Function removeClient

packages/core/sdk/src/oauth-service.ts:1165–1241

(
    owner: Owner,
    slug: OAuthClientSlug,
  )

  // op never cascades into connections).
  // -----------------------------------------------------------------------
  const removeClient = (
    owner: Owner,
    slug: OAuthClientSlug,
  ): Effect.Effect<void, OrgWriteDeniedError | StorageFailure> =>
    Effect.gen(function* () {
      // Config-declared apps have no row to remove; removing one is an env
      // change on the host, not a storage operation. Fail loudly rather than
      // returning a success that changed nothing.
      if (isFirstPartyOAuthClientSlug(String(slug))) {
        return yield* new StorageError({
          message: `OAuth client "${String(slug)}" is a first-party app declared in host config; it cannot be removed through this surface.`,
          cause: undefined,
        });
      }
      yield* deps.guardOrgWrite(owner);
      // "Is there an app at (owner, slug) right now?" — asked twice, for two
      // different reasons. Before the delete it says whether this call removes
      // anything at all; after the commit it says whether the secret key still
      // belongs to the app this call removed.
      const findClientRow = deps.fuma.use("oauth_client.findFirst", (db) =>
        looseDb(db).findFirst("oauth_client", {
          where: (b: any) => b.and(b("owner", "=", owner), b("slug", "=", String(slug))),
        }),
      );

      const removedRow = yield* deps.fuma.transaction(
        Effect.gen(function* () {
          const existing = yield* findClientRow;
          yield* deps.fuma
            .use("oauth_client.delete", (db) =>
              looseDb(db).deleteMany("oauth_client", {
                where: (b: any) => b.and(b("owner", "=", owner), b("slug", "=", String(slug))),
              }),
            )
            .pipe(Effect.asVoid);
          return existing;
        }),
      );
      // Nothing matched, so this call removed nothing and owns no secret. The
      // idempotent no-op and the cross-subject miss both land here, and both
      // used to queue a delete of a key they never had a claim on.
      if (!removedRow) return;
      // Best-effort: drop the secret from the provider so it isn't orphaned.
      //
      // Deferred to the outermost commit. This function opens no transaction of
      // its own, but a caller can wrap it in one — and `provider.delete` reaches
      // a store that does not roll back with it. An abort would then restore the
      // client row while its secret stayed destroyed, leaving a client that
      // looks configured and can never authenticate again. Orphaning a secret is
      // recoverable; deleting one that is still referenced is not, so the
      // deletion waits until the row's removal is durable. With no transaction
      // active `afterCommit` runs it immediately, which is the behaviour this
      // path already had.
      const provider = deps.defaultWritableProvider();
      const dropSecret = provider?.delete;
      if (provider && dropSecret) {
        yield* afterCommit(
          Effect.gen(function* () {