(
owner: Owner,
slug: OAuthClientSlug,
)
| 988 | // Load an oauth_client row by (owner, slug). |
| 989 | // ----------------------------------------------------------------------- |
| 990 | const loadClient = ( |
| 991 | owner: Owner, |
| 992 | slug: OAuthClientSlug, |
| 993 | ): Effect.Effect<LoadedOAuthClient | null, StorageFailure> => |
| 994 | deps.fuma |
| 995 | .use("oauth_client.findFirst", (db) => |
| 996 | looseDb(db).findFirst("oauth_client", { |
| 997 | where: (b: any) => b.and(b("owner", "=", owner), b("slug", "=", String(slug))), |
| 998 | }), |
| 999 | ) |
| 1000 | .pipe( |
| 1001 | Effect.flatMap((row) => { |
| 1002 | if (!row) return Effect.succeed(null); |
| 1003 | const grant = parseGrant(row.grant); |
| 1004 | // EXPLICIT — this row drives the token exchange. An unknown grant is a |
| 1005 | // corrupt row; fail loudly rather than guessing authorization_code and |
| 1006 | // running the wrong flow. |
| 1007 | if (grant === null) { |
| 1008 | return Effect.fail( |
| 1009 | new StorageError({ |
| 1010 | message: `oauth_client ${String(slug)} has an unknown grant: ${String(row.grant)}`, |
| 1011 | cause: undefined, |
| 1012 | }), |
| 1013 | ); |
| 1014 | } |
| 1015 | // `client_secret_item_id` is null for DCR-minted / public PKCE clients; |
| 1016 | // the token exchange treats a missing secret as "public client, omit |
| 1017 | // client_secret" (see pickClientAuth). A confidential client persisted |
| 1018 | // its secret to the provider in createClient; resolve it back here. |
| 1019 | return Effect.gen(function* () { |
| 1020 | let clientSecret = ""; |
| 1021 | if (row.client_secret_item_id != null) { |
| 1022 | const provider = deps.defaultWritableProvider(); |
| 1023 | if (provider) { |
| 1024 | clientSecret = |
| 1025 | (yield* provider.get(ProviderItemId.make(String(row.client_secret_item_id)))) ?? |
| 1026 | ""; |
| 1027 | } |
| 1028 | } |
| 1029 | return { |
| 1030 | slug: String(row.slug), |
| 1031 | authorizationUrl: String(row.authorization_url), |
| 1032 | tokenUrl: String(row.token_url), |
| 1033 | grant, |
| 1034 | clientId: String(row.client_id), |
| 1035 | clientSecret, |
| 1036 | resource: row.resource == null ? null : String(row.resource), |
| 1037 | } satisfies LoadedOAuthClient; |
| 1038 | }); |
| 1039 | }), |
| 1040 | ); |
| 1041 | |
| 1042 | // ----------------------------------------------------------------------- |
| 1043 | // start — begin a flow through a client to mint a connection. |
no test coverage detected