(
target: {
readonly owner: Owner;
readonly name: ConnectionName;
readonly integration: IntegrationSlug;
readonly template: AuthTemplateSlug;
readonly identityLabel?: string | null;
},
client: LoadedOAuthClient,
token: OAuth2TokenResponse,
/** The scope set requested at /authorize + /token (the integration's
* declared or discovered scopes) — the recorded-scope fallback when the AS
* omits `scope`. */
requestedScopes: readonly string[],
/** The owner of `client` — persisted so refresh loads it by explicit owner. */
clientOwner: Owner,
/** Regional token endpoint override to persist when the code was redeemed
* off the client's configured host; null to use the client's token URL. */
oauthTokenUrl: string | null,
)
| 1298 | // connection row with OAuth lifecycle fields + produce its tools. |
| 1299 | // ----------------------------------------------------------------------- |
| 1300 | const mintFromToken = ( |
| 1301 | target: { |
| 1302 | readonly owner: Owner; |
| 1303 | readonly name: ConnectionName; |
| 1304 | readonly integration: IntegrationSlug; |
| 1305 | readonly template: AuthTemplateSlug; |
| 1306 | readonly identityLabel?: string | null; |
| 1307 | }, |
| 1308 | client: LoadedOAuthClient, |
| 1309 | token: OAuth2TokenResponse, |
| 1310 | /** The scope set requested at /authorize + /token (the integration's |
| 1311 | * declared or discovered scopes) — the recorded-scope fallback when the AS |
| 1312 | * omits `scope`. */ |
| 1313 | requestedScopes: readonly string[], |
| 1314 | /** The owner of `client` — persisted so refresh loads it by explicit owner. */ |
| 1315 | clientOwner: Owner, |
| 1316 | /** Regional token endpoint override to persist when the code was redeemed |
| 1317 | * off the client's configured host; null to use the client's token URL. */ |
| 1318 | oauthTokenUrl: string | null, |
| 1319 | ): Effect.Effect<Connection, StorageFailure> => |
| 1320 | Effect.gen(function* () { |
| 1321 | const provider = deps.defaultWritableProvider(); |
| 1322 | if (!provider || !provider.set) { |
| 1323 | return yield* new StorageError({ |
| 1324 | message: |
| 1325 | "No default writable credential provider is registered to store the OAuth access token.", |
| 1326 | cause: undefined, |
| 1327 | }); |
| 1328 | } |
| 1329 | const itemId = accessItemId(target.owner, target.integration, target.name); |
| 1330 | yield* provider.set(ProviderItemId.make(itemId), token.access_token); |
| 1331 | |
| 1332 | let refreshItemId: string | null = null; |
| 1333 | if (token.refresh_token) { |
| 1334 | refreshItemId = refreshItemIdFor(itemId); |
| 1335 | yield* provider.set(ProviderItemId.make(refreshItemId), token.refresh_token); |
| 1336 | } |
| 1337 | |
| 1338 | const oauthScope = recordedOAuthScope(token, requestedScopes); |
| 1339 | return yield* deps.mintOAuthConnection({ |
| 1340 | owner: target.owner, |
| 1341 | name: target.name, |
| 1342 | integration: target.integration, |
| 1343 | template: target.template, |
| 1344 | identityLabel: target.identityLabel ?? null, |
| 1345 | provider: String(provider.key), |
| 1346 | itemId, |
| 1347 | oauthClient: OAuthClientSlug.make(client.slug), |
| 1348 | oauthClientOwner: clientOwner, |
| 1349 | refreshItemId, |
| 1350 | expiresAt: expiresAtFrom(token), |
| 1351 | // Record the granted scope the AS echoed back. Some providers, including |
| 1352 | // Microsoft, issue a refresh token for `offline_access` but omit that |
| 1353 | // non-resource scope from the token `scope` string, so preserve it when |
| 1354 | // the refresh token proves it was granted. |
| 1355 | oauthScope, |
| 1356 | missingOAuthScopes: |
| 1357 | client.grant === "authorization_code" |
no test coverage detected