Function createClient

packages/core/sdk/src/oauth-service.ts:877–1113

(
    input: CreateOAuthClientInput,
  )

  // createClient — write the oauth_client row.
  // -----------------------------------------------------------------------
  const createClient = (
    input: CreateOAuthClientInput,
  ): Effect.Effect<OAuthClientSlug, OrgWriteDeniedError | StorageFailure> =>
    Effect.gen(function* () {
      // The `first-party:` namespace is reserved for config-declared apps — a
      // stored row under it would be shadowed by (or worse, impersonate) the
      // host's own app.
      if (isFirstPartyOAuthClientSlug(String(input.slug))) {
        return yield* new StorageError({
          message: `OAuth client slug "${String(input.slug)}" uses the reserved first-party namespace.`,
          cause: undefined,
        });
      }
      yield* deps.guardOrgWrite(input.owner);
      yield* validateClientEndpoints(input, deps.endpointUrlPolicy);
      if (
        input.tokenEndpointAuthMethod !== undefined &&
        input.tokenEndpointAuthMethod !== "body" &&
        input.clientSecret.length === 0
      ) {
        return yield* new StorageError({
          message: "HTTP Basic token endpoint authentication requires a client secret.",
          cause: undefined,
        });
      }
      const keys = yield* Effect.try({
        try: () => deps.ownedKeys(input.owner),
        catch: (cause) =>
          new StorageError({
            message: "Cannot write oauth_client for owner without a subject",
            cause,
          }),
      });
      const now = new Date();

      // Resolve the out-of-band write up front, but do not mutate the provider
      // until the database transaction commits.
      let clientSecretItemIdValue: string | null = null;
      let credentialWrite: CredentialWriteAttempt | null = null;
      let secretWrite: CredentialWriteSnapshot | undefined;
      if (input.clientSecret.length > 0) {
        const provider = deps.defaultWritableProvider();
        if (!provider || !provider.set) {
          return yield* new StorageError({
            message:
              "No default writable credential provider is registered to store the OAuth client secret.",
            cause: undefined,
          });
        }
        const attemptId = crypto.randomUUID();
        credentialWrite = makeCredentialWriteAttempt(deps.credentialWriteRuntimeId, attemptId);
        clientSecretItemIdValue = credentialAttemptItemId(
          clientSecretItemId(input.owner, input.slug),
          attemptId,
        );
        const itemId = ProviderItemId.make(clientSecretItemIdValue);
        const [snapshot] = yield* snapshotCredentialWrites(
          { ...provider, set: provider.set },