Function makeOAuthService

packages/core/sdk/src/oauth-service.ts:672–2504

(deps: OAuthServiceDeps)

});

export const makeOAuthService = (deps: OAuthServiceDeps): OAuthService => {
  const httpClientLayer = deps.httpClientLayer ?? FetchHttpClient.layer;
  const fetch = deps.fetch;
  // Config-declared first-party apps, keyed by their prefixed slug. Config is
  // the source of truth — no row exists, so every stored-row path (CRUD, GC)
  // is bypassed by construction, and rotating a secret is an env change.
  const firstPartyBySlug = new Map(
    (deps.firstPartyClients ?? []).map((client) => [
      String(firstPartyOAuthClientSlug(client.name)),
      client,
    ]),
  );
  // EXPLICIT — no localhost default. `null` means this executor has no OAuth
  // callback; redirect-requiring flows fail loudly via `requireRedirectUri`.
  const redirectUri = deps.redirectUri;
  const discoveryOptions = { endpointUrlPolicy: deps.endpointUrlPolicy };

  // -------------------------------------------------------------------------
  // Enterprise-managed rollout seam.
  //
  // ROLLOUT SEMANTIC, stated once here because it is the whole reason the gate
  // sits where it does: the gate answers "may this connect attempt the
  // enterprise-managed path", and nothing else. It runs once, before discovery,
  // so a withheld verdict costs no round trip and spends no identity assertion.
  // The verdict it produces is then FROZEN onto the connection
  // (`ENTERPRISE_MANAGED_PROVIDER_STATE_KEY`), and the credential-refresh path
  // reads that state instead of re-asking. Turning the flag off therefore stops
  // new enterprise-managed connects and leaves every existing one renewing — no
  // stranded connections, no silent downgrade, and no third-party network
  // dependency anywhere in credential resolution.
  // -------------------------------------------------------------------------
  const rollout = deps.enterpriseManagedRollout;

  /** The gate's verdict, or "enabled" when no host injected a gate. */
  const decideEnterpriseManagedRollout = (
    context: EnterpriseManagedRolloutContext,
  ): Effect.Effect<EnterpriseManagedRolloutDecision> =>
    rollout === undefined
      ? Effect.succeed(ENTERPRISE_MANAGED_ROLLOUT_ENABLED)
      : rollout.decide(context);

  /** Best-effort rollout observation. Failures AND defects are discarded here,
   *  so no implementation of `record` can fail a connect or change its outcome;
   *  keeping it off the critical path is the host's side of the contract.
   *  Mirrors how `afterCommit` treats `onIntegrationChange`. */
  const recordEnterpriseManagedRollout = (
    event: EnterpriseManagedRolloutEvent,
  ): Effect.Effect<void> =>
    rollout === undefined
      ? Effect.void
      : rollout.record(event).pipe(Effect.ignoreCause({ log: false }));

  const filterAuthorizationCodeScopes = (
    client: LoadedOAuthClient,
    requestedScopes: readonly string[],
  ): Effect.Effect<readonly string[], never> =>
    Effect.gen(function* () {
      if (requestedScopes.length === 0) return requestedScopes;