(
input: CreateConnectionInput,
)
| 2263 | // ------------------------------------------------------------------ |
| 2264 | |
| 2265 | const connectionsCreate = ( |
| 2266 | input: CreateConnectionInput, |
| 2267 | ): Effect.Effect< |
| 2268 | Connection, |
| 2269 | | IntegrationNotFoundError |
| 2270 | | CredentialProviderNotRegisteredError |
| 2271 | | InvalidConnectionInputError |
| 2272 | | StorageFailure |
| 2273 | > => |
| 2274 | Effect.gen(function* () { |
| 2275 | const name = connectionIdentifier(String(input.name)); |
| 2276 | // Typed (not StorageError) so the HTTP edge can answer 400 with the |
| 2277 | // reason instead of an opaque 500 — callers can act on it. |
| 2278 | if (input.owner === "user" && subject == null) { |
| 2279 | return yield* new InvalidConnectionInputError({ |
| 2280 | message: |
| 2281 | 'Cannot create a personal connection: this context has no user subject. Create it with owner "org", or connect as a signed-in user.', |
| 2282 | }); |
| 2283 | } |
| 2284 | const integrationRow = yield* findIntegrationRow(input.integration); |
| 2285 | if (!integrationRow) { |
| 2286 | return yield* new IntegrationNotFoundError({ |
| 2287 | slug: input.integration, |
| 2288 | }); |
| 2289 | } |
| 2290 | |
| 2291 | // Resolve the value origin(s) → one provider + an item_ids map (one entry |
| 2292 | // per named input). All of a connection's inputs share a single provider: |
| 2293 | // pasted inputs go to the default writable store, external `from` inputs to |
| 2294 | // their provider. Mixing pasted + external, or two external providers, is |
| 2295 | // rejected (the connection row carries one `provider`). |
| 2296 | const inputs = normalizeConnectionInputs(input); |
| 2297 | const pasted = inputs.filter((i) => "value" in i.origin); |
| 2298 | const external = inputs.filter((i) => "from" in i.origin); |
| 2299 | // A credentialed connection is born wired: it must reference at least |
| 2300 | // one credential input. An empty binding (no inputs at all — e.g. an |
| 2301 | // empty `values`/`inputs` map) is a credential with no credential: it |
| 2302 | // would persist, produce a full tool catalog, and then fail every |
| 2303 | // invocation with `connection_value_missing`. Reject it here — EXCEPT |
| 2304 | // for the no-auth template ("none"), where zero inputs and an empty |
| 2305 | // `item_ids` map are the canonical shape (public MCP servers; the UI |
| 2306 | // submits `values: {}` for them). OAuth connections are minted via |
| 2307 | // `mintOAuthConnection`, not this path; an external `from` reference |
| 2308 | // may resolve to null and is surfaced at invoke time, not here. |
| 2309 | const isNoAuth = String(input.template) === String(NO_AUTH_TEMPLATE); |
| 2310 | if (inputs.length === 0 && !isNoAuth) { |
| 2311 | return yield* new InvalidConnectionInputError({ |
| 2312 | message: "A connection must supply at least one credential input.", |
| 2313 | }); |
| 2314 | } |
| 2315 | let providerKey: string; |
| 2316 | const itemIds: Record<string, string> = {}; |
| 2317 | if (external.length > 0 && pasted.length > 0) { |
| 2318 | return yield* new InvalidConnectionInputError({ |
| 2319 | message: "A connection cannot mix pasted and external-provider inputs.", |
| 2320 | }); |
| 2321 | } |
| 2322 | if (external.length > 0) { |
no test coverage detected