Function vantaTokenCacheKey

apps/sim/tools/vanta/utils.ts:165–174

* Derives the cache key for a credential set. The client secret is included * only as a SHA-256 digest so plaintext secrets never persist in the * long-lived cache maps.

(params: VantaTokenParams)

 * long-lived cache maps.
 */
async function vantaTokenCacheKey(params: VantaTokenParams): Promise<string> {
  const digest = await crypto.subtle.digest(
    'SHA-256',
    new TextEncoder().encode(`${params.clientId}:${params.clientSecret}`)
  )
  const secretHash = Array.from(new Uint8Array(digest))
    .map((byte) => byte.toString(16).padStart(2, '0'))
    .join('')
  return [params.region ?? 'us', params.scope, params.clientId, secretHash].join('|')
}

async function exchangeVantaToken(params: VantaTokenParams, cacheKey: string): Promise<string> {
  const response = await fetch(`${getVantaBaseUrl(params.region)}/oauth/token`, {