// ---------------------------------------------------------------------------// Generic helpers for storing OAuth token secrets and transparently// refreshing access tokens before a request.//// Plugins (google-discovery, openapi) supply an adapter for their secrets// API and a `persistAuth` callback so this module stays decoupled from any// specific plugin SDK or store shape.// --------------------------------------------------------------------------- import { Effect } from "effect"; import { OAuth2Error, type OAuth2TokenResponse } from "./index";import {  OAUTH2_DEFAULT_TIMEOUT_MS,  refreshAccessToken,  shouldRefreshToken,  type ClientAuthMethod,} from "./index"; // ---------------------------------------------------------------------------// Secrets I/O adapter — plain string IDs, no plugin types.// --------------------------------------------------------------------------- export type OAuth2SecretsIO = {  readonly resolve: (secretId: string) => Effect.Effect<string, unknown>;  readonly setValue: (input: {    readonly secretId: string;    readonly value: string;    readonly name: string;    readonly purpose: string;  }) => Effect.Effect<void, unknown>;}; const wrapSecretError =  (operation: string) =>  (cause: unknown): OAuth2Error =>    new OAuth2Error({      message: `${operation}: ${cause instanceof Error ? cause.message : String(cause)}`,      cause,    }); // ---------------------------------------------------------------------------// storeOAuthTokens — freshly store access + refresh tokens as new secrets.// --------------------------------------------------------------------------- /** Shape of a newly persisted OAuth2 auth descriptor. */export type StoredOAuthTokens = {  readonly accessTokenSecretId: string;  readonly refreshTokenSecretId: string | null;  readonly tokenType: string;  readonly expiresAt: number | null;  readonly scope: string | null;}; export type StoreOAuthTokensInput = {  readonly tokens: OAuth2TokenResponse;  /** Slug used as prefix for new secret IDs, e.g. `acme_api`. */  readonly slug: string;  /** Human-readable name for the source, used in secret labels. */  readonly displayName: string;  /** `purpose` label stored on the access-token secret. */  readonly accessTokenPurpose: string;  /** `purpose` label stored on the refresh-token secret. */  readonly refreshTokenPurpose: string;  /** Adapter that creates a new secret and returns its freshly-minted ID. */  readonly createSecret: (input: {    readonly idPrefix: string;    readonly name: string;    readonly value: string;    readonly purpose: string;  }) => Effect.Effect<{ readonly id: string }, unknown>;}; /** * Persist access + refresh tokens from an OAuth2 token response as new * secrets and return a `StoredOAuthTokens` descriptor ready to write to a * source config. */export const storeOAuthTokens = (  input: StoreOAuthTokensInput,): Effect.Effect<StoredOAuthTokens, OAuth2Error> =>  Effect.gen(function* () {    const accessRef = yield* input      .createSecret({        idPrefix: `${input.slug}_access_token`,        name: `${input.displayName} Access Token`,        value: input.tokens.access_token,        purpose: input.accessTokenPurpose,      })      .pipe(Effect.mapError(wrapSecretError("Failed to store access token")));     const refreshRef = input.tokens.refresh_token      ? yield* input          .createSecret({            idPrefix: `${input.slug}_refresh_token`,            name: `${input.displayName} Refresh Token`,            value: input.tokens.refresh_token,            purpose: input.refreshTokenPurpose,          })          .pipe(Effect.mapError(wrapSecretError("Failed to store refresh token")))      : null;     return {      accessTokenSecretId: accessRef.id,      refreshTokenSecretId: refreshRef?.id ?? null,      tokenType: input.tokens.token_type ?? "Bearer",      expiresAt:        typeof input.tokens.expires_in === "number"          ? Date.now() + input.tokens.expires_in * 1000          : null,      scope: input.tokens.scope ?? null,    };  }); // ---------------------------------------------------------------------------// withRefreshedAccessToken — return the current access token, refreshing// first if it's within the skew window.// --------------------------------------------------------------------------- /** The subset of a stored OAuth2 auth descriptor this helper needs. */export type OAuth2AuthRefs = {  readonly clientIdSecretId: string;  readonly clientSecretSecretId: string | null;  readonly accessTokenSecretId: string;  readonly refreshTokenSecretId: string | null;  readonly tokenType: string;  readonly expiresAt: number | null;  readonly scopes: readonly string[];}; /** Snapshot of auth values written back after a successful refresh. */export type RefreshedAuthSnapshot = {  readonly tokenType: string;  readonly expiresAt: number | null;  readonly scope: string | null;}; export type WithRefreshedAccessTokenInput = {  readonly auth: OAuth2AuthRefs;  readonly tokenUrl: string;  readonly secrets: OAuth2SecretsIO;  /** Display name used when re-setting the access-token secret after refresh. */  readonly displayName: string;  readonly accessTokenPurpose: string;  readonly refreshTokenPurpose: string;  readonly clientAuth?: ClientAuthMethod;  readonly timeoutMs?: number;  /**   * Called after a successful refresh with the new expiry / tokenType /   * scope so the plugin can write the updated auth back to its source   * config. The accessTokenSecretId does NOT change — the value behind   * it is overwritten in place.   */  readonly persistAuth: (    snapshot: RefreshedAuthSnapshot,  ) => Effect.Effect<void, unknown>;}; /** * Resolve the current access token for a source — if it's within the * refresh-skew window, first exchange the refresh token for a new access * token, persist it, and write the updated expiry back via `persistAuth`. * * Returns the access-token string to be used for the upcoming request. */export const withRefreshedAccessToken = (  input: WithRefreshedAccessTokenInput,): Effect.Effect<string, OAuth2Error> =>  Effect.gen(function* () {    const { auth, secrets } = input;    const needsRefresh =      auth.refreshTokenSecretId !== null && shouldRefreshToken({ expiresAt: auth.expiresAt });     if (!needsRefresh) {      return yield* secrets        .resolve(auth.accessTokenSecretId)        .pipe(Effect.mapError(wrapSecretError("Failed to resolve OAuth access token")));    }     // Proactive refresh path.    const refreshToken = yield* secrets      .resolve(auth.refreshTokenSecretId!)      .pipe(Effect.mapError(wrapSecretError("Failed to resolve OAuth refresh token")));     const clientId = yield* secrets      .resolve(auth.clientIdSecretId)      .pipe(Effect.mapError(wrapSecretError("Failed to resolve OAuth client ID")));     const clientSecret =      auth.clientSecretSecretId === null        ? null        : yield* secrets            .resolve(auth.clientSecretSecretId)            .pipe(Effect.mapError(wrapSecretError("Failed to resolve OAuth client secret")));     const refreshed = yield* refreshAccessToken({      tokenUrl: input.tokenUrl,      clientId,      clientSecret,      refreshToken,      scopes: auth.scopes,      clientAuth: input.clientAuth,      timeoutMs: input.timeoutMs ?? OAUTH2_DEFAULT_TIMEOUT_MS,    });     yield* secrets      .setValue({        secretId: auth.accessTokenSecretId,        value: refreshed.access_token,        name: `${input.displayName} Access Token`,        purpose: input.accessTokenPurpose,      })      .pipe(Effect.mapError(wrapSecretError("Failed to persist refreshed access token")));     if (refreshed.refresh_token && auth.refreshTokenSecretId) {      yield* secrets        .setValue({          secretId: auth.refreshTokenSecretId,          value: refreshed.refresh_token,          name: `${input.displayName} Refresh Token`,          purpose: input.refreshTokenPurpose,        })        .pipe(Effect.mapError(wrapSecretError("Failed to persist rotated refresh token")));    }     yield* input      .persistAuth({        tokenType: refreshed.token_type ?? auth.tokenType,        expiresAt:          typeof refreshed.expires_in === "number"            ? Date.now() + refreshed.expires_in * 1000            : auth.expiresAt,        scope: refreshed.scope ?? null,      })      .pipe(Effect.mapError(wrapSecretError("Failed to persist updated OAuth auth")));     return refreshed.access_token;  });