(
target: {
readonly owner: Owner;
readonly name: ConnectionName;
readonly integration: IntegrationSlug;
readonly template: AuthTemplateSlug;
readonly identityLabel?: string | null;
},
client: LoadedOAuthClient,
token: OAuth2TokenResponse,
/** The scope set requested at /authorize + /token (the integration's
* declared or discovered scopes) — the recorded-scope fallback when the AS
* omits `scope`. */
requestedScopes: readonly string[],
/** The owner of `client` — persisted so refresh loads it by explicit owner. */
clientOwner: Owner,
/** Regional token endpoint override to persist when the code was redeemed
* off the client's configured host; null to use the client's token URL. */
oauthTokenUrl: string | null,
)
| 1340 | // connection row with OAuth lifecycle fields + produce its tools. |
| 1341 | // ----------------------------------------------------------------------- |
| 1342 | const mintFromToken = ( |
| 1343 | target: { |
| 1344 | readonly owner: Owner; |
| 1345 | readonly name: ConnectionName; |
| 1346 | readonly integration: IntegrationSlug; |
| 1347 | readonly template: AuthTemplateSlug; |
| 1348 | readonly identityLabel?: string | null; |
| 1349 | }, |
| 1350 | client: LoadedOAuthClient, |
| 1351 | token: OAuth2TokenResponse, |
| 1352 | /** The scope set requested at /authorize + /token (the integration's |
| 1353 | * declared or discovered scopes) — the recorded-scope fallback when the AS |
| 1354 | * omits `scope`. */ |
| 1355 | requestedScopes: readonly string[], |
| 1356 | /** The owner of `client` — persisted so refresh loads it by explicit owner. */ |
| 1357 | clientOwner: Owner, |
| 1358 | /** Regional token endpoint override to persist when the code was redeemed |
| 1359 | * off the client's configured host; null to use the client's token URL. */ |
| 1360 | oauthTokenUrl: string | null, |
| 1361 | ): Effect.Effect<Connection, StorageFailure> => |
| 1362 | Effect.gen(function* () { |
| 1363 | const provider = deps.defaultWritableProvider(); |
| 1364 | if (!provider || !provider.set) { |
| 1365 | return yield* new StorageError({ |
| 1366 | message: |
| 1367 | "No default writable credential provider is registered to store the OAuth access token.", |
| 1368 | cause: undefined, |
| 1369 | }); |
| 1370 | } |
| 1371 | const itemId = accessItemId(target.owner, target.integration, target.name); |
| 1372 | yield* provider.set(ProviderItemId.make(itemId), token.access_token); |
| 1373 | |
| 1374 | let refreshItemId: string | null = null; |
| 1375 | if (token.refresh_token) { |
| 1376 | refreshItemId = refreshItemIdFor(itemId); |
| 1377 | yield* provider.set(ProviderItemId.make(refreshItemId), token.refresh_token); |
| 1378 | } |
| 1379 | |
| 1380 | const oauthScope = recordedOAuthScope(token, requestedScopes); |
| 1381 | return yield* deps.mintOAuthConnection({ |
| 1382 | owner: target.owner, |
| 1383 | name: target.name, |
| 1384 | integration: target.integration, |
| 1385 | template: target.template, |
| 1386 | identityLabel: target.identityLabel ?? null, |
| 1387 | provider: String(provider.key), |
| 1388 | itemId, |
| 1389 | oauthClient: OAuthClientSlug.make(client.slug), |
| 1390 | oauthClientOwner: clientOwner, |
| 1391 | refreshItemId, |
| 1392 | expiresAt: expiresAtFrom(token), |
| 1393 | // Record the granted scope the AS echoed back. Some providers, including |
| 1394 | // Microsoft, issue a refresh token for `offline_access` but omit that |
| 1395 | // non-resource scope from the token `scope` string, so preserve it when |
| 1396 | // the refresh token proves it was granted. |
| 1397 | oauthScope, |
| 1398 | missingOAuthScopes: |
| 1399 | client.grant === "authorization_code" |
no test coverage detected