Function makeProvider

packages/plugins/onepassword/src/sdk/plugin.ts:282–348

(
  ctx: PluginCtx<OnePasswordStore>,
  timeoutMs: number,
  preferSdk: boolean | undefined,
)

// ---------------------------------------------------------------------------

const makeProvider = (
  ctx: PluginCtx<OnePasswordStore>,
  timeoutMs: number,
  preferSdk: boolean | undefined,
): CredentialProvider => ({
  key: PROVIDER_KEY,
  writable: false,

  get: (id: ProviderItemId): Effect.Effect<string | null, StorageFailure> =>
    ctx.storage.getConfig().pipe(
      // An undecodable stored config reads as "not configured" here; the
      // settings surface reports the decode problem.
      Effect.catchTag("OnePasswordError", () => Effect.succeed(null)),
      Effect.flatMap((config) => {
        if (!config) return Effect.succeed(null as string | null);

        return getServiceFromConfig(config, timeoutMs, preferSdk).pipe(
          Effect.flatMap((svc) => resolveConfiguredRef(svc, config, id)),
          // Backend unreachability degrades to "no value", matching the other
          // providers. Ambiguity does NOT: silently picking a vault (or
          // silently failing) hides a real conflict, so it surfaces as a
          // typed failure with the full explanation.
          Effect.catch(() => Effect.succeed({ kind: "not-found" } as RefResolution)),
          Effect.flatMap(
            (resolution): Effect.Effect<string | null, StorageError> =>
              resolution.kind === "ambiguous"
                ? Effect.fail(
                    new StorageError({
                      message: ambiguityMessage(id, resolution.matches),
                      cause: undefined,
                    }),
                  )
                : Effect.succeed(resolution.kind === "resolved" ? resolution.value : null),
          ),
        );
      }),
    ),

  list: (): Effect.Effect<readonly ProviderEntry[], StorageFailure> =>
    ctx.storage.getConfig().pipe(
      Effect.flatMap((config) => {
        if (!config) return Effect.succeed([] as readonly ProviderEntry[]);
        return getServiceFromConfig(config, timeoutMs, preferSdk).pipe(
          Effect.flatMap((svc) =>
            Effect.forEach(config.vaults, (vault) =>
              svc.listItems(vault.id).pipe(
                Effect.map((items) =>
                  items.map(
                    // Vault-qualified ids: picking an entry permanently
                    // records which vault it came from, so identically-titled
                    // items in different vaults can never collide.
                    (item): ProviderEntry => ({
                      id: ProviderItemId.make(`op://${vault.id}/${item.id}`),
                      name: item.title,
                      group: vault.name,
                    }),
                  ),
                ),