( input: CreateOAuthClientInput, endpointUrlPolicy: OAuthEndpointUrlPolicy | undefined, )
| 576 | }).pipe(Effect.asVoid); |
| 577 | |
| 578 | const validateClientEndpoints = ( |
| 579 | input: CreateOAuthClientInput, |
| 580 | endpointUrlPolicy: OAuthEndpointUrlPolicy | undefined, |
| 581 | ): Effect.Effect<void, StorageFailure> => |
| 582 | Effect.gen(function* () { |
| 583 | yield* validateSupportedEndpoint(input.tokenUrl, "token_url", endpointUrlPolicy); |
| 584 | if (input.resource != null && input.resource.trim().length > 0) { |
| 585 | yield* validateSupportedEndpoint(input.resource, "resource", endpointUrlPolicy); |
| 586 | } |
| 587 | if (input.grant !== "authorization_code") return; |
| 588 | yield* validateSupportedEndpoint( |
| 589 | input.authorizationUrl, |
| 590 | "authorization_url", |
| 591 | endpointUrlPolicy, |
| 592 | ); |
| 593 | if (isWellKnownOAuthMetadataUrl(input.authorizationUrl)) { |
| 594 | return yield* new StorageError({ |
| 595 | message: |
| 596 | "Invalid OAuth client endpoint configuration: authorization_url must be the OAuth authorization endpoint, not a .well-known metadata URL.", |
| 597 | cause: undefined, |
| 598 | }); |
| 599 | } |
| 600 | if (canonicalUrlString(input.authorizationUrl) === canonicalUrlString(input.tokenUrl)) { |
| 601 | return yield* new StorageError({ |
| 602 | message: |
| 603 | "Invalid OAuth client endpoint configuration: authorization_url must not equal token_url.", |
| 604 | cause: undefined, |
| 605 | }); |
| 606 | } |
| 607 | }); |
| 608 | |
| 609 | /** Resolve a config-declared first-party app to the loaded-client shape the |
| 610 | * flow/refresh paths consume. First-party apps are authorization_code only: |
no test coverage detected