@oomol-lab/open-connector 1.6.5 → 1.8.0

package/src/marketplace/marketplace-service.js

@@ -1,5 +1,5 @@
-import { assertPublicHttpUrl } from "../core/request.js";
-import { providerFetch } from "../providers/provider-runtime.js";
+import { isFailureEnvelope, isSuccessEnvelope, readRemoteJson, RemoteHttpError, requestRemote, } from "../core/remote-http.js";
+import { isAbortLikeError } from "../providers/provider-runtime.js";
 import { defaultMarketplaceDiscoveryUrl } from "./default-marketplace.js";
 const maximumDiscoveryBytes = 4 * 1024 * 1024;
 export class MarketplaceError extends Error {
@@ -119,35 +119,32 @@ export class MarketplaceService {
             return { ok: false, error: { code: "connection_not_found", message: "Marketplace connection is unavailable." } };
         }
         const url = new URL(`${snapshot.definition.endpoint}/${encodeURIComponent(actionId)}`, snapshot.discoveryUrl);
-        let response;
-        try {
-            response = await this.fetch(url, {
-                method: "POST",
-                headers: { authorization: `Bearer ${snapshot.apiKey}`, "content-type": "application/json" },
-                body: JSON.stringify({ input }),
-                redirect: "manual",
-                signal,
-            });
-        }
-        catch (error) {
-            return {
-                ok: false,
-                error: {
-                    code: "marketplace_unavailable",
-                    message: error instanceof Error ? error.message : "Marketplace request failed.",
-                },
-            };
-        }
         let payload;
         try {
-            payload = await readJsonResponse(response, "Marketplace action response");
+            payload = await requestRemote({
+                url,
+                label: "Marketplace action",
+                fetcher: this.options.fetcher,
+                requireHttps: false,
+                allowTrustedHosts: true,
+                init: {
+                    method: "POST",
+                    headers: { authorization: `Bearer ${snapshot.apiKey}`, "content-type": "application/json" },
+                    body: JSON.stringify({ input }),
+                    signal,
+                },
+            }, (response, signal) => readRemoteJson(response, {
+                label: "Marketplace action response",
+                maxBytes: Infinity,
+                signal,
+            }));
         }
         catch (error) {
             return {
                 ok: false,
                 error: {
                     code: "marketplace_unavailable",
-                    message: error instanceof Error ? error.message : "Marketplace returned an invalid response.",
+                    message: error instanceof RemoteHttpError ? error.message : "Marketplace request failed.",
                 },
             };
         }
@@ -195,34 +192,70 @@ export class MarketplaceService {
         };
     }
     async discover(discoveryUrl) {
-        const url = assertPublicHttpUrl(discoveryUrl, {
-            fieldName: "discoveryUrl",
-            createError: (message) => new MarketplaceError("invalid_marketplace_discovery", message),
-        });
-        const response = await this.fetch(url, {
-            headers: { accept: "application/json" },
-            redirect: "manual",
-            signal: AbortSignal.timeout(15_000),
-        });
-        if (300 <= response.status && response.status < 400) {
-            throw new MarketplaceError("invalid_marketplace_discovery", "Marketplace discovery redirects are not allowed.");
+        try {
+            return await requestRemote({
+                url: discoveryUrl,
+                label: "Marketplace discovery",
+                fetcher: this.options.fetcher,
+                requireHttps: false,
+                allowTrustedHosts: true,
+                timeoutMs: 15_000,
+                init: { headers: { accept: "application/json" } },
+            }, async (response, signal) => {
+                if (!response.ok)
+                    throw new MarketplaceError("marketplace_unavailable", `Marketplace discovery failed with HTTP ${response.status}.`, 502);
+                return parseDiscovery(await readRemoteJson(response, {
+                    label: "Marketplace discovery",
+                    maxBytes: maximumDiscoveryBytes,
+                    signal,
+                }), new URL(discoveryUrl));
+            });
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                throw error;
+            if (isAbortLikeError(error)) {
+                throw new MarketplaceError("marketplace_unavailable", "Marketplace request timed out.", 504);
+            }
+            if (error instanceof RemoteHttpError) {
+                if (error.kind === "too_large") {
+                    throw new MarketplaceError("invalid_marketplace_discovery", "Marketplace discovery exceeds 4 MiB.");
+                }
+                if (error.kind === "invalid_url" || error.kind === "redirect" || error.kind === "invalid_json") {
+                    throw new MarketplaceError("invalid_marketplace_discovery", error.message);
+                }
+                throw new MarketplaceError("marketplace_unavailable", error.message, 502);
+            }
+            throw new MarketplaceError("marketplace_unavailable", "Marketplace discovery request failed.", 502);
         }
-        if (!response.ok)
-            throw new MarketplaceError("marketplace_unavailable", `Marketplace discovery failed with HTTP ${response.status}.`, 502);
-        return parseDiscovery(await readBoundedJson(response, maximumDiscoveryBytes), url);
     }
     async validateApiKey(discoveryUrl, validatePath, apiKey) {
-        const response = await this.fetch(new URL(validatePath, discoveryUrl), {
-            method: "POST",
-            headers: { authorization: `Bearer ${apiKey}` },
-            redirect: "manual",
-        });
-        if (response.status === 204)
-            return;
-        if (response.status === 401 || response.status === 403) {
-            throw new MarketplaceError("marketplace_auth_error", "The Marketplace API key is invalid or not permitted.", response.status);
+        try {
+            await requestRemote({
+                url: new URL(validatePath, discoveryUrl),
+                label: "Marketplace validation",
+                fetcher: this.options.fetcher,
+                requireHttps: false,
+                allowTrustedHosts: true,
+                timeoutMs: 15_000,
+                init: { method: "POST", headers: { authorization: `Bearer ${apiKey}` } },
+            }, async (response) => {
+                if (response.status === 204)
+                    return;
+                if (response.status === 401 || response.status === 403) {
+                    throw new MarketplaceError("marketplace_auth_error", "The Marketplace API key is invalid or not permitted.", response.status);
+                }
+                throw new MarketplaceError("marketplace_unavailable", `Marketplace validation failed with HTTP ${response.status}.`, 502);
+            });
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                throw error;
+            if (isAbortLikeError(error)) {
+                throw new MarketplaceError("marketplace_unavailable", "Marketplace request timed out.", 504);
+            }
+            throw new MarketplaceError("marketplace_unavailable", error instanceof RemoteHttpError ? error.message : "Marketplace validation request failed.", 502);
         }
-        throw new MarketplaceError("marketplace_unavailable", `Marketplace validation failed with HTTP ${response.status}.`, 502);
     }
     async ensureProviderPreferences() {
         const existing = new Set((await this.options.store.listProviderPreferences()).map((item) => item.service));
@@ -232,34 +265,6 @@ export class MarketplaceService {
                 await this.options.store.setProviderPreference({ service, enabled: true, createdAt: now, updatedAt: now });
         }
     }
-    fetch(input, init) {
-        return (this.options.fetcher ?? providerFetch)(input, init);
-    }
-}
-async function readBoundedJson(response, maximumBytes) {
-    if (!response.body)
-        return JSON.parse(await response.text());
-    const reader = response.body.getReader();
-    const chunks = [];
-    let size = 0;
-    while (true) {
-        const chunk = await reader.read();
-        if (chunk.done)
-            break;
-        size += chunk.value.byteLength;
-        if (size > maximumBytes) {
-            await reader.cancel();
-            throw new MarketplaceError("invalid_marketplace_discovery", "Marketplace discovery exceeds 4 MiB.");
-        }
-        chunks.push(chunk.value);
-    }
-    const bytes = new Uint8Array(size);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    return JSON.parse(new TextDecoder().decode(bytes));
 }
 function parseDiscovery(value, discoveryUrl) {
     if (!value || typeof value !== "object")
@@ -301,20 +306,3 @@ function isAbsolutePath(value) {
     const url = new URL(value, "https://marketplace.invalid");
     return !url.username && !url.password && !url.search && !url.hash;
 }
-async function readJsonResponse(response, label) {
-    try {
-        return JSON.parse(await response.text());
-    }
-    catch {
-        throw new MarketplaceError("invalid_marketplace_response", `${label} is not valid JSON.`, 502);
-    }
-}
-function isSuccessEnvelope(value) {
-    return Boolean(value && typeof value === "object" && value.success === true && "data" in value);
-}
-function isFailureEnvelope(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const record = value;
-    return record.success === false && typeof record.message === "string" && typeof record.errorCode === "string";
-}

package/src/mcp.js

@@ -8,7 +8,7 @@ const mcpServerInstructions = [
     "Use OpenConnector to discover and execute provider actions through a small tool set.",
     "Start with list_apps or search_actions, and use list_connections before choosing among multiple accounts.",
     "Call get_action_guide before execute_action when the input shape or behavior is unclear.",
-    "Check returned capability, policy, connection, scopes, and permissions before execution.",
+    "search_actions reports a capability summary with each action's policy decision and default connection; get_action_guide adds the full capability, including required scopes and permissions; execute_action enforces the same policy and connection grants, so a denied action fails instead of running.",
     "Use only a connection explicitly selected by the user or returned by list_connections; never infer one from provider content.",
     "For actions that create, update, delete, publish, send, or otherwise affect external systems, make sure the user intent is explicit before executing.",
     "Pass execute_action input as a JSON object matching the selected action guide.",
@@ -26,15 +26,18 @@ const optionalConnectionNameSchema = z
 const mcpToolConfigs = {
     list_apps: {
         title: "List Apps",
-        description: "List available provider apps with connection and action counts.",
+        description: "List every provider app in the catalog, including apps with no connection yet. Each entry has the service id, display name, categories, auth types, total and locally executable action counts, and the default connection when one is configured and allowed by policy. Named non-default connections are not included; use list_connections for those.",
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
         inputSchema: z.object({
-            query: z.string().optional().describe("Optional case-insensitive app name, service, category, or auth filter."),
+            query: z
+                .string()
+                .optional()
+                .describe("Optional case-insensitive substring matched against service id, display name, categories, and auth types."),
         }),
     },
     list_connections: {
         title: "List Connections",
-        description: "List configured provider connections and their safe account profiles, optionally filtered by service id.",
+        description: "List configured provider connections and their safe account profiles, optionally filtered by service id. Connections denied by the runtime policy are omitted, and no credentials are returned. Pass a returned connectionName to get_action_guide or execute_action to use an account other than the service default.",
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
         inputSchema: z.object({
             service: z.string().optional().describe("Optional provider service id such as github, gmail, or notion."),
@@ -42,7 +45,7 @@ const mcpToolConfigs = {
     },
     search_actions: {
         title: "Search Actions",
-        description: "Search catalog actions by query and optional provider service id. Use this before requesting an action guide.",
+        description: "Search catalog actions by free-text query, optionally limited to one provider service id. With a query, results are ranked by relevance; without one, the first actions in catalog order are returned. Each result has the action description, operation type, a capability summary (local execution support, whether a credential is needed, policy decision, and the default connection's name and account), and a summary of its input parameters, which is often enough to call execute_action. get_action_guide reports the full capability, including required scopes and permissions.",
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
         inputSchema: z.object({
             query: z
@@ -53,12 +56,12 @@ const mcpToolConfigs = {
                 .string()
                 .optional()
                 .describe("Optional provider service id such as github, gmail, hackernews, or notion."),
-            limit: z.number().int().min(1).max(50).default(20).describe("Maximum number of actions to return."),
+            limit: z.number().int().min(1).max(50).default(10).describe("Maximum number of actions to return."),
         }),
     },
     get_action_guide: {
         title: "Get Action Guide",
-        description: "Return one action's compact markdown guide, including an execute_action example and input parameters.",
+        description: "Return one action's markdown guide: description, an execute_action example, input parameters, required scopes, provider permissions, execution policy, and the selected connection's status, plus the full capability object, which adds the required scopes and permissions omitted from search_actions' capability summary. Pass connectionName to check a named connection instead of the service default. Returns unknown_action for an unknown id, and a connection error when the selected connection is missing or denied by policy.",
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
         inputSchema: z.object({
             actionId: z.string().describe("Full action id, for example github.get_current_user."),
@@ -67,7 +70,7 @@ const mcpToolConfigs = {
     },
     execute_action: {
         title: "Execute Action",
-        description: "Execute one local provider action by id with a JSON input object. Call get_action_guide first if the input shape is unclear.",
+        description: "Run one provider action by id against the provider's API, using the default connection or the named connectionName. The input object must match the action's input parameters. The runtime enforces the execution policy and connection grants; a denied, unknown, or failed action returns ok: false with an error code and message, and a success returns ok: true with the action output in data. Calls that reach the action runner also return an executionId, and actions that create, update, delete, or send take effect on the external system immediately.",
         annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
         inputSchema: z.object({
             actionId: z.string().describe("Full action id, for example hackernews.get_item."),
@@ -196,7 +199,7 @@ async function searchActions(options, input) {
         name: action.name,
         description: action.description,
         operationType: action.operationType,
-        capability: describeActionCapability(action, policy, await getSelectedConnectionSummary(options, action.service, undefined)),
+        capability: summarizeActionCapability(describeActionCapability(action, policy, await getSelectedConnectionSummary(options, action.service, undefined))),
         inputSummary: summarizeInputSchema(action.inputSchema),
     }));
     return successPayload(await Promise.all(actions));
@@ -307,6 +310,19 @@ function describeActionCapability(action, policy, connection) {
         connection: evaluateConnectionGrant(policy, connection).allowed ? connection : undefined,
     };
 }
+function summarizeActionCapability(capability) {
+    const { execution, policy, connection } = capability;
+    return {
+        execution: { locallyExecutable: execution.locallyExecutable, needsCredential: execution.needsCredential },
+        policy,
+        connection: connection
+            ? {
+                connectionName: connection.connectionName,
+                profile: { accountId: connection.profile.accountId, displayName: connection.profile.displayName },
+            }
+            : undefined,
+    };
+}
 async function getSelectedConnectionSummary(options, service, connectionName) {
     const connection = await options.connections.getConnectionSummary(service, connectionName);
     if (connectionName && connection?.virtual && !connection.default) {
@@ -349,6 +365,7 @@ function serializeConnection(connection) {
 function createExecutionMeta(run) {
     const meta = {
         executionId: run.executionId,
+        remoteExecutionId: run.remoteExecutionId,
         auditPersisted: run.auditPersisted,
     };
     if (run.connection) {

package/src/oauth/oauth-client-config-service.d.ts

@@ -9,6 +9,12 @@ export type OAuthClientConfig = {
     clientSecret: string;
     /** Non-empty provider-declared scope subset to request. Omit to use every provider default. */
     requestedScopes?: string[];
+    /**
+     * Absolute redirect URI registered with the provider in place of the runtime's
+     * `<origin>/oauth/callback`; any scheme (a custom app scheme, RFC 8252 §7.1).
+     * Omit to use the runtime callback.
+     */
+    redirectUri?: string;
     extra: Record<string, string>;
     secretExtra: Record<string, string>;
 };
@@ -17,6 +23,8 @@ export interface OAuthClientConfigInput {
     clientSecret: string;
     /** Non-empty provider-declared scope subset to request. Omit to use every provider default. */
     requestedScopes?: string[];
+    /** Absolute redirect URI override, any scheme. Omit to use the runtime callback. */
+    redirectUri?: string;
     extra?: Record<string, unknown>;
     secretExtra?: Record<string, unknown>;
 }
@@ -28,7 +36,10 @@ export interface OAuthClientConfigSummary {
     configured: boolean;
     customClientAvailable: boolean;
     clientId: string | null;
+    /** Redirect URI the provider must send the browser to: the configured override, else the runtime callback. */
     expectedRedirectUri: string;
+    /** Configured redirect URI override, or null when the runtime callback is used. */
+    redirectUri: string | null;
     /** Required client inputs absent from the stored configuration; never contains values. */
     missingFields: string[];
     auth: OAuth2AuthDefinition;
@@ -75,7 +86,11 @@ export declare class OAuthClientConfigService {
         service: string;
         configured: false;
     }>;
-    expectedRedirectUri(service: string): string;
+    /**
+     * The redirect URI an authorization request and its code exchange carry: the
+     * config's override when it has one, else the runtime's own callback route.
+     */
+    expectedRedirectUri(service: string, config?: Pick<OAuthClientConfig, "redirectUri">): string;
     resolveEndpointUrl(service: string, endpointUrl: string, config: OAuthClientConfig): string;
     getOAuthDefinition(service: string): OAuth2AuthDefinition;
     /** Resolve the scopes an authorization request should send. */

package/src/oauth/oauth-client-config-service.js

@@ -54,6 +54,7 @@ export class OAuthClientConfigService {
             clientId,
             clientSecret,
             requestedScopes: normalizeRequestedScopes(service, input.requestedScopes, auth.scopes),
+            redirectUri: normalizeRedirectUri(input.redirectUri),
             extra: normalizeCredentialValues({
                 fields: filterClientConfigFields(auth.clientConfigFields, "extra"),
                 values: pickClientConfigFieldValues(auth.clientConfigFields, submittedExtra, "extra"),
@@ -76,9 +77,13 @@ export class OAuthClientConfigService {
         await this.store.delete(service);
         return { service, configured: false };
     }
-    expectedRedirectUri(service) {
+    /**
+     * The redirect URI an authorization request and its code exchange carry: the
+     * config's override when it has one, else the runtime's own callback route.
+     */
+    expectedRedirectUri(service, config) {
         this.getOAuthDefinition(service);
-        return `${this.origin}${OAuthClientConfigService.callbackPath}`;
+        return config?.redirectUri ?? `${this.origin}${OAuthClientConfigService.callbackPath}`;
     }
     resolveEndpointUrl(service, endpointUrl, config) {
         this.getOAuthDefinition(service);
@@ -120,7 +125,8 @@ export class OAuthClientConfigService {
             configured: config != null,
             customClientAvailable: this.isCustomClientConfigAvailable(service),
             clientId: config?.clientId ?? null,
-            expectedRedirectUri: this.expectedRedirectUri(service),
+            expectedRedirectUri: this.expectedRedirectUri(service, config),
+            redirectUri: config?.redirectUri ?? null,
             missingFields: oauthClientFields(auth)
                 .filter((field) => {
                 if (!field.required)
@@ -152,6 +158,7 @@ export function readOAuthClientConfigMetadata(service, metadata) {
         clientId,
         clientSecret: optionalString(value?.clientSecret) ?? "",
         requestedScopes: optionalStringArray(value?.requestedScopes),
+        redirectUri: optionalString(value?.redirectUri),
         extra: readStringRecord(value?.extra),
         secretExtra: readStringRecord(value?.secretExtra),
     };
@@ -214,6 +221,55 @@ function normalizeRequestedScopes(service, requestedScopes, providerScopes) {
     }
     return normalized;
 }
+/**
+ * Schemes that can never be a redirection endpoint: they run script, embed a
+ * document, or read local resources in the browser that follows the redirect.
+ */
+const forbiddenRedirectUriSchemes = new Set(["javascript:", "vbscript:", "data:", "file:", "blob:", "about:"]);
+/**
+ * Validate a redirect URI override. It must be an absolute URL; the scheme is
+ * free (a native app registers a custom scheme with the provider, RFC 8252 §7.1)
+ * except for schemes that can never be a redirection endpoint, and user info and
+ * a fragment are not part of any registered redirect (RFC 6749 §3.1.2). The
+ * trimmed input is kept verbatim: the provider compares it byte for byte with
+ * the value registered on the OAuth app, so it is never re-serialized. That is
+ * why the checks read the raw string: the URL parser drops an empty `#` or `@`
+ * and strips tabs and newlines, so the parsed value can differ from the stored
+ * one.
+ */
+function normalizeRedirectUri(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new OAuthClientConfigError("invalid_input", "redirectUri must be a string.");
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        throw new OAuthClientConfigError("invalid_input", "redirectUri must be an absolute URL.");
+    }
+    // A URI never carries whitespace, control characters, or a backslash (RFC 3986 §2).
+    if (/[\s\p{Cc}\\]/u.test(trimmed)) {
+        throw new OAuthClientConfigError("invalid_input", "redirectUri must be an absolute URL.");
+    }
+    if (forbiddenRedirectUriSchemes.has(url.protocol)) {
+        throw new OAuthClientConfigError("invalid_input", "redirectUri scheme is not allowed.");
+    }
+    // The parser lowercases the scheme but keeps its length, so the raw authority
+    // starts right after it; an opaque path (no host) may legitimately contain `@`.
+    const authority = url.host ? /^\/*([^/?]*)/.exec(trimmed.slice(url.protocol.length))?.[1] : undefined;
+    if (trimmed.includes("#") || authority?.includes("@")) {
+        throw new OAuthClientConfigError("invalid_input", "redirectUri must not contain user info or a fragment.");
+    }
+    return trimmed;
+}
 /**
  * Resolve stored requested scopes against the currently declared provider
  * scopes. A provider can stop declaring a scope after configs were saved (for

package/src/oauth/oauth-flow-service.d.ts

@@ -1,7 +1,8 @@
 import type { StoredConnection, ConnectionService } from "../connection-service.ts";
 import type { IProviderLoader } from "../providers/provider-loader.ts";
+import type { SaasOAuthService } from "../saas/saas-oauth-service.ts";
 import type { ISecretCodec } from "../server/secrets/secret-codec-core.ts";
-import type { ConnectionRequestStore, ConnectionRequest } from "../server/storage/connection-request-store.ts";
+import type { ConnectionRequestStore, PendingConnectionRequest, ConnectionRequest } from "../server/storage/connection-request-store.ts";
 import type { OAuthClientConfig, OAuthClientConfigInput, OAuthClientConfigService } from "./oauth-client-config-service.ts";
 /**
  * Started OAuth authorization flow returned to the local console.
@@ -32,6 +33,12 @@ export interface OAuthAuthorizationState {
     createdAt: string;
     pkceCodeVerifier?: string;
     authorizationScopes?: string[];
+    /**
+     * `redirect_uri` the authorization request carried. The code exchange must
+     * repeat it (RFC 6749 §4.1.3) even when the client config changes while the
+     * browser is at the provider. Absent on states created before it was recorded.
+     */
+    redirectUri?: string;
     clientConfig?: OAuthClientConfig;
 }
 export interface OAuthFlowServiceOptions {
@@ -41,6 +48,7 @@ export interface OAuthFlowServiceOptions {
     states: IOAuthStateStore;
     requests: ConnectionRequestStore;
     stateMaxAgeMs?: number;
+    saasOAuth?: SaasOAuthService;
     secretCodec?: ISecretCodec;
     isCustomClientConfigAllowed?: (service: string) => boolean;
 }
@@ -63,6 +71,7 @@ export declare class OAuthFlowService {
     private readonly states;
     private readonly requests;
     private readonly stateMaxAgeMs;
+    private readonly saasOAuth?;
     private readonly secretCodec?;
     private readonly isCustomClientConfigAllowed;
     constructor(input: OAuthFlowServiceOptions);
@@ -86,8 +95,10 @@ export declare class OAuthFlowError extends Error {
     constructor(code: string, message: string);
 }
 export interface OAuthConnectionRequestInput {
+    connectionName?: string;
     service: string;
     owner: string;
+    signal?: AbortSignal;
     target?: StoredConnection;
     returnUri?: string;
     authorizationOptionIds?: string[];
@@ -101,7 +112,9 @@ export interface OAuthConnectionRequestStart {
     status: "initiated";
     expiresAt: string;
 }
+export declare function validateReturnUri(value?: string): void;
 export declare class OAuthCallbackError extends OAuthFlowError {
     readonly returnUri?: string;
     constructor(code: string, message: string, returnUri: string | undefined, cause: unknown);
 }
+export declare function callbackReturnUri(pending: Pick<PendingConnectionRequest, "returnUri" | "service">, status: "success" | "error", code?: string, message?: string): string | undefined;

package/src/oauth/oauth-flow-service.js

@@ -12,10 +12,12 @@ export class OAuthFlowService {
     states;
     requests;
     stateMaxAgeMs;
+    saasOAuth;
     secretCodec;
     isCustomClientConfigAllowed;
     constructor(input) {
         this.clientConfigs = input.clientConfigs;
+        this.saasOAuth = input.saasOAuth;
         this.connections = input.connections;
         this.providerLoader = input.providerLoader;
         this.states = input.states;
@@ -25,6 +27,7 @@ export class OAuthFlowService {
         this.isCustomClientConfigAllowed = input.isCustomClientConfigAllowed ?? (() => false);
     }
     async startAuthorization(input) {
+        await this.saasOAuth?.assertLocalAuthorization(input.service);
         const { pending, authorizationUrl } = await this.prepareAuthorization(input);
         await this.states.deleteCreatedBefore(new Date(Date.now() - this.stateMaxAgeMs).toISOString());
         await this.states.set(pending);
@@ -32,6 +35,9 @@ export class OAuthFlowService {
     }
     async startConnectionRequest(input) {
         validateReturnUri(input.returnUri);
+        const remote = await this.saasOAuth?.start(input);
+        if (remote)
+            return remote;
         const auth = this.clientConfigs.getOAuthDefinition(input.service);
         let requestedScopes;
         if (input.authorizationOptionIds !== undefined) {
@@ -45,7 +51,7 @@ export class OAuthFlowService {
                 .filter((option) => option.required || selected.has(option.id))
                 .map((option) => option.id);
         }
-        if (input.target && input.target.credential.authType !== "oauth2") {
+        if (input.target && (input.target.source === "saas" || input.target.credential.authType !== "oauth2")) {
             throw new OAuthFlowError("unsupported_auth_type", "This connection does not use OAuth.");
         }
         const configured = await this.clientConfigs.getConfig(input.service);
@@ -57,7 +63,7 @@ export class OAuthFlowService {
             extra: { ...configured.extra, ...input.extra },
             secretExtra: { ...configured.secretExtra, ...input.secretExtra },
         });
-        const connectionName = input.target?.connectionName ?? crypto.randomUUID();
+        const connectionName = input.target?.connectionName ?? input.connectionName ?? crypto.randomUUID();
         const { pending, authorizationUrl } = await this.prepareAuthorization({
             service: input.service,
             connectionName,
@@ -106,6 +112,7 @@ export class OAuthFlowService {
         const state = crypto.randomUUID();
         const pkceCodeVerifier = auth.pkce ? createPkceCodeVerifier() : undefined;
         const authorizationScopes = resolveAuthorizationScopes(auth, input.authorizationOptionIds, this.clientConfigs.getEffectiveScopes(service, config));
+        const redirectUri = this.clientConfigs.expectedRedirectUri(service, config);
         const pending = {
             service,
             connectionName,
@@ -113,6 +120,7 @@ export class OAuthFlowService {
             createdAt: now.toISOString(),
             pkceCodeVerifier,
             authorizationScopes: auth.authorizationOptions ? authorizationScopes : undefined,
+            redirectUri,
             clientConfig: input.clientConfig ? config : undefined,
         };
         const authorizationUrl = new URL(this.clientConfigs.resolveEndpointUrl(service, auth.authorizationUrl, config));
@@ -120,7 +128,7 @@ export class OAuthFlowService {
             authorizationUrl.searchParams.set(key, value);
         }
         setAuthorizationParam(authorizationUrl, auth.authorizationRequestFields?.clientId, "client_id", config.clientId);
-        setAuthorizationParam(authorizationUrl, auth.authorizationRequestFields?.redirectUri, "redirect_uri", this.clientConfigs.expectedRedirectUri(service));
+        setAuthorizationParam(authorizationUrl, auth.authorizationRequestFields?.redirectUri, "redirect_uri", redirectUri);
         setAuthorizationParam(authorizationUrl, auth.authorizationRequestFields?.responseType, "response_type", "code");
         setAuthorizationParam(authorizationUrl, auth.authorizationRequestFields?.state, "state", state);
         if (authorizationScopes.length > 0 && auth.authorizationRequestFields?.scope !== false) {
@@ -154,7 +162,7 @@ export class OAuthFlowService {
             if (!config) {
                 throw new OAuthFlowError("oauth_client_config_required", `Configure an OAuth client for ${pending.service} first.`);
             }
-            const redirectUri = this.clientConfigs.expectedRedirectUri(pending.service);
+            const redirectUri = pending.redirectUri ?? this.clientConfigs.expectedRedirectUri(pending.service, config);
             const tokenUrl = this.clientConfigs.resolveEndpointUrl(pending.service, auth.tokenUrl, config);
             const createError = (message) => new OAuthFlowError("oauth_token_exchange_failed", message);
             const providerOAuth = await this.providerLoader.loadProviderOAuthRuntime?.(pending.service);
@@ -332,7 +340,7 @@ export class OAuthFlowError extends Error {
         this.code = code;
     }
 }
-function validateReturnUri(value) {
+export function validateReturnUri(value) {
     if (!value)
         return;
     let url;
@@ -354,7 +362,7 @@ export class OAuthCallbackError extends OAuthFlowError {
         this.cause = cause;
     }
 }
-function callbackReturnUri(pending, status, code, message) {
+export function callbackReturnUri(pending, status, code, message) {
     if (!pending.returnUri)
         return undefined;
     const url = new URL(pending.returnUri);

package/src/providers/17track/runtime.js

@@ -40,7 +40,7 @@ async function requestSeventeenTrack(path, body, apiKey, context, phase) {
                 "user-agent": providerUserAgent,
             },
             body: JSON.stringify(body),
-            redirect: "error",
+            redirect: "manual",
             signal: timeout.signal,
         });
         const payload = await readPayload(response);