
| 612 | .pipe(Effect.catch(() => Effect.void)); |
| 613 | yield* deps.fuma.use("oauth_client.create", (db) => |
| 614 | looseDb(db).create("oauth_client", { |
| 615 | tenant: keys.tenant, |
| 616 | owner: keys.owner, |
| 617 | subject: keys.subject, |
| 618 | slug: String(input.slug), |
| 619 | authorization_url: input.authorizationUrl, |
| 620 | token_url: input.tokenUrl, |
| 621 | grant: input.grant, |
| 622 | client_id: input.clientId, |
| 623 | client_secret_item_id: clientSecretItemIdValue, |
| 624 | resource: input.resource ?? null, |
| 625 | origin_kind: input.origin?.kind ?? "manual", |
| 626 | // Recorded intent, kept for BOTH origins: a manual app registered from |
| 627 | // an integration's dialog stamps its integration so the picker can |
| 628 | // match it exactly, the same way a DCR client records the integration |
| 629 | // that requested it. |
| 630 | origin_integration: |
no test coverage detected