Function decideDcrClientReuse

packages/core/sdk/src/oauth-service.ts:1112–1176

(
    input: RegisterDynamicClientInput,
    issuer: string | null,
    flowRedirectUri: string | null,
  )

      );

  const decideDcrClientReuse = (
    input: RegisterDynamicClientInput,
    issuer: string | null,
    flowRedirectUri: string | null,
  ): Effect.Effect<
    {
      readonly existingSlug: OAuthClientSlug | null;
      readonly registrationSlug: OAuthClientSlug;
    },
    StorageFailure
  > =>
    Effect.gen(function* () {
      const candidates = yield* dcrCandidatesForIssuer(input.owner, issuer);
      const resource = input.resource ?? null;
      // A candidate is reusable only when the callback it registered with the
      // AS still matches the current flow's callback — strict servers reject an
      // authorize request whose redirect_uri differs from the registration
      // (e.g. the callback origin changed after a sandbox was recreated while
      // the persisted client survived). A null stored redirect is a legacy row
      // predating the column: treated as matching so an upgrade doesn't
      // re-register every client whose callback never changed. A null FLOW
      // redirect has nothing to compare against, so it also reuses — the only
      // alternative is a fresh registration, which the missing-redirectUri
      // guard would fail.
      const redirectMatches = (candidate: DcrReuseCandidate): boolean =>
        candidate.redirectUri === null ||
        flowRedirectUri === null ||
        candidate.redirectUri === flowRedirectUri;
      // A fresh registration must never take a slug an existing candidate
      // holds: `createClient` deletes any colliding (owner, slug) row first,
      // which would clobber a client that live connections still refresh
      // through (a redirect-mismatched client stays valid for refresh — the
      // token grant doesn't involve the redirect URI).
      const takenSlugs = new Set(candidates.map((client) => String(client.slug)));
      if (resource !== null) {
        const matchingResource = candidates.find((client) => client.resource === resource);
        if (matchingResource && redirectMatches(matchingResource)) {
          return { existingSlug: matchingResource.slug, registrationSlug: matchingResource.slug };
        }
        const slug = uniqueDcrSlug(
          dcrClientSlug(issuer, candidates.length > 0 ? resource : null, input.slug),
          takenSlugs,
        );
        return {
          existingSlug: null,
          registrationSlug: slug,
        };
      }

      // Resource-less request: only reuse a resource-LESS candidate. A client
      // minted for a specific RFC 8707 resource must NOT be reused for a
      // resource-less flow (its tokens are bound to that resource), so when only
      // resource-scoped candidates exist we register a fresh resource-less client
      // rather than silently borrowing one (the old `?? candidates[0]` bug).
      const reusable = candidates.find(
        (client) => client.resource === null && redirectMatches(client),
      );
      if (reusable) return { existingSlug: reusable.slug, registrationSlug: reusable.slug };