Function removeClient

packages/core/sdk/src/oauth-service.ts:942–1007

(owner: Owner, slug: OAuthClientSlug)

  // op never cascades into connections).
  // -----------------------------------------------------------------------
  const removeClient = (owner: Owner, slug: OAuthClientSlug): Effect.Effect<void, StorageFailure> =>
    Effect.gen(function* () {
      // Config-declared apps have no row to remove; removing one is an env
      // change on the host, not a storage operation. Fail loudly rather than
      // returning a success that changed nothing.
      if (isFirstPartyOAuthClientSlug(String(slug))) {
        return yield* new StorageError({
          message: `OAuth client "${String(slug)}" is a first-party app declared in host config; it cannot be removed through this surface.`,
          cause: undefined,
        });
      }
      // "Is there an app at (owner, slug) right now?" — asked twice, for two
      // different reasons. Before the delete it says whether this call removes
      // anything at all; after the commit it says whether the secret key still
      // belongs to the app this call removed.
      const findClientRow = deps.fuma.use("oauth_client.findFirst", (db) =>
        looseDb(db).findFirst("oauth_client", {
          where: (b: any) => b.and(b("owner", "=", owner), b("slug", "=", String(slug))),
        }),
      );

      const removedRow = yield* findClientRow;
      yield* deps.fuma
        .use("oauth_client.delete", (db) =>
          looseDb(db).deleteMany("oauth_client", {
            where: (b: any) => b.and(b("owner", "=", owner), b("slug", "=", String(slug))),
          }),
        )
        .pipe(Effect.asVoid);
      // Nothing matched, so this call removed nothing and owns no secret. The
      // idempotent no-op and the cross-subject miss both land here, and both
      // used to queue a delete of a key they never had a claim on.
      if (!removedRow) return;

      // Best-effort: drop the secret from the provider so it isn't orphaned.
      //
      // Deferred to the outermost commit. This function opens no transaction of
      // its own, but a caller can wrap it in one — and `provider.delete` reaches
      // a store that does not roll back with it. An abort would then restore the
      // client row while its secret stayed destroyed, leaving a client that
      // looks configured and can never authenticate again. Orphaning a secret is
      // recoverable; deleting one that is still referenced is not, so the
      // deletion waits until the row's removal is durable. With no transaction
      // active `afterCommit` runs it immediately, which is the behaviour this
      // path already had.
      const provider = deps.defaultWritableProvider();
      const dropSecret = provider?.delete;
      if (provider && dropSecret) {
        yield* afterCommit(
          Effect.gen(function* () {
            // Deferral alone is not enough: the secret is keyed by (owner, slug)
            // ALONE, so the key outlives the row it belonged to. If the same
            // slug is registered again before this hook runs, the key now holds
            // the NEW app's secret, and deleting it recreates exactly the state
            // the deferral exists to prevent — a client that looks configured
            // and can never authenticate. Re-check that the app is still gone
            // and stand down when it is not. A re-check that FAILS is caught
            // below and also stands down, which is the deliberate direction: