( input: CreateOAuthClientInput, endpointUrlPolicy: OAuthEndpointUrlPolicy | undefined, )
| 539 | }).pipe(Effect.asVoid); |
| 540 | |
| 541 | const validateClientEndpoints = ( |
| 542 | input: CreateOAuthClientInput, |
| 543 | endpointUrlPolicy: OAuthEndpointUrlPolicy | undefined, |
| 544 | ): Effect.Effect<void, StorageFailure> => |
| 545 | Effect.gen(function* () { |
| 546 | yield* validateSupportedEndpoint(input.tokenUrl, "token_url", endpointUrlPolicy); |
| 547 | if (input.resource != null && input.resource.trim().length > 0) { |
| 548 | yield* validateSupportedEndpoint(input.resource, "resource", endpointUrlPolicy); |
| 549 | } |
| 550 | if (input.grant !== "authorization_code") return; |
| 551 | yield* validateSupportedEndpoint( |
| 552 | input.authorizationUrl, |
| 553 | "authorization_url", |
| 554 | endpointUrlPolicy, |
| 555 | ); |
| 556 | if (isWellKnownOAuthMetadataUrl(input.authorizationUrl)) { |
| 557 | return yield* new StorageError({ |
| 558 | message: |
| 559 | "Invalid OAuth client endpoint configuration: authorization_url must be the OAuth authorization endpoint, not a .well-known metadata URL.", |
| 560 | cause: undefined, |
| 561 | }); |
| 562 | } |
| 563 | if (canonicalUrlString(input.authorizationUrl) === canonicalUrlString(input.tokenUrl)) { |
| 564 | return yield* new StorageError({ |
| 565 | message: |
| 566 | "Invalid OAuth client endpoint configuration: authorization_url must not equal token_url.", |
| 567 | cause: undefined, |
| 568 | }); |
| 569 | } |
| 570 | }); |
| 571 | |
| 572 | /** Resolve a config-declared first-party app to the loaded-client shape the |
| 573 | * flow/refresh paths consume. First-party apps are authorization_code only: |
no test coverage detected