( input: CreateOAuthClientInput, endpointUrlPolicy: OAuthEndpointUrlPolicy | undefined, )
| 470 | }).pipe(Effect.asVoid); |
| 471 | |
| 472 | const validateClientEndpoints = ( |
| 473 | input: CreateOAuthClientInput, |
| 474 | endpointUrlPolicy: OAuthEndpointUrlPolicy | undefined, |
| 475 | ): Effect.Effect<void, StorageFailure> => |
| 476 | Effect.gen(function* () { |
| 477 | yield* validateSupportedEndpoint(input.tokenUrl, "token_url", endpointUrlPolicy); |
| 478 | if (input.resource != null && input.resource.trim().length > 0) { |
| 479 | yield* validateSupportedEndpoint(input.resource, "resource", endpointUrlPolicy); |
| 480 | } |
| 481 | if (input.grant !== "authorization_code") return; |
| 482 | yield* validateSupportedEndpoint( |
| 483 | input.authorizationUrl, |
| 484 | "authorization_url", |
| 485 | endpointUrlPolicy, |
| 486 | ); |
| 487 | if (isWellKnownOAuthMetadataUrl(input.authorizationUrl)) { |
| 488 | return yield* new StorageError({ |
| 489 | message: |
| 490 | "Invalid OAuth client endpoint configuration: authorization_url must be the OAuth authorization endpoint, not a .well-known metadata URL.", |
| 491 | cause: undefined, |
| 492 | }); |
| 493 | } |
| 494 | if (canonicalUrlString(input.authorizationUrl) === canonicalUrlString(input.tokenUrl)) { |
| 495 | return yield* new StorageError({ |
| 496 | message: |
| 497 | "Invalid OAuth client endpoint configuration: authorization_url must not equal token_url.", |
| 498 | cause: undefined, |
| 499 | }); |
| 500 | } |
| 501 | }); |
| 502 | |
| 503 | /** Resolve a config-declared first-party app to the loaded-client shape the |
| 504 | * flow/refresh paths consume. First-party apps are authorization_code only: |
no test coverage detected