( reauthState: OAuthReauthRequiredState, row: ConnectionRow, )
| 1081 | * that somehow lacks one) gets an expired verdict synthesized from the |
| 1082 | * recorded rejection, unpersisted. */ |
| 1083 | const deadGrantVerdict = ( |
| 1084 | reauthState: OAuthReauthRequiredState, |
| 1085 | row: ConnectionRow, |
| 1086 | ): HealthCheckResult => { |
| 1087 | // The mechanism recorded WITH the dead grant; older records carry none and |
| 1088 | // read as a refresh rejection, which is what recording a dead grant meant |
| 1089 | // before the mechanism was stored. |
| 1090 | const recorded = recordedDeadGrantReason(reauthState) ?? "credential_refresh_rejected"; |
| 1091 | const cached = Option.getOrNull(decodeLastHealth(row.last_health)); |
| 1092 | // Backfill the mechanism onto verdicts persisted before `reason` existed |
| 1093 | // (or by writers that omit it) — otherwise every pre-existing dead grant |
| 1094 | // would present reasonless spans indefinitely. |
| 1095 | if (cached !== null && cached.status === "expired") { |
| 1096 | return cached.reason !== undefined ? cached : { ...cached, reason: recorded }; |
| 1097 | } |
| 1098 | return { |
| 1099 | status: "expired", |
| 1100 | checkedAt: reauthState.oauthReauthRequiredAt, |
| 1101 | detail: |
| 1102 | reauthState.oauthReauthRequiredDetail ?? |
| 1103 | "The authorization server rejected this connection's refresh token (invalid_grant). Reconnect to continue.", |
| 1104 | reason: recorded, |
| 1105 | }; |
| 1106 | }; |
| 1107 | |
| 1108 | /** The health a connection row presents on every API read. Derived, never |
| 1109 | * written back: while `provider_state` records a dead grant, the row |
no test coverage detected