lael-labs/executor

.changeset/raw-oauth-basic.md+5−0

@@ -0,0 +1,5 @@
	1	---
	2	"@executor-js/sdk": patch
	3	---
	4
	5	Add a raw HTTP Basic compatibility mode for OAuth providers that reject form-encoded client credentials.

e2e/cloud/mcp-session-cap-eviction.test.ts+7−5

     const openedSessionIds: string[] = [];
     const scenarioBody = Effect.gen(function* () {
-      // Open more sessions than the cap allows, at limited concurrency. None
+      // Open more sessions than the cap allows. Keep admission sequential:
-      // of them run any work, so every one is immediately eviction-eligible —
+      // the cloud e2e database is one serialized PGlite instance, and this
-      // crossing the cap must pick at least one and tear it down through its
+      // scenario exercises resident eviction rather than concurrent cold
-      // own stub.
+      // builds. None of the sessions run any work, so every one is immediately
+      // eviction-eligible — crossing the cap must pick at least one and tear it
+      // down through its own stub.
       const sessionIds = yield* Effect.forEach(
         Array.from({ length: SESSIONS_TO_OPEN }, (_, index) => index),
         (index) =>
               openedSessionIds.push(sessionId);
             }),
           ),
-        { concurrency: 8 },
+        { concurrency: 1 },
       );
       expect(sessionIds.length, "every session opened").toBe(SESSIONS_TO_OPEN);

e2e/selfhost/oauth-app-modal.test.ts+4−2

             await page.locator("#oauth-app-name").fill(appName);
             await page.locator("#oauth-client-id").fill("client-one");
             await page.locator("#oauth-client-secret").fill("secret-one");
-            await page.getByRole("radio", { name: /HTTP Basic/ }).check();
+            await page.getByRole("radio", { name: /^HTTP Basic client_secret_basic$/ }).check();
             await page.getByRole("button", { name: "Register app", exact: true }).click();
             // Back on the picker, the new app is selectable AND manageable —
             // the per-app actions menu is what replaced the old apps page.
               "the edit form prefills the stored client id",
             ).toBe("client-one");
             await expect
-              .poll(() => page.getByRole("radio", { name: /HTTP Basic/ }).isChecked())
+              .poll(() =>
+                page.getByRole("radio", { name: /^HTTP Basic client_secret_basic$/ }).isChecked(),
+              )
               .toBe(true);
           });

packages/core/sdk/src/executor.ts+2−1

   isFirstPartyOAuthClientSlug,
   parseStoredTokenEndpointAuthMethod,
   type OAuthService,
+  type TokenEndpointAuthMethod,
 } from "./oauth-client";
 import type { FirstPartyOAuthClientConfig } from "./oauth-client";
 import {
       readonly tokenUrl: string;
       readonly grant: string;
       readonly resource: string | null;
-      readonly tokenEndpointAuthMethod?: "body" | "basic";
+      readonly tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
       readonly tokenRequestFormat?: "form" | "json";
     }

packages/core/sdk/src/oauth-client.ts+10−4

   "urn:ietf:params:oauth:token-type:id_token";
 /** How a confidential OAuth client authenticates to its token endpoint. */
-export const TokenEndpointAuthMethodSchema = Schema.Literals(["body", "basic"]).annotate({
+export const TokenEndpointAuthMethodSchema = Schema.Literals([
+  "body",
+  "basic",
+  "basic_raw",
+]).annotate({
   identifier: "TokenEndpointAuthMethod",
   description:
-    "Transport for a confidential OAuth client secret: request body (client_secret_post) or HTTP Basic (client_secret_basic).",
+    "Transport for a confidential OAuth client secret: request body (client_secret_post), standards-based HTTP Basic (client_secret_basic), or raw HTTP Basic for providers that reject form-encoded credentials.",
 });
 export type TokenEndpointAuthMethod = typeof TokenEndpointAuthMethodSchema.Type;
 export const isTokenEndpointAuthMethod = (value: unknown): value is TokenEndpointAuthMethod =>
-  value === "body" || value === "basic";
+  value === "body" || value === "basic" || value === "basic_raw";
 /** Decode a nullable stored value. `undefined` is the legacy/default body
  *  method; `null` means the row contains an invalid non-null value. */
    *  them. */
   readonly authorizationExtraParams?: Readonly<Record<string, string>>;
   /** Token endpoint client-auth transport. Omitted means
-   *  `client_secret_post`; `basic` sends the secret only in HTTP Basic auth. */
+   *  `client_secret_post`; `basic` uses the RFC form-encoded HTTP Basic form;
+   *  `basic_raw` is an explicit compatibility mode for providers that require
+   *  the literal client id and secret before Base64 encoding. */
   readonly tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
   /** Token endpoint request encoding. OAuth defaults to URL-encoded form;
    *  providers such as Atlassian, ClickUp, and Notion require JSON. */

packages/core/sdk/src/oauth-flow.test.ts+62−0

@@ -327,6 +327,68 @@ describe("oauth.start / oauth.complete", () => { · 326 unmodified lines
327	),	327	),
328	);	328	);
329		329
		330	it.effect("persists raw HTTP Basic credentials for code exchange and refresh", () =>
		331	Effect.scoped(
		332	Effect.gen(function* () {
		333	const clientId = "test-client";
		334	const clientSecret = "test-secret";
		335	const server = yield* serveOAuthTestServer({
		336	scopes: ["read"],
		337	defaultTokenEndpointAuthMethod: "client_secret_basic",
		338	});
		339	const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });
		340	yield* executor.acme.seed();
		341
		342	yield* executor.oauth.createClient({
		343	owner: "org",
		344	slug: CLIENT,
		345	authorizationUrl: server.authorizationEndpoint,
		346	tokenUrl: server.tokenEndpoint,
		347	grant: "authorization_code",
		348	clientId,
		349	clientSecret,
		350	tokenEndpointAuthMethod: "basic_raw",
		351	});
		352
		353	const started = yield* executor.oauth.start({
		354	owner: "org",
		355	client: CLIENT,
		356	clientOwner: "org",
		357	name: ConnectionName.make("raw-basic-client"),
		358	integration: INTEG,
		359	template: TEMPLATE,
		360	});
		361	expect(started.status).toBe("redirect");
		362	if (started.status !== "redirect") return;
		363
		364	const callback = yield* server.completeAuthorizationCodeFlow({
		365	authorizationUrl: started.authorizationUrl,
		366	});
		367	yield* executor.oauth.complete({ state: started.state, code: callback.code });
		368
		369	yield* Effect.promise(() =>
		370	config.db.updateMany("connection", {
		371	where: (b) => b("name", "=", "rawBasicClient"),
		372	set: { expires_at: Date.now() - 60_000 },
		373	}),
		374	);
		375	yield* executor.execute(ToolAddress.make("tools.acme.org.rawBasicClient.whoami"), {});
		376
		377	const tokenRequests = (yield* server.requests).filter(
		378	(request) => request.path === "/token" && request.method === "POST",
		379	);
		380	expect(tokenRequests).toHaveLength(2);
		381	const expectedAuthorization = `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;
		382	for (const request of tokenRequests) {
		383	expect(request.headers.authorization).toBe(expectedAuthorization);
		384	expect(request.body).not.toContain("client_secret=");
		385	}
		386	expect(tokenRequests[0]?.body).toContain("grant_type=authorization_code");
		387	expect(tokenRequests[1]?.body).toContain("grant_type=refresh_token");
		388	}),
		389	),
		390	);
		391
330	it.effect("carries the URL org selector in provider state without changing redirect_uri", () =>	392	it.effect("carries the URL org selector in provider state without changing redirect_uri", () =>
331	Effect.scoped(	393	Effect.scoped(
332	Effect.gen(function* () {	394	Effect.gen(function* () {

packages/core/sdk/src/oauth-helpers.test.ts+27−4

         yield* exchangeAuthorizationCode({
           tokenUrl,
           clientId: "cid",
-          clientSecret: "csecret",
+          clientSecret: "c-secret",
           redirectUrl: "https://app.example.com/cb",
           codeVerifier: "verifier",
           code: "abc",
         });
         const call = (yield* calls)[0]!;
         expect(call.headers["content-type"]).toBe("application/json");
-        expect(call.headers["authorization"]).toBe("Basic Y2lkOmNzZWNyZXQ=");
+        expect(call.headers["authorization"]).toBe("Basic Y2lkOmMlMkRzZWNyZXQ=");
         expect(call.jsonBody).toEqual({
           grant_type: "authorization_code",
           code: "abc",
         yield* exchangeAuthorizationCode({
           tokenUrl,
           clientId: "cid",
-          clientSecret: "csecret",
+          clientSecret: "c-secret",
           redirectUrl: "https://app.example.com/cb",
           codeVerifier: "verifier",
           code: "abc",
           clientAuth: "basic",
         });
         const call = (yield* calls)[0]!;
-        const expected = `Basic ${Buffer.from("cid:csecret").toString("base64")}`;
+        const expected = `Basic ${Buffer.from("cid:c%2Dsecret").toString("base64")}`;
+        expect(call.headers["authorization"]).toBe(expected);
+        expect(call.body.has("client_id")).toBe(false);
+        expect(call.body.has("client_secret")).toBe(false);
+      }),
+    ),
+  );
+  it.effect("uses literal Basic credentials when clientAuth=basic_raw", () =>
+    withTokenEndpoint(tokenResponse(validCodeBody), ({ tokenUrl, calls }) =>
+      Effect.gen(function* () {
+        const clientId = "client-id";
+        const clientSecret = "secret-_~.!*'()";
+        yield* exchangeAuthorizationCode({
+          tokenUrl,
+          clientId,
+          clientSecret,
+          redirectUrl: "https://app.example.com/cb",
+          codeVerifier: "verifier",
+          code: "abc",
+          clientAuth: "basic_raw",
+        });
+        const call = (yield* calls)[0]!;
+        const expected = `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;
         expect(call.headers["authorization"]).toBe(expected);
         expect(call.body.has("client_id")).toBe(false);
         expect(call.body.has("client_secret")).toBe(false);

packages/core/sdk/src/oauth-helpers.ts+34−22

 import { Data, Effect, Option, Predicate, Schema } from "effect";
 import * as oauth from "oauth4webapi";
-import type { SubjectTokenType } from "./oauth-client";
+import type { SubjectTokenType, TokenEndpointAuthMethod } from "./oauth-client";
 // ---------------------------------------------------------------------------
 // Errors
 // oauth4webapi adapter helpers
 // ---------------------------------------------------------------------------
-export type ClientAuthMethod = "body" | "basic";
+export type ClientAuthMethod = TokenEndpointAuthMethod;
 /**
  * The token-endpoint client-auth transport used when a caller doesn't specify
  * method our DCR registers (`token_endpoint_auth_method: client_secret_post`)
  * and the one every confidential client in the v2 model uses. EXPLICIT and
  * documented rather than a hidden inline `?? "body"`: callers that need
- * `client_secret_basic` pass `clientAuth: "basic"`. For PUBLIC clients (no
+ * `client_secret_basic` pass `clientAuth: "basic"`. Providers that reject the
- * secret) the method is irrelevant — `pickClientAuth` returns `None()`.
+ * RFC form encoding can explicitly pass `clientAuth: "basic_raw"`. For PUBLIC
+ * clients (no secret) the method is irrelevant — `pickClientAuth` returns
+ * `None()`.
  */
 export const DEFAULT_CLIENT_AUTH_METHOD: ClientAuthMethod = "body";
 // (public PKCE — `None()`, RFC 7636). This is not a silent guess: `loadClient`
 // persists a non-empty secret for confidential clients and null/"" for public
 // ones, so an absent secret here unambiguously means "public client". The
-// `method` only chooses HOW a present secret is sent (post vs basic).
+// `method` only chooses HOW a present secret is sent (post vs either Basic
+// credential encoding).
+const base64BasicCredentials = (clientId: string, clientSecret: string): string => {
+  const bytes = new TextEncoder().encode(`${clientId}:${clientSecret}`);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return globalThis.btoa(binary);
+};
+const rawClientSecretBasic =
+  (clientSecret: string): oauth.ClientAuth =>
+  (_authorizationServer, client, _body, headers) => {
+    headers.set("authorization", `Basic ${base64BasicCredentials(client.client_id, clientSecret)}`);
+  };
 const pickClientAuth = (
   clientSecret: string | null | undefined,
   method: ClientAuthMethod,
 ): oauth.ClientAuth => {
   if (!clientSecret) return oauth.None();
-  return method === "basic"
+  if (method === "basic") return oauth.ClientSecretBasic(clientSecret);
-    ? oauth.ClientSecretBasic(clientSecret)
+  if (method === "basic_raw") return rawClientSecretBasic(clientSecret);
-    : oauth.ClientSecretPost(clientSecret);
+  return oauth.ClientSecretPost(clientSecret);
 };
 const normalizedTokenScope = (
   readonly fetch?: typeof globalThis.fetch;
 };
-const base64BasicCredentials = (clientId: string, clientSecret: string): string => {
-  const bytes = new TextEncoder().encode(`${clientId}:${clientSecret}`);
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return globalThis.btoa(binary);
-};
 const jsonTokenEndpointRequest = async (input: {
   readonly tokenUrl: string;
   readonly clientId: string;
     accept: "application/json",
     "content-type": "application/json",
   });
-  const confidential = Boolean(input.clientSecret);
+  const clientSecret = input.clientSecret ?? "";
-  if (confidential && input.clientAuth === "basic") {
+  const confidential = clientSecret.length > 0;
-    headers.set(
+  if (confidential && input.clientAuth !== "body") {
-      "authorization",
+    await pickClientAuth(clientSecret, input.clientAuth)(
-      `Basic ${base64BasicCredentials(input.clientId, input.clientSecret ?? "")}`,
+      asFromTokenUrl(tokenUrl, input.endpointUrlPolicy),
+      { client_id: input.clientId },
+      new URLSearchParams(),
+      headers,
     );
   }
   const body = {
     grant_type: input.grantType,
     ...input.parameters,
-    ...(confidential && input.clientAuth === "basic"
+    ...(confidential && input.clientAuth !== "body"
       ? {}
       : {
           client_id: input.clientId,
-          ...(confidential ? { client_secret: input.clientSecret ?? "" } : {}),
+          ...(confidential ? { client_secret: clientSecret } : {}),
         }),
   };
   // oxlint-disable-next-line executor/no-raw-fetch -- boundary: provider token exchange is the SDK's HTTP boundary and preserves its injected fetch seam

packages/core/sdk/src/oauth-service.ts+8−3

   type OAuthStartInput,
   type RegisterDynamicClientInput,
   type SubjectTokenType,
+  type TokenEndpointAuthMethod,
 } from "./oauth-client";
 import type { OwnerBinding } from "./plugin";
 import type { CredentialProvider } from "./provider";
   /** Resolved literal secret (read from the provider via the stored item id). */
   readonly clientSecret: string;
   readonly resource: string | null;
-  readonly tokenEndpointAuthMethod?: "body" | "basic";
+  readonly tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
   readonly tokenRequestFormat?: "form" | "json";
 }
   readonly clientId: string;
   readonly clientSecret: string;
   readonly resource: string | null;
-  readonly tokenEndpointAuthMethod?: "body" | "basic";
+  readonly tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
   readonly tokenRequestFormat?: "form" | "json";
 } => ({
   slug: String(firstPartyOAuthClientSlug(config.name)),
         });
       }
       yield* validateClientEndpoints(input, deps.endpointUrlPolicy);
-      if (input.tokenEndpointAuthMethod === "basic" && input.clientSecret.length === 0) {
+      if (
+        input.tokenEndpointAuthMethod !== undefined &&
+        input.tokenEndpointAuthMethod !== "body" &&
+        input.clientSecret.length === 0
+      ) {
         return yield* new StorageError({
           message: "HTTP Basic token endpoint authentication requires a client secret.",
           cause: undefined,

packages/react/src/api/atoms.tsx+2−1

   type OAuthGrant,
   type Owner,
   type ProviderItemId,
+  type TokenEndpointAuthMethod,
   type ToolAddress,
 } from "@executor-js/sdk/shared";
 import * as Atom from "effect/unstable/reactivity/Atom";
           readonly tokenUrl: string;
           readonly grant: OAuthGrant;
           readonly clientId: string;
-          readonly tokenEndpointAuthMethod?: "body" | "basic";
+          readonly tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
           readonly resource?: string | null;
           readonly originIntegration?: IntegrationSlug | null;
         };

packages/react/src/components/oauth-client-form.test.ts+11−0

@@ -124,6 +124,17 @@ describe("canSubmitOAuthClientForm", () => { · 123 unmodified lines
124	}),	124	}),
125	).toBe(false);	125	).toBe(false);
126	});	126	});
		127
		128	it("requires a secret when raw HTTP Basic is selected", () => {
		129	expect(
		130	canSubmitOAuthClientForm({
		131	...validBase,
		132	grant: "authorization_code",
		133	clientSecret: "",
		134	tokenEndpointAuthMethod: "basic_raw",
		135	}),
		136	).toBe(false);
		137	});
127	});	138	});
128		139
129	describe("preferredManualTokenEndpointAuthMethod", () => {	140	describe("preferredManualTokenEndpointAuthMethod", () => {

packages/react/src/components/oauth-client-form.tsx+10−3

   input.name.trim().length > 0 &&
   input.clientId.trim().length > 0 &&
   (input.grant === "authorization_code" || input.clientSecret.trim().length > 0) &&
-  (input.tokenEndpointAuthMethod !== "basic" || input.clientSecret.trim().length > 0) &&
+  (input.tokenEndpointAuthMethod === undefined ||
+    input.tokenEndpointAuthMethod === "body" ||
+    input.clientSecret.trim().length > 0) &&
   input.tokenUrl.trim().length > 0 &&
   (input.grant === "client_credentials" || input.authorizationUrl.trim().length > 0);
           onValueChange={(next: string) => {
             if (isTokenEndpointAuthMethod(next)) setTokenEndpointAuthMethod(next);
           }}
-          className="grid gap-2 sm:grid-cols-2"
+          className="grid gap-2 sm:grid-cols-3"
         >
           {(
             [
                 label: "HTTP Basic",
                 hint: "client_secret_basic",
               },
+              {
+                value: "basic_raw",
+                label: "HTTP Basic (raw)",
+                hint: "provider compatibility",
+              },
             ] as const
           ).map((option) => (
             <Label
             </Label>
           ))}
         </RadioGroup>
-        {tokenEndpointAuthMethod === "basic" && clientSecret.trim().length === 0 ? (
+        {tokenEndpointAuthMethod !== "body" && clientSecret.trim().length === 0 ? (
           <p className="text-xs text-destructive">HTTP Basic requires a client secret.</p>
         ) : null}
       </div>