@geminixiang/mikan 1.0.0-beta.8 → 1.0.0-beta.80

package/dist/{web → adapters/web}/login/portal.js

@@ -1,14 +1,27 @@
-import { createHash, randomBytes } from "crypto";
-import { escapeHtml } from "../../utils/html.js";
-import { readRawBody } from "../../utils/http-body.js";
-import { renderPortalShell } from "../../portal-shell.js";
-import { resolveLinkBaseUrl } from "../../config.js";
-import { requestBaseUrl } from "../request.js";
-import { getOAuthServices, resolveOAuthService, } from "./oauth.js";
-import * as log from "../../log.js";
-import { reportUserFacingError } from "../../observability/sentry.js";
-import { PRODUCT_NAME } from "../../platform-messages.js";
-import { defaultVaultTargetPath } from "../../vault/index.js";
+import { createHash, randomBytes } from "node:crypto";
+import { escapeHtml, readJsonBody, renderPortalShell, requestBaseUrl } from "../portal-shell.js";
+import { resolveLinkBaseUrl } from "../../../env-manifest.js";
+import { readEnv } from "../../../env-manifest.js";
+import { InMemoryTokenStore } from "../token-store.js";
+import { getOAuthServices, resolveOAuthService } from "./oauth.js";
+import * as log from "../../../log.js";
+import { reportUserFacingError } from "../../../observability/index.js";
+import { PRODUCT_NAME } from "../../messages.js";
+import { defaultVaultTargetPath } from "../../../vault/index.js";
+const TTL_MS = 15 * 60 * 1000;
+export class InMemoryLinkTokenStore extends InMemoryTokenStore {
+    create(platform, platformUserId, conversationId, vaultId, providerId) {
+        this.deleteWhere((token) => token.platform === platform && token.platformUserId === platformUserId);
+        return this.createRecord(TTL_MS, {
+            platform,
+            platformUserId,
+            vaultId,
+            providerId,
+            conversationId,
+        });
+    }
+}
+import { errorMessage, isRecord } from "../../../unknown-values.js";
 const OAUTH_STATE_TTL_MS = 10 * 60 * 1000;
 const DEFAULT_SECRET_CONFIG_ID = "manual";
 const SECRET_PRESETS = [
@@ -176,17 +189,6 @@ const SECRET_PRESETS = [
         ],
     },
 ];
-// ── request handler ───────────────────────────────────────────────────────────
-/**
- * Start a small HTTP server that receives credential onboarding callbacks from the web portal.
- *
- * Routes:
- *   GET  /health              — health check
- *   GET  /link?token=xxx      — credential onboarding page
- *   POST /api/link/complete   — API key completion endpoint
- *   POST /api/oauth/start     — creates provider OAuth redirect URL
- *   GET  /oauth/callback      — OAuth callback endpoint
- */
 export function createLoginRequestHandler(linkTokenStore, vaultManager, notify) {
     const oauthStates = new Map();
     return (req, res, url) => {
@@ -205,29 +207,52 @@ export function createLoginRequestHandler(linkTokenStore, vaultManager, notify)
             const defaultMode = oauthServiceHint ? "oauth" : "api_key";
             const existingSecrets = describeVaultSecrets(vaultManager, linkToken.vaultId);
             res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-            res.end(renderCredentialPage(rawToken, oauthServiceHint ? `${oauthServiceHint.label} OAuth` : "Store Secret", defaultMode, "", "Secret value", "sk-...", oauthServiceHint
-                ? `Authorize ${oauthServiceHint.label} and store tokens in your vault.`
-                : "Set any environment variable key/value pair in your vault.", oauthServices, oauthServiceHint?.id, existingSecrets));
+            res.end(renderCredentialPage({
+                token: rawToken,
+                title: oauthServiceHint ? `${oauthServiceHint.label} OAuth` : "Store Secret",
+                defaultMode,
+                initialEnvKey: "",
+                secretLabel: "Secret value",
+                placeholder: "sk-...",
+                helpText: oauthServiceHint
+                    ? `Authorize ${oauthServiceHint.label} and store tokens in your vault.`
+                    : "Set any environment variable key/value pair in your vault.",
+                oauthServices,
+                oauthServiceIdHint: oauthServiceHint?.id,
+                existingSecrets,
+            }));
             return true;
         }
         if (req.method === "POST" && url.pathname === "/api/link/complete") {
             if (!enforceCsrf(req, res))
                 return true;
-            void readJsonBody(req, res, async (body) => {
-                await handleLinkComplete(body, linkTokenStore, vaultManager, notify, res);
+            void readJsonBody(req, res, 16 * 1024).then((body) => {
+                if (body === null)
+                    return;
+                return handleLinkComplete(body, linkTokenStore, vaultManager, notify, res);
             });
             return true;
         }
         if (req.method === "POST" && url.pathname === "/api/oauth/start") {
             if (!enforceCsrf(req, res))
                 return true;
-            void readJsonBody(req, res, async (body) => {
-                await handleOAuthStart(body, req, linkTokenStore, oauthStates, res);
+            void readJsonBody(req, res, 16 * 1024).then((body) => {
+                if (body === null)
+                    return;
+                return handleOAuthStart(body, req, linkTokenStore, oauthStates, res);
             });
             return true;
         }
         if (req.method === "GET" && url.pathname === "/oauth/callback") {
-            void handleOAuthCallback(url, req, linkTokenStore, vaultManager, notify, oauthStates, res).catch((err) => {
+            void handleOAuthCallback({
+                url,
+                req,
+                linkTokenStore,
+                vaultManager,
+                notify,
+                oauthStates,
+                res,
+            }).catch((err) => {
                 log.logWarning("OAuth callback failed", err.message);
                 reportUserFacingError(err, {
                     domain: "login",
@@ -244,16 +269,6 @@ export function createLoginRequestHandler(linkTokenStore, vaultManager, notify)
         return false;
     };
 }
-/**
- * Block cross-site POSTs to the credential endpoints. Two defenses:
- *   1. Require Content-Type: application/json, which forces a CORS preflight
- *      for any cross-origin fetch and rules out `<form enctype="text/plain">`
- *      tricks that could otherwise smuggle a JSON body.
- *   2. When MIKAN_LINK_URL is configured, require that the Origin (or Referer,
- *      as a fallback for browsers that strip Origin) matches that base URL.
- *      This stops an attacker-controlled page — even one that somehow stole a
- *      victim's link token — from completing the flow.
- */
 function enforceCsrf(req, res) {
     const contentType = req.headers["content-type"]
         ?.split(";")[0]
@@ -266,8 +281,6 @@ function enforceCsrf(req, res) {
     }
     const configured = resolveLinkBaseUrl();
     if (!configured) {
-        // No trusted origin to compare against in local/dev mode; the loopback
-        // bind already prevents cross-host access.
         return true;
     }
     let configuredOrigin;
@@ -275,7 +288,6 @@ function enforceCsrf(req, res) {
         configuredOrigin = new URL(configured).origin;
     }
     catch {
-        // Misconfigured MIKAN_LINK_URL — fail closed.
         res.writeHead(500, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "Server misconfiguration" }));
         return false;
@@ -287,7 +299,6 @@ function enforceCsrf(req, res) {
     }
     return true;
 }
-/** Best-effort origin of the request, derived from Origin or Referer. */
 function requestOrigin(req) {
     const origin = req.headers.origin?.trim();
     if (origin && origin !== "null")
@@ -302,18 +313,9 @@ function requestOrigin(req) {
         return undefined;
     }
 }
-async function readJsonBody(req, res, onBody) {
-    const body = await readRawBody(req, res, 16 * 1024);
-    if (body === null)
-        return;
-    await onBody(body);
-}
-// ── HTML helpers ───────────────────────────────────────────────────────────────
 const esc = escapeHtml;
 const loginViewStyles = `
-  /* Login portal inherits all base chrome from the shared shell.
-     This module only adds preset cards, service logos, help popovers,
-     and the mode toggle. */
+
 
   p { margin: 0; color: var(--muted); font-size: 0.92rem; line-height: 1.55; }
 
@@ -669,7 +671,7 @@ function renderServiceLogo(kind) {
         sentry: { className: "sentry", text: "S" },
         manual: { className: "manual", text: ">_" },
     };
-    const logo = textLogos[kind] ?? textLogos.manual;
+    const logo = textLogos[kind] ?? textLogos.manual ?? { className: "manual", text: ">_" };
     return `<span class="service-logo ${logo.className}" aria-hidden="true"><span class="service-logo-text">${logo.text}</span></span>`;
 }
 function resolveFieldEnvKeys(field) {
@@ -739,42 +741,8 @@ function renderManualProviderCard(initialEnvKey, secretLabel, placeholder) {
     </div>
   </section>`;
 }
-function renderCredentialPage(token, title, defaultMode, initialEnvKey, secretLabel, placeholder, helpText, oauthServices, oauthServiceIdHint, existingSecrets) {
-    const oauthOptions = oauthServices
-        .map((service) => {
-        const selected = service.id === oauthServiceIdHint ? ' selected="selected"' : "";
-        return `<option value="${esc(service.id)}"${selected}>${esc(service.label)}</option>`;
-    })
-        .join("\n");
-    const presetCards = SECRET_PRESETS.map(renderPresetProviderCard).join("\n");
-    return renderHtmlDocument("Login", `<section class="card stack">
-  <p class="eyebrow">${PRODUCT_NAME}</p>
-  <h1 class="page-title">${esc(title)}</h1>
-  <p>Your personal sandbox is already provisioned automatically.</p>
-  <p>${esc(helpText)}</p>
-  ${renderSecretsSummary(existingSecrets)}
-  <div class="mode">
-    <label><input type="radio" name="mode" value="api_key" ${defaultMode === "api_key" ? "checked" : ""}> Secrets / API tokens</label>
-    <label><input type="radio" name="mode" value="oauth" ${defaultMode === "oauth" ? "checked" : ""}> OAuth login</label>
-  </div>
-</section>
-
-<div id="api-panel" class="panel">
-  ${presetCards}
-  ${renderManualProviderCard(initialEnvKey, secretLabel, placeholder)}
-</div>
-
-<div id="oauth-panel" class="panel card stack">
-  <label for="oauthService">OAuth service</label>
-  <select id="oauthService" name="oauthService">${oauthOptions}</select>
-  <p class="panel-note">You'll be redirected to the selected service's authorization page.</p>
-</div>
-
-<div>
-  <button id="btn" class="primary-button" onclick="connect()">Continue</button>
-  <div id="result" class="result" aria-live="polite"></div>
-</div>
-  <script>
+const CREDENTIAL_PAGE_TOKEN = "__MIKAN_LOGIN_TOKEN__";
+const CREDENTIAL_PAGE_SCRIPT = `  <script>
     const envKeyPattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
     function selectedMode() {
@@ -858,7 +826,7 @@ function renderCredentialPage(token, title, defaultMode, initialEnvKey, secretLa
       const r = await fetch('/api/oauth/start', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ token: '${esc(token)}', serviceId }),
+        body: JSON.stringify({ token: '__MIKAN_LOGIN_TOKEN__', serviceId }),
       });
       const data = await r.json();
       if (!r.ok) {
@@ -880,7 +848,7 @@ function renderCredentialPage(token, title, defaultMode, initialEnvKey, secretLa
       const r = await fetch('/api/link/complete', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ token: '${esc(token)}', mode: 'api_key', env: payload.env }),
+        body: JSON.stringify({ token: '__MIKAN_LOGIN_TOKEN__', mode: 'api_key', env: payload.env }),
       });
       const data = await r.json();
       if (r.ok) {
@@ -941,7 +909,47 @@ function renderCredentialPage(token, title, defaultMode, initialEnvKey, secretLa
         resetContinueButton();
       }
     }
-  </script>`);
+  </script>`;
+function renderCredentialPageScript(token) {
+    return CREDENTIAL_PAGE_SCRIPT.replaceAll(CREDENTIAL_PAGE_TOKEN, () => esc(token));
+}
+function renderCredentialPage(options) {
+    const { token, title, defaultMode, initialEnvKey, secretLabel, placeholder, helpText, oauthServices, oauthServiceIdHint, existingSecrets, } = options;
+    const oauthOptions = oauthServices
+        .map((service) => {
+        const selected = service.id === oauthServiceIdHint ? ' selected="selected"' : "";
+        return `<option value="${esc(service.id)}"${selected}>${esc(service.label)}</option>`;
+    })
+        .join("\n");
+    const presetCards = SECRET_PRESETS.map(renderPresetProviderCard).join("\n");
+    return renderHtmlDocument("Login", `<section class="card stack">
+  <p class="eyebrow">${PRODUCT_NAME}</p>
+  <h1 class="page-title">${esc(title)}</h1>
+  <p>Your personal sandbox is already provisioned automatically.</p>
+  <p>${esc(helpText)}</p>
+  ${renderSecretsSummary(existingSecrets)}
+  <div class="mode">
+    <label><input type="radio" name="mode" value="api_key" ${defaultMode === "api_key" ? "checked" : ""}> Secrets / API tokens</label>
+    <label><input type="radio" name="mode" value="oauth" ${defaultMode === "oauth" ? "checked" : ""}> OAuth login</label>
+  </div>
+</section>
+
+<div id="api-panel" class="panel">
+  ${presetCards}
+  ${renderManualProviderCard(initialEnvKey, secretLabel, placeholder)}
+</div>
+
+<div id="oauth-panel" class="panel card stack">
+  <label for="oauthService">OAuth service</label>
+  <select id="oauthService" name="oauthService">${oauthOptions}</select>
+  <p class="panel-note">You'll be redirected to the selected service's authorization page.</p>
+</div>
+
+<div>
+  <button id="btn" class="primary-button" onclick="connect()">Continue</button>
+  <div id="result" class="result" aria-live="polite"></div>
+</div>
+${renderCredentialPageScript(token)}`);
 }
 function renderErrorPage(message) {
     return renderStatusPage("Login Error", message, "err");
@@ -953,7 +961,7 @@ function isValidEnvKey(value) {
     return /^[A-Za-z_][A-Za-z0-9_]*$/.test(value);
 }
 function extractEnvUpdates(data) {
-    if (data.env && typeof data.env === "object" && !Array.isArray(data.env)) {
+    if (isRecord(data.env)) {
         const rawEntries = Object.entries(data.env);
         if (rawEntries.length === 0)
             return { error: "Missing required field: env" };
@@ -1001,17 +1009,7 @@ function renderSentryCliConfig(updates) {
     }
     return lines.join("\n");
 }
-// ── API-key completion ────────────────────────────────────────────────────────
-async function handleLinkComplete(body, linkTokenStore, vaultManager, notify, res) {
-    let data;
-    try {
-        data = JSON.parse(body);
-    }
-    catch {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Invalid JSON" }));
-        return;
-    }
+async function handleLinkComplete(data, linkTokenStore, vaultManager, notify, res) {
     if (!data.token) {
         res.writeHead(400, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "Missing required field: token" }));
@@ -1024,8 +1022,6 @@ async function handleLinkComplete(body, linkTokenStore, vaultManager, notify, re
         return;
     }
     const envKeys = Object.keys(updates).toSorted((left, right) => left.localeCompare(right));
-    // Atomic consume prevents two concurrent requests from both passing the
-    // validity check before either deletes the token.
     const linkToken = linkTokenStore.consume(data.token);
     if (!linkToken) {
         res.writeHead(400, { "Content-Type": "application/json" });
@@ -1037,12 +1033,13 @@ async function handleLinkComplete(body, linkTokenStore, vaultManager, notify, re
     try {
         vaultManager.upsertEnv(linkToken.vaultId, updates);
         if (sentryCliConfig) {
-            vaultManager.upsertFile(linkToken.vaultId, ".sentryclirc", sentryCliConfig, "/root/.sentryclirc");
-            fileTargets.push("/root/.sentryclirc");
+            const target = defaultVaultTargetPath(".sentryclirc");
+            vaultManager.upsertFile(linkToken.vaultId, ".sentryclirc", sentryCliConfig, target);
+            fileTargets.push(target);
         }
     }
     catch (persistError) {
-        log.logWarning(`Failed to persist [${envKeys.join(", ")}] for ${linkToken.platform}/${linkToken.platformUserId}`, persistError instanceof Error ? persistError.message : String(persistError));
+        log.logWarning(`Failed to persist [${envKeys.join(", ")}] for ${linkToken.platform}/${linkToken.platformUserId}`, errorMessage(persistError));
         reportUserFacingError(persistError, {
             domain: "login",
             surface: "credential_login",
@@ -1085,17 +1082,7 @@ async function handleLinkComplete(body, linkTokenStore, vaultManager, notify, re
         });
     });
 }
-// ── OAuth flow ────────────────────────────────────────────────────────────────
-async function handleOAuthStart(body, req, linkTokenStore, oauthStates, res) {
-    let data;
-    try {
-        data = JSON.parse(body);
-    }
-    catch {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Invalid JSON" }));
-        return;
-    }
+async function handleOAuthStart(data, req, linkTokenStore, oauthStates, res) {
     if (!data.token || !data.serviceId) {
         res.writeHead(400, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "Missing required fields: token/serviceId" }));
@@ -1113,8 +1100,8 @@ async function handleOAuthStart(body, req, linkTokenStore, oauthStates, res) {
         res.end(JSON.stringify({ error: `Unsupported OAuth service: ${data.serviceId}` }));
         return;
     }
-    const clientId = process.env[service.clientIdEnvKey];
-    const clientSecret = process.env[service.clientSecretEnvKey];
+    const clientId = readEnv(service.clientIdEnvKey);
+    const clientSecret = readEnv(service.clientSecretEnvKey);
     if (!clientId || !clientSecret) {
         res.writeHead(400, { "Content-Type": "application/json" });
         res.end(JSON.stringify({
@@ -1153,69 +1140,64 @@ async function handleOAuthStart(body, req, linkTokenStore, oauthStates, res) {
     res.writeHead(200, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ ok: true, redirectUrl: authorizeUrl.toString() }));
 }
-async function handleOAuthCallback(url, req, linkTokenStore, vaultManager, notify, oauthStates, res) {
+function resolveOAuthCallback(options) {
+    const { url, oauthStates, linkTokenStore, res } = options;
     const state = url.searchParams.get("state") ?? "";
     const code = url.searchParams.get("code") ?? "";
     const oauthError = url.searchParams.get("error");
-    // Atomic pop: whatever path we take from here, this state is spent.
-    // Done before any `await` to close the TOCTOU window between the state
-    // lookup and the final delete.
     const pending = oauthStates.get(state);
     if (pending)
         oauthStates.delete(state);
     if (oauthError) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage(`OAuth authorization failed: ${oauthError}`));
-        return;
+        return undefined;
     }
     if (!pending || Date.now() > pending.expiresAt) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("OAuth state is invalid or expired. Please run /login again."));
-        return;
+        return undefined;
     }
     if (!code) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("Missing OAuth authorization code."));
-        return;
+        return undefined;
     }
     const service = resolveOAuthService(pending.serviceId);
     if (!service) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("Unsupported OAuth service."));
-        return;
+        return undefined;
     }
-    const clientId = process.env[service.clientIdEnvKey];
-    const clientSecret = process.env[service.clientSecretEnvKey];
+    const clientId = readEnv(service.clientIdEnvKey);
+    const clientSecret = readEnv(service.clientSecretEnvKey);
     if (!clientId || !clientSecret) {
         res.writeHead(500, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("OAuth service is not configured on server."));
-        return;
+        return undefined;
     }
-    // Atomic consume: pairs with the callback being one-shot. Two concurrent
-    // callbacks for the same state would previously both pass `peek` and both
-    // run `exchangeOAuthCode` across the await; only one reaches `consume`.
     const linkToken = linkTokenStore.consume(pending.linkToken);
     if (!linkToken) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("Login link is invalid or expired. Please run /login again."));
-        return;
+        return undefined;
     }
-    const redirectUri = `${requestBaseUrl(req)}/oauth/callback`;
-    const tokenResp = await exchangeOAuthCode(service, code, clientId, clientSecret, redirectUri, pending.codeVerifier);
-    const accessToken = tokenResp.access_token?.trim();
-    const refreshToken = tokenResp.refresh_token?.trim();
+    return { code, codeVerifier: pending.codeVerifier, service, clientId, clientSecret, linkToken };
+}
+function storeOAuthCredentials(options) {
+    const { tokenResponse, service, clientId, clientSecret, linkToken, vaultManager, res } = options;
+    const accessToken = tokenResponse.access_token?.trim();
+    const refreshToken = tokenResponse.refresh_token?.trim();
     if (!accessToken) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("OAuth token exchange did not return an access_token."));
-        return;
+        return undefined;
     }
     const updates = {};
-    for (const key of service.accessTokenEnvKeys ?? []) {
+    for (const key of service.accessTokenEnvKeys ?? [])
         updates[key] = accessToken;
-    }
-    if (refreshToken && service.refreshTokenEnvKey) {
+    if (refreshToken && service.refreshTokenEnvKey)
         updates[service.refreshTokenEnvKey] = refreshToken;
-    }
     const fileOutput = service.fileOutput;
     let mountedPath;
     if (fileOutput?.type === "authorized_user") {
@@ -1223,15 +1205,13 @@ async function handleOAuthCallback(url, req, linkTokenStore, vaultManager, notif
             res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
             res.end(renderErrorPage("OAuth token exchange did not return a refresh_token. " +
                 "Retry after revoking prior consent or ensure prompt=consent is applied."));
-            return;
+            return undefined;
         }
         mountedPath = fileOutput.targetPath ?? defaultVaultTargetPath(fileOutput.relativePath);
-        if (fileOutput.envKey) {
+        if (fileOutput.envKey)
             updates[fileOutput.envKey] = mountedPath;
-        }
-        for (const key of fileOutput.additionalEnvKeys ?? []) {
+        for (const key of fileOutput.additionalEnvKeys ?? [])
             updates[key] = mountedPath;
-        }
     }
     const storedTargets = [];
     try {
@@ -1246,7 +1226,7 @@ async function handleOAuthCallback(url, req, linkTokenStore, vaultManager, notif
         }
     }
     catch (persistError) {
-        log.logWarning(`Failed to persist OAuth credentials for ${linkToken.platform}/${linkToken.platformUserId}`, persistError instanceof Error ? persistError.message : String(persistError));
+        log.logWarning(`Failed to persist OAuth credentials for ${linkToken.platform}/${linkToken.platformUserId}`, errorMessage(persistError));
         reportUserFacingError(persistError, {
             domain: "login",
             surface: "oauth",
@@ -1263,10 +1243,39 @@ async function handleOAuthCallback(url, req, linkTokenStore, vaultManager, notif
         });
         res.writeHead(500, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("OAuth tokens were received but could not be stored on the server. Fix the server issue and run /login again."));
-        return;
+        return undefined;
     }
+    return storedTargets;
+}
+async function handleOAuthCallback(options) {
+    const resolved = resolveOAuthCallback(options);
+    if (!resolved)
+        return;
+    const { service, code, clientId, clientSecret, codeVerifier, linkToken } = resolved;
+    const redirectUri = `${requestBaseUrl(options.req)}/oauth/callback`;
+    const tokenResponse = await exchangeOAuthCode({
+        service,
+        code,
+        clientId,
+        clientSecret,
+        redirectUri,
+        codeVerifier,
+    });
+    const storedTargets = storeOAuthCredentials({
+        tokenResponse,
+        service,
+        clientId,
+        clientSecret,
+        linkToken,
+        vaultManager: options.vaultManager,
+        res: options.res,
+    });
+    if (!storedTargets)
+        return;
     log.logInfo(`Stored [${storedTargets.join(", ")}] for ${linkToken.platform}/${linkToken.platformUserId} in vault:${linkToken.vaultId}`);
-    notify(linkToken.platform, linkToken.conversationId, `${service.label} OAuth stored (${storedTargets.join(", ")}) in vault \`${linkToken.vaultId}\`.`).catch((err) => {
+    options
+        .notify(linkToken.platform, linkToken.conversationId, `${service.label} OAuth stored (${storedTargets.join(", ")}) in vault \`${linkToken.vaultId}\`.`)
+        .catch((err) => {
         log.logWarning("Failed to notify user after OAuth login", err.message);
         reportUserFacingError(err, {
             domain: "login",
@@ -1283,10 +1292,11 @@ async function handleOAuthCallback(url, req, linkTokenStore, vaultManager, notif
             },
         });
     });
-    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-    res.end(renderSuccessPage(`${service.label} OAuth connected successfully.`));
+    options.res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    options.res.end(renderSuccessPage(`${service.label} OAuth connected successfully.`));
 }
-async function exchangeOAuthCode(service, code, clientId, clientSecret, redirectUri, codeVerifier) {
+async function exchangeOAuthCode(options) {
+    const { service, code, clientId, clientSecret, redirectUri, codeVerifier } = options;
     const params = new URLSearchParams();
     params.set("grant_type", "authorization_code");
     params.set("code", code);