import type { Connection } from "@executor-js/sdk/shared"; import type { OAuthStartPayload } from "./oauth-sign-in"; // ---------------------------------------------------------------------------// OAuth scope helpers (pure) — shared by Reconnect (re-consent) and the connect// modal's informational subset-scope warning. Kept React/atom-free so they are// unit-testable in isolation.// --------------------------------------------------------------------------- /** How a connection should be re-connected: *  - `"oauth"` — it came from an OAuth flow (`oauthClient != null`); a token *    refresh CANNOT widen scopes and FAILS when there is no refresh token, so *    Reconnect must RE-RUN the OAuth flow (prompt=consent + the widened scope *    union), re-minting the SAME connection (owner/integration/name). *  - `"refresh"` — a static credential / non-OAuth connection; Reconnect is the *    existing token-refresh mutation. */export type ReconnectMode = "oauth" | "refresh"; /** An OAuth connection carries the `oauthClient` slug that minted it; a static *  credential does not. That single field decides the Reconnect path. */export function reconnectMode(connection: Connection): ReconnectMode {  return connection.oauthClient != null ? "oauth" : "refresh";} /** Build the `oauth.start` payload that re-runs the OAuth flow for an existing *  OAuth connection. The branded `name`/`template`/`oauthClient` carried by the *  connection are exactly the branded types `oauth.start` expects, so the same *  connection (owner/integration/name) is re-minted with a fresh refresh token *  and the widened scope union. Returns null for a non-OAuth connection. */export function oauthReconnectPayload(connection: Connection): OAuthStartPayload | null {  if (connection.oauthClient == null) return null;  return {    client: connection.oauthClient,    // The app's stored owner (a Personal connection may be backed by a shared    // Workspace app); fall back to the connection owner for same-owner connects.    clientOwner: connection.oauthClientOwner ?? connection.owner,    owner: connection.owner,    name: connection.name,    integration: connection.integration,    template: connection.template,    identityLabel: connection.identityLabel ?? undefined,  };} // ---------------------------------------------------------------------------// Subset-scope warning (Part 2). At connect, when the chosen OAuth app's// DECLARED scopes are a STRICT subset of the integration's declared scopes, the// app grants fewer scopes than the integration needs. Connect already requests// the UNION, so this is purely INFORMATIONAL: the gap is in the provider-app /// GCP API enablement the user controls, surfaced so a rejected sign-in is// explicable. Never blocks connect.// --------------------------------------------------------------------------- const OAUTH_SCOPE_ALIASES: Readonly<Record<string, string>> = {  // Google accepts OIDC shorthand scopes but records the expanded People API  // scopes in token responses. Treat them as the same grant for reconsent UI.  "https://www.googleapis.com/auth/userinfo.email": "email",  "https://www.googleapis.com/auth/userinfo.profile": "profile",}; const canonicalScope = (scope: string): string => OAUTH_SCOPE_ALIASES[scope] ?? scope; /** Normalize a scope list: trim, canonicalize known provider aliases, drop *  empties, de-dupe (order-preserving). A scope set is compared as a SET — *  duplicates and blanks never widen it. */const normalizeScopes = (scopes: readonly string[]): readonly string[] => {  const seen = new Set<string>();  const out: string[] = [];  for (const raw of scopes) {    const scope = canonicalScope(raw.trim());    if (scope.length === 0 || seen.has(scope)) continue;    seen.add(scope);    out.push(scope);  }  return out;}; /** Scopes in `needed` that `granted` does NOT cover — generic set difference *  (needed − granted), order-preserving. Empty when `granted` is a superset/equal *  or `needed` is empty. */export function missingScopes(  needed: readonly string[] | undefined,  granted: readonly string[] | undefined,): readonly string[] {  const want = normalizeScopes(needed ?? []);  if (want.length === 0) return [];  const have = new Set(normalizeScopes(granted ?? []));  return want.filter((scope: string) => !have.has(scope));} /** The scopes a connection was actually GRANTED, parsed from its space-delimited *  `oauthScope` record. Empty for static creds / when the AS omitted scope. */export function connectionGrantedScopes(connection: Connection): readonly string[] {  return connection.oauthScope ? connection.oauthScope.split(/\s+/).filter(Boolean) : [];} /** Whether an OAuth connection must RECONNECT to grant newly-needed access: the *  integration now DECLARES scopes the connection was not granted (e.g. after the *  integration added a service). Drives the "reconnect to grant access" prompt. *  Compares the integration's declared scopes (needed) against the connection's *  recorded grant — `oauth_scope` made load-bearing. False for non-OAuth *  connections and when the grant already covers everything declared. */export function connectionNeedsReconsent(  connection: Connection,  declaredScopes: readonly string[] | undefined,): boolean {  if (connection.oauthClient == null) return false;  return missingScopes(declaredScopes, connectionGrantedScopes(connection)).length > 0;}