(
row: ConnectionRow,
provider: CredentialProvider,
trigger: RefreshTrigger,
)
| 2574 | |
| 2575 | // Perform the actual refresh-token grant and persist the rotated material. |
| 2576 | const performTokenRefresh = ( |
| 2577 | row: ConnectionRow, |
| 2578 | provider: CredentialProvider, |
| 2579 | trigger: RefreshTrigger, |
| 2580 | ): Effect.Effect<string | null, StorageFailure | CredentialResolutionError> => |
| 2581 | Effect.gen(function* () { |
| 2582 | const owner = row.owner as Owner; |
| 2583 | const reauth = ( |
| 2584 | message: string, |
| 2585 | options?: { |
| 2586 | readonly credentialMissing?: boolean; |
| 2587 | readonly blockedByAdmin?: boolean; |
| 2588 | }, |
| 2589 | ): CredentialResolutionError => |
| 2590 | new CredentialResolutionError({ |
| 2591 | owner, |
| 2592 | integration: IntegrationSlug.make(row.integration), |
| 2593 | name: ConnectionName.make(row.name), |
| 2594 | message, |
| 2595 | reauthRequired: true, |
| 2596 | ...(options?.credentialMissing === true ? { credentialMissing: true } : {}), |
| 2597 | ...(options?.blockedByAdmin === true ? { blockedByAdmin: true } : {}), |
| 2598 | }); |
| 2599 | |
| 2600 | // A recorded invalid_grant is the AS's standing verdict on this grant: |
| 2601 | // re-sending it cannot succeed, so don't. Fail as reauth-required |
| 2602 | // without a token request — the reconnect mint rewrites |
| 2603 | // `provider_state` and thereby re-arms refresh. Without this gate a |
| 2604 | // dead connection re-sent its dead grant on every proactive cycle, |
| 2605 | // indefinitely (owner.com's Datadog connections: 100+ identical |
| 2606 | // rejections over two days, surfacing nothing). |
| 2607 | const reauthState = oauthReauthRequiredFromProviderState(row.provider_state); |
| 2608 | if (reauthState !== null) { |
| 2609 | yield* Effect.annotateCurrentSpan({ |
| 2610 | "executor.oauth.refresh.skipped_known_dead": true, |
| 2611 | }); |
| 2612 | const recordedHealth = Option.getOrNull(decodeLastHealth(row.last_health)); |
| 2613 | const recordedDetail = |
| 2614 | reauthState.oauthReauthRequiredDetail ?? |
| 2615 | (recordedHealth?.status === "expired" ? recordedHealth.detail : undefined); |
| 2616 | const detail = |
| 2617 | recordedDetail === undefined |
| 2618 | ? "The authorization server rejected this connection's refresh token (invalid_grant). Reconnect to continue." |
| 2619 | : recordedDetail.endsWith("Reconnect to continue.") |
| 2620 | ? recordedDetail |
| 2621 | : `${recordedDetail} Reconnect to continue.`; |
| 2622 | // An admin-policy denial recorded on the dead grant must survive |
| 2623 | // reconstruction: without the flag, callers past the first denial |
| 2624 | // would show ordinary reconnect guidance — the interactive OAuth |
| 2625 | // route the policy contract forbids offering. |
| 2626 | return yield* reauth(detail, { |
| 2627 | blockedByAdmin: recordedDeadGrantReason(reauthState) === "blocked_by_admin", |
| 2628 | }); |
| 2629 | } |
| 2630 | |
| 2631 | // Load the backing app. A `first-party:` slug resolves from host config |
| 2632 | // (deployment-owned identity, in-memory secret); a stored slug loads by |
| 2633 | // the owner STORED on the connection (a Personal connection may be |
no test coverage detected