( reauthState: OAuthReauthRequiredState, row: ConnectionRow, )
| 1020 | * that somehow lacks one) gets an expired verdict synthesized from the |
| 1021 | * recorded rejection, unpersisted. */ |
| 1022 | const deadGrantVerdict = ( |
| 1023 | reauthState: OAuthReauthRequiredState, |
| 1024 | row: ConnectionRow, |
| 1025 | ): HealthCheckResult => { |
| 1026 | // The mechanism recorded WITH the dead grant; older records carry none and |
| 1027 | // read as a refresh rejection, which is what recording a dead grant meant |
| 1028 | // before the mechanism was stored. |
| 1029 | const recorded = recordedDeadGrantReason(reauthState) ?? "credential_refresh_rejected"; |
| 1030 | const cached = Option.getOrNull(decodeLastHealth(row.last_health)); |
| 1031 | // Backfill the mechanism onto verdicts persisted before `reason` existed |
| 1032 | // (or by writers that omit it) — otherwise every pre-existing dead grant |
| 1033 | // would present reasonless spans indefinitely. |
| 1034 | if (cached !== null && cached.status === "expired") { |
| 1035 | return cached.reason !== undefined ? cached : { ...cached, reason: recorded }; |
| 1036 | } |
| 1037 | return { |
| 1038 | status: "expired", |
| 1039 | checkedAt: reauthState.oauthReauthRequiredAt, |
| 1040 | detail: |
| 1041 | reauthState.oauthReauthRequiredDetail ?? |
| 1042 | "The authorization server rejected this connection's refresh token (invalid_grant). Reconnect to continue.", |
| 1043 | reason: recorded, |
| 1044 | }; |
| 1045 | }; |
| 1046 | |
| 1047 | /** The health a connection row presents on every API read. Derived, never |
| 1048 | * written back: while `provider_state` records a dead grant, the row |
no test coverage detected