Function loadedFirstPartyClient

packages/core/sdk/src/oauth-service.ts:613–639

(
  config: FirstPartyOAuthClientConfig,
)

 *  client_credentials mints machine tokens under the OPERATOR's app identity,
 *  which must never be shared across tenants. */
export const loadedFirstPartyClient = (
  config: FirstPartyOAuthClientConfig,
): {
  readonly slug: string;
  readonly authorizationUrl: string;
  readonly tokenUrl: string;
  readonly grant: OAuthGrant;
  readonly clientId: string;
  readonly clientSecret: string;
  readonly resource: string | null;
  readonly tokenEndpointAuthMethod?: "body" | "basic";
  readonly tokenRequestFormat?: "form" | "json";
} => ({
  slug: String(firstPartyOAuthClientSlug(config.name)),
  authorizationUrl: config.authorizationUrl,
  tokenUrl: config.tokenUrl,
  grant: "authorization_code",
  clientId: config.clientId,
  clientSecret: config.clientSecret,
  resource: config.resource ?? null,
  ...(config.tokenEndpointAuthMethod === undefined
    ? {}
    : { tokenEndpointAuthMethod: config.tokenEndpointAuthMethod }),
  ...(config.tokenRequestFormat === undefined
    ? {}
    : { tokenRequestFormat: config.tokenRequestFormat }),
});

export const makeOAuthService = (deps: OAuthServiceDeps): OAuthService => {
  const httpClientLayer = deps.httpClientLayer ?? FetchHttpClient.layer;