lael-labs/executor

packages/core/sdk/src/executor.ts+9−5

           );
     const healthFromCredentialResolutionFailure = (
-      failure: StorageFailure | CredentialResolutionError,
+      failure: CredentialResolutionError,
     ): HealthCheckResult =>
-      Predicate.isTagged("CredentialResolutionError")(failure) && failure.reauthRequired === true
+      failure.reauthRequired === true
         ? {
             status: "expired",
             checkedAt: Date.now(),
         : {
             status: "degraded",
             checkedAt: Date.now(),
-            // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: failures here carry typed safe messages
+            // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: CredentialResolutionError carries a typed `message` field
             detail: failure.message,
           };
+    // Genuine storage failures propagate: an infra blip must fail the request,
+    // not persist as a "degraded" verdict on the connection.
     const oauthCredentialHealthWithoutProbe = (
       row: ConnectionRow,
-    ): Effect.Effect<HealthCheckResult, never> =>
+    ): Effect.Effect<HealthCheckResult, StorageFailure> =>
       resolveConnectionValues(row).pipe(
         Effect.as({
           status: "healthy" as const,
           checkedAt: Date.now(),
           detail: "Credential resolved (no probe configured).",
         }),
-        Effect.catch((failure) => Effect.succeed(healthFromCredentialResolutionFailure(failure))),
+        Effect.catchTag("CredentialResolutionError", (failure) =>
+          Effect.succeed(healthFromCredentialResolutionFailure(failure)),
+        ),
       );
     // Resolve an in-flight credential's value map (key-first validation) without

packages/core/sdk/src/oauth-flow.test.ts+43−0

@@ -12,6 +12,7 @@ import { · 11 unmodified lines
12	} from "./ids";	12	} from "./ids";
13	import { decodeOAuthCallbackState } from "./oauth";	13	import { decodeOAuthCallbackState } from "./oauth";
14	import { OAuthStartError } from "./oauth-client";	14	import { OAuthStartError } from "./oauth-client";
		15	import { missingGrantedOAuthScopes } from "./oauth-service";
15	import { definePlugin } from "./plugin";	16	import { definePlugin } from "./plugin";
16	import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";	17	import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
17	import { serveOAuthTestServer } from "./testing/oauth-test-server";	18	import { serveOAuthTestServer } from "./testing/oauth-test-server";
@@ -1177,3 +1178,45 @@ describe("oauth.complete regional token-endpoint rebind (Datadog multi-site)", ( · 1159 unmodified lines
1177	),	1178	),
1178	);	1179	);
1179	});	1180	});
		1181
		1182	describe("missingGrantedOAuthScopes canonicalization", () => {
		1183	it("treats Microsoft fully-qualified granted scopes as covering short-form requests", () => {
		1184	const missing = missingGrantedOAuthScopes(
		1185	[
		1186	"offline_access",
		1187	"User.Read",
		1188	"https://graph.microsoft.com/.default",
		1189	"Mail.ReadWrite",
		1190	"Mail.Send",
		1191	"MailboxSettings.ReadWrite",
		1192	],
		1193	[
		1194	"https://graph.microsoft.com/Mail.ReadWrite",
		1195	"https://graph.microsoft.com/Mail.Send",
		1196	"https://graph.microsoft.com/MailboxSettings.ReadWrite",
		1197	"https://graph.microsoft.com/User.Read",
		1198	].join(" "),
		1199	);
		1200	expect(missing).toEqual([]);
		1201	});
		1202
		1203	it("still reports genuinely ungranted scopes under the qualified Microsoft shape", () => {
		1204	const missing = missingGrantedOAuthScopes(
		1205	["User.Read", "Mail.ReadWrite", "Mail.Send"],
		1206	"https://graph.microsoft.com/User.Read https://graph.microsoft.com/Mail.ReadWrite",
		1207	);
		1208	expect(missing).toEqual(["Mail.Send"]);
		1209	});
		1210
		1211	it("maps Google userinfo aliases and ignores identity meta-scopes", () => {
		1212	const missing = missingGrantedOAuthScopes(
		1213	["openid", "email", "profile", "https://www.googleapis.com/auth/calendar"],
		1214	[
		1215	"https://www.googleapis.com/auth/userinfo.email",
		1216	"https://www.googleapis.com/auth/userinfo.profile",
		1217	"https://www.googleapis.com/auth/calendar",
		1218	].join(" "),
		1219	);
		1220	expect(missing).toEqual([]);
		1221	});
		1222	});

packages/core/sdk/src/oauth-helpers.ts+9−2

   key: string,
 ): string | undefined => {
   const value = claims[key];
-  return typeof value === "string" && value.trim().length > 0 ? value : undefined;
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : undefined;
 };
 const decodeJwtPayload = (token: string): Readonly<Record<string, unknown>> | null => {
   if (!/^[A-Za-z0-9_-]+$/.test(payload) || payload.length % 4 === 1) return null;
   const base64 = payload.replaceAll("-", "+").replaceAll("_", "/");
   const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), "=");
-  const decoded = decodeJwtClaims(globalThis.atob(padded));
+  // atob yields latin1 code units; JWT payloads are UTF-8 bytes, so re-decode
+  // them properly or non-ASCII claim values (accented emails, names) garble.
+  const utf8 = new TextDecoder().decode(
+    Uint8Array.from(globalThis.atob(padded), (char) => char.charCodeAt(0)),
+  );
+  const decoded = decodeJwtClaims(utf8);
   return Option.isSome(decoded) ? decoded.value : null;
 };

packages/core/sdk/src/oauth-service.ts+21−3

 const informationalOAuthScopes = new Set(["openid", "email", "profile", "offline_access"]);
-const canonicalOAuthScope = (scope: string): string => OAUTH_SCOPE_ALIASES[scope] ?? scope;
+/** Canonicalize a scope for granted-vs-requested comparison. Microsoft's token
+ *  endpoint returns Graph scopes fully qualified
+ *  (`https://graph.microsoft.com/Mail.ReadWrite`) even when the request used
+ *  the short form, so resource-URI prefixes are stripped down to the scope's
+ *  final path segment before comparing. */
+const canonicalOAuthScope = (scope: string): string => {
+  const aliased = OAUTH_SCOPE_ALIASES[scope];
+  if (aliased) return aliased;
+  if (/^https?:\/\/graph\.microsoft\.(com|us|de)\//i.test(scope)) {
+    return scope.slice(scope.lastIndexOf("/") + 1);
+  }
+  return scope;
+};
+/** `.default` is a request-time meta-scope (Microsoft expands it server-side
+ *  and never echoes it in the granted scope), so it can never be "missing". */
+const isMetaOAuthScope = (scope: string): boolean => scope.toLowerCase().endsWith("/.default");
 const normalizedOAuthScopeSet = (scopes: readonly string[]): ReadonlySet<string> =>
   new Set(scopes.map((scope) => canonicalOAuthScope(scope.trim())).filter(Boolean));
-const missingGrantedOAuthScopes = (
+export const missingGrantedOAuthScopes = (
   requestedScopes: readonly string[],
   recordedScope: string | null,
 ): readonly string[] => {
   const seen = new Set<string>();
   const out: string[] = [];
   for (const raw of requestedScopes) {
-    const scope = canonicalOAuthScope(raw.trim());
+    const trimmed = raw.trim();
+    if (isMetaOAuthScope(trimmed)) continue;
+    const scope = canonicalOAuthScope(trimmed);
     if (scope.length === 0 || informationalOAuthScopes.has(scope) || seen.has(scope)) continue;
     seen.add(scope);
     if (!granted.has(scope)) out.push(scope);