@bevel-software/platform-core-backend 0.12.0 → 0.13.1

package/src/modules/secrets-vault/db-secrets-vault.service.ts

@@ -34,10 +34,13 @@ interface OAuthTokenSet {
   expires_at?: number;
   token_type?: string;
   /**
-   * Space-delimited scopes the provider actually granted (echoed on the token
-   * response). The durable record of what this token can do, so a later check can
-   * tell whether it still covers a tool whose required scopes have grown. Absent
-   * on tokens minted before this was captured (treated as "covers nothing").
+   * Space-delimited scopes the provider actually granted. The durable record of
+   * what this token can do, so a later check can tell whether it still covers a
+   * tool whose required scopes have grown. Taken from the token response's
+   * `scope` when echoed; when the provider stays silent, RFC 6749 §5.1 says the
+   * grant is identical to the request, so the scopes asked for at `begin*` time
+   * are recorded instead. Absent only on tokens minted before this was captured
+   * (treated as "covers nothing").
    */
   scope?: string;
 }
@@ -51,6 +54,13 @@ interface OAuthBlob {
    * it's a one-time secret binding the pending consent to this server.
    */
   pendingVerifier?: string;
+  /**
+   * The space-delimited `scope` the pending consent asked for — what the
+   * token is deemed granted when the provider's token response echoes none
+   * (RFC 6749 §5.1: `scope` is optional when identical to the request). One-time
+   * like the verifier: consumed by the exchange it was minted for.
+   */
+  pendingScopes?: string;
 }
 
 /**
@@ -281,16 +291,39 @@ export class DbSecretsVaultService implements ISecretsVaultService {
     // PKCE (S256): same as the tool path — mint the verifier, stash it on the
     // row (so `completeOAuth` echoes it at the token exchange), and put only
     // the derived challenge in the consent URL. A provider registered pkce
-    // would otherwise fail the exchange from this standalone flow.
-    let pendingVerifier: string | undefined;
-    if (meta.pkce) {
-      pendingVerifier = randomBytes(32).toString('base64url');
-      const blob = this.readBlob(row.valueEncrypted);
-      const next: OAuthBlob = { ...blob, pendingVerifier };
-      await this.db
-        .update(secrets)
-        .set({ valueEncrypted: this.crypto().encrypt(JSON.stringify(next)), updatedAt: new Date() })
-        .where(and(eq(secrets.id, id), eq(secrets.userId, userId)));
+    // would otherwise fail the exchange from this standalone flow. The
+    // requested scopes ride along for the same exchange (see `pendingScopes`).
+    const pendingVerifier = meta.pkce ? randomBytes(32).toString('base64url') : undefined;
+    const pendingScopes = meta.scopes && meta.scopes.length ? meta.scopes.join(' ') : undefined;
+    if (pendingVerifier || pendingScopes) {
+      // Read-modify-write on the blob, guarded on the ciphertext we read: a
+      // refresh running concurrently (the row is a live credential) may have
+      // persisted ROTATED tokens in between, and writing our copy over them
+      // would leave the row holding a dead refresh token if this consent is
+      // then abandoned. On a miss (0 rows), re-read and merge onto the fresh
+      // blob; bounded so a row that keeps changing fails loudly, not forever.
+      let current = row;
+      for (let attempt = 0; ; attempt++) {
+        const blob = this.readBlob(current.valueEncrypted);
+        const next: OAuthBlob = { ...blob, pendingVerifier, pendingScopes };
+        const written = await this.db
+          .update(secrets)
+          .set({ valueEncrypted: this.crypto().encrypt(JSON.stringify(next)), updatedAt: new Date() })
+          .where(
+            and(eq(secrets.id, id), eq(secrets.userId, userId), eq(secrets.valueEncrypted, current.valueEncrypted)),
+          )
+          .returning({ id: secrets.id });
+        if (!Array.isArray(written) || written.length > 0) break;
+        if (attempt >= 2) throw new SecretOAuthError('The sign-in changed while starting — try again');
+        current = await this.requireRow(userId, id);
+        // Only a token rotation is merge-able. A row that is no longer this
+        // OAuth secret — re-registered against another provider, or replaced by
+        // a static value — would have the consent URL built above pointing at
+        // one provider and the pending fields stashed for another.
+        if (current.kind !== 'oauth' || JSON.stringify(current.oauthMeta) !== JSON.stringify(row.oauthMeta)) {
+          throw new SecretOAuthError('The sign-in changed while starting — try again');
+        }
+      }
     }
 
     const url = new URL(meta.authorizationUrl);
@@ -340,7 +373,14 @@ export class DbSecretsVaultService implements ISecretsVaultService {
     if (meta.resource) body.set('resource', meta.resource);
 
     const tokens = await this.tokenRequest(meta.tokenUrl, body);
-    // The verifier is one-time — never carried past the exchange it was minted for.
+    // A silent token response granted what was asked (RFC 6749 §5.1) — record
+    // the request as the grant, or every declared scope would read as missing
+    // and the sign-in would be flagged "again" forever. An echoed `scope` is
+    // the provider's own word and wins — narrower grants included, and so does
+    // an explicit empty one: only an ABSENT field means "as requested".
+    if (tokens.scope === undefined && blob.pendingScopes) tokens.scope = blob.pendingScopes;
+    // The verifier and the requested scopes are one-time — never carried past
+    // the exchange they were minted for.
     const next: OAuthBlob = { clientSecret: blob.clientSecret, tokens };
     await this.db
       .update(secrets)
@@ -433,11 +473,22 @@ export class DbSecretsVaultService implements ISecretsVaultService {
     // only the derived challenge in the consent URL. `completeOAuth` echoes the
     // verifier at the token exchange and drops it.
     const pendingVerifier = meta.pkce ? randomBytes(32).toString('base64url') : undefined;
+    // The scopes this consent asks for: the caller may override from the live
+    // tool file (`input.scopes`) so an owner adding a permission takes effect
+    // without re-setting the secret. Remembered on the row so a token response
+    // that echoes no `scope` is read as granting exactly this (RFC 6749 §5.1).
+    const requestedScopes = input.scopes && input.scopes.length ? input.scopes : meta.scopes;
+    const pendingScopes = requestedScopes && requestedScopes.length ? requestedScopes.join(' ') : undefined;
 
     // Provision (or reset) the caller's own oauth row for this key from the shared
     // provider meta + secret, preserving any existing tokens. Keyed `<manual>_<VAR>`
     // so `resolve` (scope 'user') returns the token once sign-in completes.
-    const blob: OAuthBlob = { clientSecret: sharedBlob.clientSecret, tokens: existingTokens, pendingVerifier };
+    const blob: OAuthBlob = {
+      clientSecret: sharedBlob.clientSecret,
+      tokens: existingTokens,
+      pendingVerifier,
+      pendingScopes,
+    };
     const valueEncrypted = this.crypto().encrypt(JSON.stringify(blob));
     const [row] = await this.db
       .insert(secrets)
@@ -449,10 +500,8 @@ export class DbSecretsVaultService implements ISecretsVaultService {
       .returning();
 
     // Build the consent URL exactly as beginOAuth does, from the stored meta —
-    // EXCEPT the requested scopes, which the caller may override from the live tool
-    // file (`input.scopes`) so an owner adding a permission takes effect without
-    // re-setting the secret. Client id, addresses, and secret stay owner-pinned.
-    const requestedScopes = input.scopes && input.scopes.length ? input.scopes : meta.scopes;
+    // EXCEPT the requested scopes (above). Client id, addresses, and secret
+    // stay owner-pinned.
     const url = new URL(meta.authorizationUrl);
     url.searchParams.set('response_type', 'code');
     url.searchParams.set('client_id', meta.clientId);
@@ -572,8 +621,10 @@ export class DbSecretsVaultService implements ISecretsVaultService {
     // Some providers omit the refresh_token on refresh — keep the old one.
     if (!refreshed.refresh_token) refreshed.refresh_token = tokens.refresh_token;
     // Likewise, a refresh response often omits `scope` — keep the granted scopes
-    // recorded at sign-in so coverage checks don't regress to "unknown".
-    if (!refreshed.scope) refreshed.scope = tokens.scope;
+    // recorded at sign-in so coverage checks don't regress to "unknown". Same
+    // rule as the exchange: only an ABSENT field means "unchanged"; an echoed
+    // value, empty included, is the provider's word.
+    if (refreshed.scope === undefined) refreshed.scope = tokens.scope;
     const next: OAuthBlob = { clientSecret: blob.clientSecret, tokens: refreshed };
 
     // Optimistic concurrency: only persist if the stored ciphertext is unchanged,

package/src/modules/secrets-vault/mcp-oauth-discovery.service.ts

@@ -10,6 +10,22 @@ export type McpAuthDiscovery =
   /** The server wants auth but the spec chain didn't complete — leave the tool as-is. */
   | { status: 'unsupported'; reason: string };
 
+/** Where a server's sign-in lives — the spec chain's answer before any client exists. */
+interface AuthorizationServerInfo {
+  authorizationUrl: string;
+  tokenUrl: string;
+  /** RFC 7591 endpoint, when the AS offers dynamic registration. */
+  registrationUrl?: string;
+  /** RFC 8707 resource indicator: the PRM's `resource`, else the MCP URL itself. */
+  resource: string;
+  scopes?: string[];
+}
+
+type AuthorizationServerResolution =
+  | { status: 'open' }
+  | { status: 'found'; as: AuthorizationServerInfo }
+  | { status: 'unsupported'; reason: string };
+
 const FETCH_TIMEOUT_MS = 5_000;
 /** Re-probe an open/unsupported server after this long (it may grow/lose auth). */
 const NEGATIVE_TTL_MS = 5 * 60_000;
@@ -37,12 +53,21 @@ const OAUTH_TTL_MS = 60 * 60_000;
  * row from the shared one, and the UTCP variable loader injects the fresh
  * access token into the manual's `Authorization` header at call time.
  *
+ * Providers without dynamic registration (HubSpot, Google) stop at step 3.
+ * For those, `providerForDeclaredClient` runs steps 1–3 for a client id the
+ * OWNER registered by hand and declared on the manual — same endpoints, same
+ * PKCE, same resource indicator, nothing persisted (the owner's client-secret
+ * save pins the completed provider).
+ *
  * Every fetch is SSRF-guarded (https-only, no redirects, bounded) — these URLs
  * originate from user-authored `.tool` files and remote servers' own metadata.
  */
 export class McpOAuthDiscoveryService {
   private readonly cache = new Map<string, { result: McpAuthDiscovery; expiresAt: number }>();
   private readonly inflight = new Map<string, Promise<McpAuthDiscovery>>();
+  /** The metadata walk alone, per MCP URL — shared by every declared client on that server. */
+  private readonly asCache = new Map<string, { result: AuthorizationServerResolution; expiresAt: number }>();
+  private readonly asInflight = new Map<string, Promise<AuthorizationServerResolution>>();
 
   constructor(
     private readonly deps: {
@@ -75,6 +100,30 @@ export class McpOAuthDiscoveryService {
     return pending;
   }
 
+  /**
+   * The provider for a client the OWNER registered: the server's discovered
+   * endpoints + resource indicator around the declared `clientId`, PKCE on (the
+   * MCP spec requires it; a provider without it ignores the parameters). No
+   * registration call, no vault write — the metadata is cached per URL so a
+   * re-scan or a second declared client on the same server costs no network.
+   */
+  async providerForDeclaredClient(manualName: string, mcpUrl: string, clientId: string): Promise<McpAuthDiscovery> {
+    const resolved = await this.resolveAuthorizationServer(manualName, mcpUrl);
+    if (resolved.status === 'open') {
+      return {
+        status: 'unsupported',
+        reason:
+          'the server did not ask for a sign-in and publishes no OAuth metadata — declare `authorizationUrl` and `tokenUrl` on the sign-in variable if it needs one',
+      };
+    }
+    if (resolved.status === 'unsupported') return resolved;
+    const { authorizationUrl, tokenUrl, resource, scopes } = resolved.as;
+    return {
+      status: 'oauth',
+      provider: { authorizationUrl, tokenUrl, clientId, scopes, pkce: true, resource },
+    };
+  }
+
   private remember(key: string, result: McpAuthDiscovery): McpAuthDiscovery {
     const ttl = result.status === 'oauth' ? OAUTH_TTL_MS : NEGATIVE_TTL_MS;
     this.cache.set(key, { result, expiresAt: this.now() + ttl });
@@ -114,6 +163,89 @@ export class McpOAuthDiscoveryService {
   }
 
   private async discoverFresh(manualName: string, key: string, mcpUrl: string): Promise<McpAuthDiscovery> {
+    const resolved = await this.resolveAuthorizationServer(manualName, mcpUrl);
+    if (resolved.status !== 'found') return resolved;
+    const { authorizationUrl, tokenUrl, registrationUrl, resource, scopes } = resolved.as;
+    if (!registrationUrl) {
+      return {
+        status: 'unsupported',
+        reason:
+          'the server requires sign-in but does not allow automatic client registration — register an OAuth app ' +
+          `with the provider (redirect URI: ${this.deps.redirectUri}), declare its client id on a user-scoped ` +
+          'sign-in variable (the server editor on the tool\'s page, or the plugin.json extensions entry), then set its client secret',
+      };
+    }
+
+    // 4. Dynamic client registration (RFC 7591), as a PUBLIC client: PKCE
+    //    carries the proof, no secret to store or leak.
+    assertSafeFetchUrl(registrationUrl, { requireHttps: true, label: 'registration_endpoint' });
+    const regRes = await this.fetchRaw(registrationUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+      body: JSON.stringify({
+        client_name: 'Bevel Knowledge Base',
+        redirect_uris: [this.deps.redirectUri],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+      }),
+    });
+    if (!regRes.ok) {
+      return { status: 'unsupported', reason: `client registration failed: HTTP ${regRes.status}` };
+    }
+    const reg = (await regRes.json().catch(() => null)) as Record<string, unknown> | null;
+    const clientId = typeof reg?.client_id === 'string' ? reg.client_id : '';
+    if (!clientId) {
+      return { status: 'unsupported', reason: 'client registration returned no client_id' };
+    }
+    const clientSecret = typeof reg?.client_secret === 'string' && reg.client_secret ? reg.client_secret : undefined;
+
+    const provider: OAuthProviderConfig = {
+      authorizationUrl,
+      tokenUrl,
+      clientId,
+      clientSecret,
+      scopes,
+      pkce: true,
+      publicClient: !clientSecret,
+      resource,
+    };
+    await this.deps.secretsVault.putSharedOAuthProvider({
+      key,
+      label: `${manualName} sign-in`,
+      provider,
+    });
+    // Return the stored (public) shape — no secret rides in cache entries.
+    const publicProvider = { ...provider };
+    delete publicProvider.clientSecret;
+    return { status: 'oauth', provider: publicProvider };
+  }
+
+  /** Steps 1–3, memoised per MCP URL (positive and negative alike, short TTL). */
+  private async resolveAuthorizationServer(manualName: string, mcpUrl: string): Promise<AuthorizationServerResolution> {
+    const cached = this.asCache.get(mcpUrl);
+    if (cached && cached.expiresAt > this.now()) return cached.result;
+    let pending = this.asInflight.get(mcpUrl);
+    if (!pending) {
+      pending = this.resolveAuthorizationServerFresh(mcpUrl)
+        .catch((err: unknown): AuthorizationServerResolution => ({
+          status: 'unsupported',
+          reason: err instanceof Error ? err.message : String(err),
+        }))
+        .then((result) => {
+          if (result.status === 'unsupported') {
+            console.warn(`[mcp-oauth-discovery] "${manualName}" (${mcpUrl}): ${result.reason}`);
+          }
+          this.asCache.set(mcpUrl, { result, expiresAt: this.now() + NEGATIVE_TTL_MS });
+          return result;
+        })
+        .finally(() => this.asInflight.delete(mcpUrl));
+      this.asInflight.set(mcpUrl, pending);
+    }
+    return pending;
+  }
+
+  private async resolveAuthorizationServerFresh(mcpUrl: string): Promise<AuthorizationServerResolution> {
     // 1. Probe: an unauthenticated initialize. A 401/403, or ANY response
     //    carrying a `WWW-Authenticate` challenge, means the server wants OAuth;
     //    a redirect to a login page (fetch throws under `redirect:'error'`)
@@ -205,57 +337,16 @@ export class McpOAuthDiscoveryService {
     if (!authorizationUrl || !tokenUrl) {
       return { status: 'unsupported', reason: 'authorization-server metadata is missing endpoints' };
     }
-    if (!registrationUrl) {
-      return {
-        status: 'unsupported',
-        reason:
-          'server requires sign-in but does not support automatic client registration — declare the oauth provider in the .tool file instead',
-      };
-    }
-
-    // 4. Dynamic client registration (RFC 7591), as a PUBLIC client: PKCE
-    //    carries the proof, no secret to store or leak.
-    assertSafeFetchUrl(registrationUrl, { requireHttps: true, label: 'registration_endpoint' });
-    const regRes = await this.fetchRaw(registrationUrl, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-      body: JSON.stringify({
-        client_name: 'Bevel Knowledge Base',
-        redirect_uris: [this.deps.redirectUri],
-        grant_types: ['authorization_code', 'refresh_token'],
-        response_types: ['code'],
-        token_endpoint_auth_method: 'none',
-      }),
-    });
-    if (!regRes.ok) {
-      return { status: 'unsupported', reason: `client registration failed: HTTP ${regRes.status}` };
-    }
-    const reg = (await regRes.json().catch(() => null)) as Record<string, unknown> | null;
-    const clientId = typeof reg?.client_id === 'string' ? reg.client_id : '';
-    if (!clientId) {
-      return { status: 'unsupported', reason: 'client registration returned no client_id' };
-    }
-    const clientSecret = typeof reg?.client_secret === 'string' && reg.client_secret ? reg.client_secret : undefined;
-
-    const provider: OAuthProviderConfig = {
-      authorizationUrl,
-      tokenUrl,
-      clientId,
-      clientSecret,
-      scopes,
-      pkce: true,
-      publicClient: !clientSecret,
-      resource,
+    return {
+      status: 'found',
+      as: {
+        authorizationUrl,
+        tokenUrl,
+        ...(registrationUrl ? { registrationUrl } : {}),
+        resource,
+        ...(scopes ? { scopes } : {}),
+      },
     };
-    await this.deps.secretsVault.putSharedOAuthProvider({
-      key,
-      label: `${manualName} sign-in`,
-      provider,
-    });
-    // Return the stored (public) shape — no secret rides in cache entries.
-    const publicProvider = { ...provider };
-    delete publicProvider.clientSecret;
-    return { status: 'oauth', provider: publicProvider };
   }
 
   private async fetchRaw(url: string, init: RequestInit): Promise<Response> {

package/src/modules/secrets-vault/secrets-vault.routes.ts

@@ -384,19 +384,37 @@ export function createSecretsVaultRoutes(deps: SecretsVaultRoutesDeps): express.
       if (!(await accessControl.canWrite(defaultWs(), email, found.manual.path))) {
         return void res.status(403).json({ error: 'You need write access to this tool to set its client secret.' });
       }
+      const { authorizationUrl, tokenUrl } = found.variable.oauth;
+      // A declaration that names only its client id is completed from the
+      // server's OAuth metadata at scan time. When that didn't happen, pinning
+      // the secret to a provider with no endpoints would leave every sign-in
+      // failing later with a far less specific error than the catalog's own.
+      if (!authorizationUrl || !tokenUrl) {
+        const why = found.manual.setup?.reason;
+        return void res.status(422).json({
+          error: why
+            ? `The sign-in endpoints for this server aren't known yet: ${why}.`
+            : "The sign-in endpoints for this server aren't known yet — declare `authorizationUrl` and `tokenUrl` on the sign-in variable.",
+        });
+      }
       const clientSecret = (req.body ?? {}).clientSecret;
       await secretsVault.putSharedOAuthClientSecret({
         key: varKey(found.manual.name, found.variable.name),
         clientSecret,
         provider: {
-          authorizationUrl: found.variable.oauth.authorizationUrl,
-          tokenUrl: found.variable.oauth.tokenUrl,
+          authorizationUrl,
+          tokenUrl,
           clientId: found.variable.oauth.clientId,
           scopes: found.variable.oauth.scopes,
           // Static authorize params (e.g. Google's `access_type=offline`) so the
           // provider returns a refresh token — stored with the secret so a later
           // `.tool` edit can't redirect the flow.
           authParams: found.variable.oauth.authParams,
+          // PKCE unless the declaration opted out; the resource indicator when
+          // the server (or the declaration) names one. Both pinned here for the
+          // same reason as the rest: the flow runs from the stored row.
+          pkce: found.variable.oauth.pkce !== false,
+          resource: found.variable.oauth.resource,
         },
       });
       res.status(201).json({ ok: true });

package/src/modules/tool-helpers/tool-context.ts

@@ -69,6 +69,7 @@ export function createToolContextResolver(deps: ToolContextDeps): ResolveToolCon
                 workspaceId,
                 branch: branchForWorkspaceId(workspaceId),
                 user,
+                kbDirName: deps.kbDirName,
                 validateWrite: validateRolesWrite,
                 creatorAccess: deps.creatorAccess,
               },

package/src/modules/tool-manuals/__tests__/mcp-json-discovery.test.ts

@@ -188,6 +188,44 @@ describe('descriptorsFromMcpJson', () => {
     expect(out[0]?.variables?.[0]?.oauth?.clientId).toBe('c-1');
   });
 
+  it('accepts a client-id-only sign-in (endpoints discovered later), refuses half a pair, carries pkce/resource', () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const declare = (oauth: unknown) =>
+      descriptorsFromMcpJson(
+        'GTM',
+        JSON.stringify({ mcpServers: { vendor: { type: 'streamable-http', url: 'https://v.example/mcp' } } }),
+        JSON.stringify({
+          name: 'gtm',
+          extensions: {
+            'software.bevel.hexis': { mcpServers: { vendor: { variables: [{ name: 'T', scope: 'user', oauth }] } } },
+          },
+        }),
+      )[0]?.variables?.[0]?.oauth;
+    // An MCP server publishes its endpoints — the client id alone is a complete declaration here.
+    expect(declare({ clientId: 'c' })).toEqual({ clientId: 'c' });
+    // …but half a pair is a broken declaration, not a discoverable one.
+    expect(declare({ clientId: 'c', authorizationUrl: 'https://v.example/auth' })).toBeUndefined();
+    expect(declare({ clientId: 'c', tokenUrl: 'https://v.example/token' })).toBeUndefined();
+    // An emptied editor field reads as absent, not as a malformed URL.
+    expect(declare({ clientId: 'c', authorizationUrl: '', tokenUrl: ' ' })).toEqual({ clientId: 'c' });
+    // PKCE is on by default: only the opt-out is stored, and it must be a boolean.
+    expect(declare({ clientId: 'c', pkce: true })).toEqual({ clientId: 'c' });
+    expect(declare({ clientId: 'c', pkce: false })).toEqual({ clientId: 'c', pkce: false });
+    expect(declare({ clientId: 'c', pkce: 'no' })).toBeUndefined();
+    // The resource indicator names the remote server — same https/SSRF bar as the endpoints.
+    expect(declare({ clientId: 'c', resource: 'https://v.example/mcp' })).toEqual({
+      clientId: 'c',
+      resource: 'https://v.example/mcp',
+    });
+    expect(declare({ clientId: 'c', resource: 'http://v.example/mcp' })).toBeUndefined();
+    expect(declare({ clientId: 'c', resource: 'https://169.254.169.254/mcp' })).toBeUndefined();
+    // A secret in a portable file never loads — same keys the `.tool` parser
+    // refuses, and the whole server is dropped rather than the key ignored.
+    expect(declare({ clientId: 'c', clientSecret: 'shh' })).toBeUndefined();
+    expect(declare({ clientId: 'c', client_secret: 'shh' })).toBeUndefined();
+    expect(declare({ clientId: 'c', secret: 'shh' })).toBeUndefined();
+  });
+
   it('yields nothing for an unparsable file, quietly for an absent extensions block', () => {
     vi.spyOn(console, 'warn').mockImplementation(() => {});
     expect(descriptorsFromMcpJson('GTM', '{ not json', null)).toEqual([]);

package/src/modules/tool-manuals/__tests__/mcp-server-edit.service.test.ts

@@ -290,6 +290,8 @@ describe('putServer', () => {
           oauth: { authorizationUrl: 'https://v.example/auth', tokenUrl: 'https://v.example/token', clientId: '   ' },
         },
       ],
+      [{ name: 'K', scope: 'user', oauth: { clientId: 'c', clientSecret: 'shh' } }], // a secret never lands in a file
+      [{ name: 'K', scope: 'user', oauth: { clientId: 'c', authorizationUrl: 'https://v.example/auth' } }], // half a pair
     ];
     const before = await readJson('Plugins/GTM/plugin.json');
     for (const variables of bad) {