Function makeRejectingPlugin

packages/core/sdk/src/oauth-flow.test.ts:2366–2405

(state: {
  revoked: Set<string>;
  /** Reject every token, even a freshly minted one — a dead grant. */
  rejectEverything?: boolean;
  calls: string[];
})

 *  token works") is what lets a test assert that the RETRY succeeded — the
 *  re-minted token is simply one the upstream never revoked. */
const makeRejectingPlugin = (state: {
  revoked: Set<string>;
  /** Reject every token, even a freshly minted one — a dead grant. */
  rejectEverything?: boolean;
  calls: string[];
}) =>
  definePlugin(() => ({
    id: "acme" as const,
    storage: () => ({}),
    resolveTools: () =>
      Effect.succeed({ tools: [{ name: ToolName.make("whoami"), description: "whoami" }] }),
    describeAuthMethods: () => [
      {
        id: "oauth",
        label: "OAuth2",
        kind: "oauth" as const,
        template: String(TEMPLATE),
        oauth: { scopes: [] },
      },
    ],
    invokeTool: ({ credential }) => {
      const token = credential.value;
      state.calls.push(String(token));
      if (token !== null && !state.rejectEverything && !state.revoked.has(token)) {
        return Effect.succeed(ToolResult.ok({ token }));
      }
      return Effect.succeed(
        authToolFailure({
          code: "connection_rejected",
          status: 401,
          message: "Upstream rejected credentials with HTTP 401.",
          integration: { id: String(credential.integration) },
          credential: { kind: "upstream", label: String(credential.connection) },
        }),
      );
    },
    extension: (ctx) => ({
      seed: () => ctx.core.integrations.register({ slug: INTEG, description: "Acme", config: {} }),
    }),
  }))();

/** Mint a connection against `server` and return the harness + call log. */
const connectRejecting = (options?: { readonly tokenExpiresInSeconds?: number }) =>