(
owner: Owner,
slug: OAuthClientSlug,
)
| 975 | // Load an oauth_client row by (owner, slug). |
| 976 | // ----------------------------------------------------------------------- |
| 977 | const loadClient = ( |
| 978 | owner: Owner, |
| 979 | slug: OAuthClientSlug, |
| 980 | ): Effect.Effect<LoadedOAuthClient | null, StorageFailure> => |
| 981 | deps.fuma |
| 982 | .use("oauth_client.findFirst", (db) => |
| 983 | looseDb(db).findFirst("oauth_client", { |
| 984 | where: (b: any) => b.and(b("owner", "=", owner), b("slug", "=", String(slug))), |
| 985 | }), |
| 986 | ) |
| 987 | .pipe( |
| 988 | Effect.flatMap((row) => { |
| 989 | if (!row) return Effect.succeed(null); |
| 990 | const grant = parseGrant(row.grant); |
| 991 | // EXPLICIT — this row drives the token exchange. An unknown grant is a |
| 992 | // corrupt row; fail loudly rather than guessing authorization_code and |
| 993 | // running the wrong flow. |
| 994 | if (grant === null) { |
| 995 | return Effect.fail( |
| 996 | new StorageError({ |
| 997 | message: `oauth_client ${String(slug)} has an unknown grant: ${String(row.grant)}`, |
| 998 | cause: undefined, |
| 999 | }), |
| 1000 | ); |
| 1001 | } |
| 1002 | // `client_secret_item_id` is null for DCR-minted / public PKCE clients; |
| 1003 | // the token exchange treats a missing secret as "public client, omit |
| 1004 | // client_secret" (see pickClientAuth). A confidential client persisted |
| 1005 | // its secret to the provider in createClient; resolve it back here. |
| 1006 | return Effect.gen(function* () { |
| 1007 | let clientSecret = ""; |
| 1008 | if (row.client_secret_item_id != null) { |
| 1009 | const provider = deps.defaultWritableProvider(); |
| 1010 | if (provider) { |
| 1011 | clientSecret = |
| 1012 | (yield* provider.get(ProviderItemId.make(String(row.client_secret_item_id)))) ?? |
| 1013 | ""; |
| 1014 | } |
| 1015 | } |
| 1016 | return { |
| 1017 | slug: String(row.slug), |
| 1018 | authorizationUrl: String(row.authorization_url), |
| 1019 | tokenUrl: String(row.token_url), |
| 1020 | grant, |
| 1021 | clientId: String(row.client_id), |
| 1022 | clientSecret, |
| 1023 | resource: row.resource == null ? null : String(row.resource), |
| 1024 | } satisfies LoadedOAuthClient; |
| 1025 | }); |
| 1026 | }), |
| 1027 | ); |
| 1028 | |
| 1029 | // ----------------------------------------------------------------------- |
| 1030 | // start — begin a flow through a client to mint a connection. |
no test coverage detected