(
owner: Owner,
slug: OAuthClientSlug,
)
| 1324 | // Load an oauth_client row by (owner, slug). |
| 1325 | // ----------------------------------------------------------------------- |
| 1326 | const loadClient = ( |
| 1327 | owner: Owner, |
| 1328 | slug: OAuthClientSlug, |
| 1329 | ): Effect.Effect<LoadedOAuthClient | null, StorageFailure> => { |
| 1330 | // First-party apps resolve from config, never storage. Owner is irrelevant: |
| 1331 | // the app belongs to the DEPLOYMENT, and visibility policy has nothing to |
| 1332 | // narrow — only the minted connection (and its tokens) is owner-scoped. |
| 1333 | if (isFirstPartyOAuthClientSlug(String(slug))) { |
| 1334 | const config = firstPartyBySlug.get(String(slug)); |
| 1335 | return Effect.succeed(config ? loadedFirstPartyClient(config) : null); |
| 1336 | } |
| 1337 | return deps.fuma |
| 1338 | .use("oauth_client.findFirst", (db) => |
| 1339 | looseDb(db).findFirst("oauth_client", { |
| 1340 | where: (b: any) => b.and(b("owner", "=", owner), b("slug", "=", String(slug))), |
| 1341 | }), |
| 1342 | ) |
| 1343 | .pipe( |
| 1344 | Effect.flatMap((row) => { |
| 1345 | if (!row) return Effect.succeed(null); |
| 1346 | const grant = parseGrant(row.grant); |
| 1347 | // EXPLICIT — this row drives the token exchange. An unknown grant is a |
| 1348 | // corrupt row; fail loudly rather than guessing authorization_code and |
| 1349 | // running the wrong flow. |
| 1350 | if (grant === null) { |
| 1351 | return Effect.fail( |
| 1352 | new StorageError({ |
| 1353 | message: `oauth_client ${String(slug)} has an unknown grant: ${String(row.grant)}`, |
| 1354 | cause: undefined, |
| 1355 | }), |
| 1356 | ); |
| 1357 | } |
| 1358 | // `client_secret_item_id` is null for DCR-minted / public PKCE clients; |
| 1359 | // the token exchange treats a missing secret as "public client, omit |
| 1360 | // client_secret" (see pickClientAuth). A confidential client persisted |
| 1361 | // its secret to the provider in createClient; resolve it back here. |
| 1362 | return Effect.gen(function* () { |
| 1363 | let clientSecret = ""; |
| 1364 | if (row.client_secret_item_id != null) { |
| 1365 | const provider = deps.defaultWritableProvider(); |
| 1366 | if (provider) { |
| 1367 | clientSecret = |
| 1368 | (yield* provider.get(ProviderItemId.make(String(row.client_secret_item_id)))) ?? |
| 1369 | ""; |
| 1370 | } |
| 1371 | } |
| 1372 | return { |
| 1373 | slug: String(row.slug), |
| 1374 | authorizationUrl: String(row.authorization_url), |
| 1375 | tokenUrl: String(row.token_url), |
| 1376 | grant, |
| 1377 | clientId: String(row.client_id), |
| 1378 | clientSecret, |
| 1379 | resource: row.resource == null ? null : String(row.resource), |
| 1380 | } satisfies LoadedOAuthClient; |
| 1381 | }); |
| 1382 | }), |
| 1383 | ); |
no test coverage detected