@oomol-lab/open-connector 1.9.2 → 1.9.3

package/src/providers/woot/runtime.js

@@ -1,5 +1,5 @@
 import { optionalBoolean, optionalInteger, optionalNumber, optionalRawString, optionalRecord, requiredString, requiredStringArray, } from "../../core/cast.js";
-import { createProviderTimeout, isAbortLikeError, providerInputError, providerUserAgent, ProviderRequestError, readProviderTextBody, } from "../provider-runtime.js";
+import { createProviderTimeout, isAbortLikeError, providerInputError, providerUserAgent, ProviderRequestError, readProviderTextBody, providerResponseError, } from "../provider-runtime.js";
 export const wootApiBaseUrl = "https://developer.woot.com";
 export const wootActionHandlers = {
     async list_feed(input, context) {
@@ -101,11 +101,11 @@ function createWootError(status, payload, phase) {
     if (status === 429)
         return new ProviderRequestError(429, message);
     if (phase === "validate" && status >= 400 && status < 500)
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     if (status === 401 || status === 403)
         return new ProviderRequestError(status, message);
     if (status === 400 || status === 404)
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     return new ProviderRequestError(status >= 500 ? 502 : status, message);
 }
 function extractWootErrorMessage(payload) {
@@ -230,16 +230,16 @@ function normalizeNullablePriceRange(value) {
 function requireRecord(value, message) {
     const record = optionalRecord(value);
     if (!record)
-        throw new ProviderRequestError(502, message);
+        throw providerResponseError(message);
     return record;
 }
 function requireRecordArray(value, message) {
     if (!Array.isArray(value))
-        throw new ProviderRequestError(502, message);
+        throw providerResponseError(message);
     return value.map((item) => {
         const record = optionalRecord(item);
         if (!record)
-            throw new ProviderRequestError(502, message);
+            throw providerResponseError(message);
         return record;
     });
 }

package/src/providers/workable/runtime.js

@@ -1,5 +1,5 @@
 import { compactObject, optionalInteger, optionalRecord, optionalString } from "../../core/cast.js";
-import { createProviderTimeout, isAbortLikeError, providerUserAgent, ProviderRequestError, requiredInputString, } from "../provider-runtime.js";
+import { createProviderTimeout, isAbortLikeError, providerUserAgent, ProviderRequestError, requiredInputString, providerInputError, } from "../provider-runtime.js";
 export const workableActionHandlers = {
     async list_jobs(input, context) {
         const payload = await requestWorkableJson({
@@ -156,13 +156,13 @@ async function buildWorkableError(response, input) {
     if (response.status === 429)
         return new ProviderRequestError(429, message);
     if (input.phase === "validate" && [400, 401, 403, 404].includes(response.status)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (input.phase === "execute" && (response.status === 401 || response.status === 403)) {
         return new ProviderRequestError(401, message);
     }
     if (response.status === 400 || response.status === 422 || (response.status === 404 && input.notFoundAsInvalidInput)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     return new ProviderRequestError(response.status || 500, message);
 }

package/src/providers/workday/runtime.js

@@ -1,5 +1,5 @@
 import { optionalBoolean, optionalInteger, optionalRecord, optionalString, recordOrEmpty } from "../../core/cast.js";
-import { createProviderTimeout, isAbortLikeError, providerUserAgent, ProviderRequestError, requiredInputString, } from "../provider-runtime.js";
+import { createProviderTimeout, isAbortLikeError, providerUserAgent, ProviderRequestError, requiredInputString, providerInputError, } from "../provider-runtime.js";
 import { workdayOAuthScopes } from "./scopes.js";
 export const workdayActionHandlers = {
     async get_current_user(_input, context) {
@@ -207,15 +207,15 @@ function createWorkdayError(status, payload, phase, notFoundAsInvalidInput) {
     if (status === 429)
         return new ProviderRequestError(429, message);
     if (phase === "validate" && (status === 401 || status === 403))
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     if (phase === "execute" && status === 401)
         return new ProviderRequestError(401, message);
     if (phase === "execute" && status === 403)
         return new ProviderRequestError(403, message);
     if (status === 404 && notFoundAsInvalidInput)
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     if (status === 400 || status === 404 || status === 422)
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     return new ProviderRequestError(status >= 400 ? status : 502, message);
 }
 function extractWorkdayErrorMessage(payload) {

package/src/providers/workiom/runtime.js

@@ -1,5 +1,5 @@
 import { compactObject, optionalInteger, optionalRecord, optionalString, requiredRecord } from "../../core/cast.js";
-import { providerResponseError, providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { providerResponseError, providerUserAgent, ProviderRequestError, providerInputError, } from "../provider-runtime.js";
 export const workiomApiBaseUrl = "https://api.workiom.com";
 export const workiomApiPathPrefix = "/api/services/app";
 export const workiomActionHandlers = {
@@ -149,7 +149,7 @@ function createWorkiomError(response, payload, phase) {
         return new ProviderRequestError(phase === "validate" ? 400 : 401, message);
     }
     if (response.status >= 400 && response.status < 500)
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     return new ProviderRequestError(response.status || 500, message);
 }
 function readArrayFromPayload(payload, paths) {

package/src/providers/workiz/runtime.js

@@ -1,5 +1,5 @@
 import { optionalBoolean, optionalInteger, optionalRecord, optionalString, requiredString } from "../../core/cast.js";
-import { createProviderTimeout, providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { createProviderTimeout, providerUserAgent, ProviderRequestError, providerInputError, } from "../provider-runtime.js";
 export const workizApiBaseUrl = "https://api.workiz.com/api/v1";
 function setQuery(query, name, value) {
     if (value !== undefined)
@@ -100,6 +100,6 @@ function mapError(status, payload, phase) {
     if (status === 401 || status === 403)
         return new ProviderRequestError(phase === "validate" ? 400 : status, message);
     if (phase === "validate" && status < 500)
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     return new ProviderRequestError(status >= 500 ? 502 : status, message);
 }

package/src/providers/workpath/executors.js

@@ -1,9 +1,8 @@
 import { compactObject, optionalRecord, optionalString, positiveInteger, requiredRecord } from "../../core/cast.js";
-import { createProviderTimeout, defineApiKeyProviderExecutors, defineProviderProxy, isAbortLikeError, providerInputError, providerUserAgent, ProviderRequestError, } from "../provider-runtime.js";
+import { createProviderTimeout, defineApiKeyProviderExecutors, defineProviderProxy, isAbortLikeError, providerInputError, providerUserAgent, ProviderRequestError, defaultProviderRequestTimeoutMs, } from "../provider-runtime.js";
 const service = "workpath";
 const workpathApiBaseUrl = "https://connect.workpath.com/api/v3";
 const workpathValidationPath = "/users";
-const workpathDefaultRequestTimeoutMs = 30_000;
 export const workpathActionHandlers = {
     async list_goals(input, context) {
         assertDateRangePair(input);
@@ -148,7 +147,7 @@ async function workpathRequest(context, input) {
             url.searchParams.set(key, String(value));
         }
     }
-    const timeout = createProviderTimeout(context.signal, workpathDefaultRequestTimeoutMs);
+    const timeout = createProviderTimeout(context.signal);
     try {
         const response = await context.fetcher(url, {
             method: "GET",
@@ -174,7 +173,7 @@ async function workpathRequest(context, input) {
             throw error;
         }
         if (timeout.didTimeout() || isAbortLikeError(error)) {
-            throw new ProviderRequestError(504, `Workpath ${input.path} request timed out after ${Math.ceil(workpathDefaultRequestTimeoutMs / 1000)} seconds`);
+            throw new ProviderRequestError(504, `Workpath ${input.path} request timed out after ${Math.ceil(defaultProviderRequestTimeoutMs / 1000)} seconds`);
         }
         throw new ProviderRequestError(502, error instanceof Error ? `Workpath request failed: ${error.message}` : "Workpath request failed");
     }

package/src/providers/worksnaps/executors.js

@@ -1,6 +1,6 @@
 import { Buffer } from "node:buffer";
 import { compactObject, optionalString } from "../../core/cast.js";
-import { defineApiKeyProviderExecutors, defineProviderProxy, providerUserAgent, ProviderRequestError, runProviderRequest, } from "../provider-runtime.js";
+import { defineApiKeyProviderExecutors, defineProviderProxy, providerUserAgent, ProviderRequestError, runProviderRequest, providerInputError, } from "../provider-runtime.js";
 export const worksnapsApiBaseUrl = "https://api.worksnaps.com/api";
 const service = "worksnaps";
 const worksnapsValidationPath = "/me.xml";
@@ -223,7 +223,7 @@ function buildWorksnapsHeaders(apiKey) {
 function createWorksnapsError(status, body, phase) {
     const message = extractWorksnapsErrorMessage(body) ?? `Worksnaps request failed with status ${status}`;
     if (phase === "validate" && status >= 400 && status < 500) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     return new ProviderRequestError(status || 502, message);
 }

package/src/providers/y_gy/runtime.js

@@ -1,5 +1,5 @@
 import { compactObject, optionalBoolean, optionalInteger, optionalRecord, optionalString } from "../../core/cast.js";
-import { createProviderTimeout, isAbortLikeError, providerUserAgent, ProviderRequestError, readProviderTextBody, } from "../provider-runtime.js";
+import { createProviderTimeout, isAbortLikeError, providerUserAgent, ProviderRequestError, readProviderTextBody, providerInputError, } from "../provider-runtime.js";
 export const yGyApiBaseUrl = "https://api.y.gy/api/v1";
 const linksPath = "/link";
 const maxResponseBytes = 10 * 1024 * 1024;
@@ -212,7 +212,7 @@ function createYGyError(status, payload, mode, notFoundAsInvalidInput) {
         return new ProviderRequestError(status, message);
     }
     if (status === 400 || status === 409 || status === 422 || (status === 404 && notFoundAsInvalidInput)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     return new ProviderRequestError(status || 502, message);
 }

package/src/providers/zenscrape/runtime.js

@@ -1,5 +1,5 @@
 import { compactObject, optionalBoolean, optionalNumber, optionalRawString, optionalRecord } from "../../core/cast.js";
-import { providerUserAgent, ProviderRequestError, readProviderTextBody, runProviderRequest, } from "../provider-runtime.js";
+import { providerUserAgent, ProviderRequestError, readProviderTextBody, runProviderRequest, providerInputError, } from "../provider-runtime.js";
 export const zenscrapeApiBaseUrl = "https://app.zenscrape.com/api/v1";
 const zenscrapeGetUrl = `${zenscrapeApiBaseUrl}/get`;
 const requestTimeoutMs = 80_000;
@@ -97,13 +97,13 @@ function createZenscrapeError(status, body, phase) {
     if (status === 429)
         return new ProviderRequestError(429, message);
     if (phase === "validate" && status >= 400 && status < 500) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (phase === "execute" && (status === 401 || status === 403)) {
         return new ProviderRequestError(status, message);
     }
     if (phase === "execute" && status === 400) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     return new ProviderRequestError(status || 502, message);
 }

package/src/providers/zep/runtime.js

@@ -1,5 +1,5 @@
 import { compactObject, optionalBoolean, optionalNumber, optionalRecord, optionalString } from "../../core/cast.js";
-import { providerUserAgent, ProviderRequestError, readProviderTextBody, runProviderRequest, } from "../provider-runtime.js";
+import { providerUserAgent, ProviderRequestError, readProviderTextBody, runProviderRequest, providerInputError, providerResponseError, } from "../provider-runtime.js";
 export const zepApiBaseUrl = "https://api.getzep.com/api/v2";
 const validationEndpoint = "/projects/info";
 const maxResponseBytes = 10 * 1024 * 1024;
@@ -180,15 +180,15 @@ function createZepError(status, payload, phase) {
     if (status === 429)
         return new ProviderRequestError(429, message);
     if (phase === "validate" && status >= 400 && status < 500) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (status === 401 || status === 403) {
         return new ProviderRequestError(status, message);
     }
     if (status >= 400 && status < 500) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
-    return new ProviderRequestError(502, message);
+    return providerResponseError(message);
 }
 function extractZepErrorMessage(payload) {
     if (typeof payload === "string")

package/src/providers/zeplin/runtime.js

@@ -1,6 +1,6 @@
 import { compactObject, objectArray, optionalInteger, optionalNumber, optionalRecord, optionalString, requiredRecord, requiredString, } from "../../core/cast.js";
 import { encodePathSegment, queryParams } from "../../core/request.js";
-import { providerResponseError, providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
+import { providerResponseError, providerUserAgent, ProviderRequestError, providerInputError, } from "../provider-runtime.js";
 import { zeplinReadScope } from "./scopes.js";
 export const zeplinApiBaseUrl = "https://api.zeplin.dev/v1";
 export const zeplinActionHandlers = {
@@ -186,7 +186,7 @@ function mapZeplinError(status, text, phase) {
         return new ProviderRequestError(429, message);
     }
     if (status >= 400 && status < 500) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     return new ProviderRequestError(status || 502, message);
 }

package/src/providers/zhihu/executors.js

@@ -5,7 +5,7 @@ import { basename, extname, join } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { compactObject, optionalRecord } from "../../core/cast.js";
-import { createProviderFetch, createProviderTimeout, defineApiKeyProviderExecutors, defineProviderProxy, ProviderRequestError, providerUserAgent, } from "../provider-runtime.js";
+import { createProviderFetch, createProviderTimeout, defineApiKeyProviderExecutors, defineProviderProxy, ProviderRequestError, providerUserAgent, providerInputError, providerResponseError, } from "../provider-runtime.js";
 const zhihuApiBaseUrl = "https://developer.zhihu.com";
 const zhihuUserAgent = providerUserAgent;
 const maximumZhihuUploadBytes = 100 * 1024 * 1024;
@@ -245,13 +245,13 @@ async function buildZhihuError(response, mode) {
         return new ProviderRequestError(429, message);
     }
     if (mode === "validate" && (response.status === 400 || response.status === 401 || response.status === 403)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (mode === "execute" && (response.status === 401 || response.status === 403)) {
         return new ProviderRequestError(401, message);
     }
     if (mode === "execute" && (response.status === 400 || response.status === 404)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     return new ProviderRequestError(response.status || 500, message);
 }
@@ -263,15 +263,15 @@ function buildZhihuPayloadError(payload, mode) {
         return new ProviderRequestError(429, message);
     }
     if (mode === "validate" && (code === 10001 || code === 20001)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (mode === "execute" && code === 20001) {
         return new ProviderRequestError(401, message);
     }
     if (mode === "execute" && code === 10001) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
-    return new ProviderRequestError(502, message);
+    return providerResponseError(message);
 }
 async function readZhihuPayload(response) {
     const text = await response.text();

package/src/providers/zylvie/runtime.js

@@ -1,5 +1,5 @@
 import { optionalRecord, optionalString, requiredString } from "../../core/cast.js";
-import { createProviderTimeout, getProviderActionHandler, ProviderRequestError, providerUserAgent, requiredResponseRecord, } from "../provider-runtime.js";
+import { createProviderTimeout, getProviderActionHandler, ProviderRequestError, providerUserAgent, requiredResponseRecord, providerInputError, } from "../provider-runtime.js";
 export const zylvieApiBaseUrl = "https://api.zylvie.com";
 const productFieldMap = {
     title: "title",
@@ -144,7 +144,7 @@ const actionHandlers = {
 };
 export async function validateZylvieCredential(input, fetcher) {
     const payload = await requestZylvieJson({
-        apiKey: requiredString(input.apiKey, "apiKey", (message) => new ProviderRequestError(400, message)),
+        apiKey: requiredString(input.apiKey, "apiKey", providerInputError),
         path: "/me",
         method: "GET",
         fetcher,
@@ -240,13 +240,13 @@ function createRequestError(response, payload, phase) {
         return new ProviderRequestError(429, message);
     }
     if (phase === "validate" && response.status >= 400 && response.status < 500) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     if (phase === "execute" && (response.status === 401 || response.status === 403)) {
         return new ProviderRequestError(401, message);
     }
     if ([400, 404, 409, 422].includes(response.status)) {
-        return new ProviderRequestError(400, message);
+        return providerInputError(message);
     }
     return new ProviderRequestError(response.status || 500, message);
 }

package/src/saas/saas-cleanup-service.d.ts

@@ -1,8 +1,10 @@
+import type { ProviderNetworkPolicy } from "../core/provider-network-policy.ts";
 import type { RuntimeLogger } from "../core/types.ts";
 import type { ConnectionRequestStore } from "../server/storage/connection-request-store.ts";
 import type { SaasProjectStore } from "../server/storage/saas-project-store.ts";
 import { SaasClient } from "./saas-client.ts";
 export interface SaasCleanupServiceOptions {
+    network?: ProviderNetworkPolicy;
     store: SaasProjectStore;
     requests: ConnectionRequestStore;
     client?: SaasClient;

package/src/saas/saas-cleanup-service.js

@@ -1,3 +1,4 @@
+import { withProviderNetworkPolicy } from "../core/provider-network-policy.js";
 import { SaasClient, SaasError } from "./saas-client.js";
 /** Resumable deletion of ordinary SaaS accounts; never creates or reconnects an account. */
 export class SaasCleanupService {
@@ -14,7 +15,7 @@ export class SaasCleanupService {
     run() {
         if (this.shutdown.signal.aborted)
             return Promise.resolve();
-        this.pending ??= this.runBatch()
+        this.pending ??= withProviderNetworkPolicy(this.options.network ?? {}, () => this.runBatch())
             .catch(() => {
             this.options.logger?.warn({ errorCode: "saas_cleanup_failed" }, "SaaS cleanup batch failed; pending work is retained");
         })

package/src/saas/saas-execution-service.d.ts

@@ -1,4 +1,4 @@
-import type { SaasConnectionReference } from "../connection-service.ts";
+import type { SaasConnectionReference } from "../connection-store.ts";
 import type { SaasActionResult, SaasProxyResult } from "./saas-client.ts";
 import type { SaasProjectService } from "./saas-project-service.ts";
 import { SaasClient } from "./saas-client.ts";

package/src/server/actions/action-runner.js

@@ -1,4 +1,4 @@
-import { ConnectionError } from "../../connection-service.js";
+import { ConnectionError } from "../../connection-error.js";
 import { executeAction as executeProviderAction } from "../../core/execution.js";
 import { withProviderHttpDispatch } from "../../core/provider-http-dispatch.js";
 import { ProviderDispatchRequestError, toProviderExecutionError, withProviderHttpDispatchResult, } from "../../providers/provider-runtime.js";

package/src/server/api/auth.js

@@ -102,6 +102,9 @@ function isPublicPath(path, method) {
         (method === "GET" && path === "/api/auth/session") ||
         (method === "POST" && path === "/api/auth/logout") ||
         (method === "GET" && path.startsWith("/api/files/")) ||
+        // This route performs its own dedicated bearer check; the global admin/runtime
+        // middleware must not require a different token.
+        (method === "POST" && path === "/v1/providers/slackbot/events/verify") ||
         isConsoleShellRequest(path, method));
 }
 export async function readLocalAuthSession(context, options) {

package/src/server/api/connection-routes.js

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import { ConnectionError } from "../../connection-service.js";
+import { ConnectionError } from "../../connection-error.js";
 import { OAuthClientConfigError } from "../../oauth/oauth-client-config-service.js";
 import { OAuthFlowError } from "../../oauth/oauth-flow-service.js";
 import { SaasError } from "../../saas/saas-client.js";

package/src/server/api/console-catalog-routes.js

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import { ConnectionError } from "../../connection-service.js";
+import { ConnectionError } from "../../connection-error.js";
 import { searchActions } from "../../core/action-search.js";
 import { renderActionMarkdown } from "./action-markdown.js";
 import { jsonError, notFound, readConnectionName as defaultReadConnectionName } from "./http-utils.js";

package/src/server/api/console-oauth-routes.d.ts

@@ -12,7 +12,9 @@ export interface ConsoleOAuthRoutesOptions {
     saasProject?: SaasProjectService;
     logger?: RuntimeLogger;
     oauthCloseDelaySeconds?: number;
+    /** Origins a provider-refusal page may post its result to (`OOMOL_CONNECT_OAUTH_RESULT_ORIGINS`). */
+    oauthResultOrigins?: readonly string[];
     readConnectionName?: (context: Context, body?: Record<string, unknown>) => string | undefined;
 }
 /** Console connection management and OAuth client configuration / authorization routes. */
-export declare function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientConfigs, saasProject, logger, oauthCloseDelaySeconds, readConnectionName, }: ConsoleOAuthRoutesOptions): Hono;
+export declare function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientConfigs, saasProject, logger, oauthCloseDelaySeconds, oauthResultOrigins, readConnectionName, }: ConsoleOAuthRoutesOptions): Hono;

package/src/server/api/console-oauth-routes.js

@@ -1,10 +1,10 @@
 import { Hono } from "hono";
-import { ConnectionError } from "../../connection-service.js";
+import { ConnectionError } from "../../connection-error.js";
 import { optionalBoolean, optionalRecord, optionalString, requiredRawString, requiredString, requiredStringArray, } from "../../core/cast.js";
 import { OAuthClientConfigError } from "../../oauth/oauth-client-config-service.js";
 import { OAuthCallbackError, OAuthFlowError } from "../../oauth/oauth-flow-service.js";
 import { HttpRequestError, jsonError, readConnectionName as defaultReadConnectionName, readJsonBody, } from "./http-utils.js";
-import { renderOAuthCompletionPage } from "./oauth-completion-page.js";
+import { oauthProviderErrorCode, renderOAuthCompletionPage, renderOAuthRefusedPage } from "./oauth-completion-page.js";
 function readOAuthClientConfigInput(body) {
     const keys = ["clientId", "clientSecret", "requestedScopes", "redirectUri", "extra", "secretExtra"];
     if (!keys.some((key) => key in body)) {
@@ -31,7 +31,7 @@ function readOptionalStringArray(body, fieldName) {
     return requiredStringArray(body[fieldName], fieldName, (message) => new HttpRequestError("invalid_input", `${message}.`));
 }
 /** Console connection management and OAuth client configuration / authorization routes. */
-export function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientConfigs, saasProject, logger, oauthCloseDelaySeconds, readConnectionName = defaultReadConnectionName, }) {
+export function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientConfigs, saasProject, logger, oauthCloseDelaySeconds, oauthResultOrigins = [], readConnectionName = defaultReadConnectionName, }) {
     const app = new Hono();
     const writeConnectionResult = async (context, operation, logContext) => {
         try {
@@ -149,7 +149,7 @@ export function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientCo
         return writeOAuthResult(context, oauthClientConfigs.upsertConfig({
             service,
             clientId: optionalString(body.clientId) ?? "",
-            clientSecret: optionalString(body.clientSecret) ?? "",
+            clientSecret: readOptionalRawString(body, "clientSecret"),
             requestedScopes: readOptionalStringArray(body, "requestedScopes"),
             redirectUri: readOptionalRawString(body, "redirectUri"),
             extra: optionalRecord(body.extra),
@@ -243,14 +243,27 @@ export function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientCo
                 : undefined;
             if (returnUri)
                 return context.redirect(returnUri);
-            const providerErrorDescription = context.req.query("error_description");
+            // A runtime authorization (`POST /api/oauth/authorizations`) has no
+            // return address: it was opened in a popup. End the authorization so it
+            // cannot complete later, and give the popup a page that tells the person
+            // what happened and, for an allowed opener, posts the result.
+            const errorCode = oauthProviderErrorCode(providerError);
+            // Only a refusal that ended a pending authorization names its state, so
+            // a late duplicate callback for a state another callback already
+            // completed cannot tell the opener that the authorization failed.
+            const discarded = state ? await oauthFlow.discardAuthorization(state) : false;
             logger?.warn({
                 ...logContext,
                 errorCode: "oauth_provider_error",
-                providerError,
-                providerErrorDescription,
-            }, "oauth callback failed");
-            return jsonError(context, 400, "oauth_provider_error", `OAuth provider returned error "${providerError}"${providerErrorDescription ? `: ${providerErrorDescription}` : "."}`);
+                providerError: errorCode,
+                providerErrorDescription: context.req.query("error_description"),
+            }, "oauth callback refused by provider");
+            return context.html(renderOAuthRefusedPage({
+                code: errorCode,
+                state: discarded ? state : undefined,
+                resultOrigins: oauthResultOrigins,
+                closeDelaySeconds: oauthCloseDelaySeconds,
+            }));
         }
         if (!state || !code) {
             if (state)

package/src/server/api/oauth-completion-page.d.ts

@@ -18,6 +18,10 @@ export declare const oauthCompletionStrings: {
         network: string;
         notFound: string;
         forbidden: string;
+        refusedBadge: string;
+        cancelledTitle: string;
+        refusedTitle: string;
+        refusedBody: string;
     };
     "zh-CN": {
         badge: string;
@@ -38,6 +42,10 @@ export declare const oauthCompletionStrings: {
         network: string;
         notFound: string;
         forbidden: string;
+        refusedBadge: string;
+        cancelledTitle: string;
+        refusedTitle: string;
+        refusedBody: string;
     };
     "zh-TW": {
         badge: string;
@@ -58,6 +66,10 @@ export declare const oauthCompletionStrings: {
         network: string;
         notFound: string;
         forbidden: string;
+        refusedBadge: string;
+        cancelledTitle: string;
+        refusedTitle: string;
+        refusedBody: string;
     };
     ja: {
         badge: string;
@@ -78,6 +90,10 @@ export declare const oauthCompletionStrings: {
         network: string;
         notFound: string;
         forbidden: string;
+        refusedBadge: string;
+        cancelledTitle: string;
+        refusedTitle: string;
+        refusedBody: string;
     };
     fr: {
         badge: string;
@@ -98,6 +114,10 @@ export declare const oauthCompletionStrings: {
         network: string;
         notFound: string;
         forbidden: string;
+        refusedBadge: string;
+        cancelledTitle: string;
+        refusedTitle: string;
+        refusedBody: string;
     };
     ru: {
         badge: string;
@@ -118,6 +138,10 @@ export declare const oauthCompletionStrings: {
         network: string;
         notFound: string;
         forbidden: string;
+        refusedBadge: string;
+        cancelledTitle: string;
+        refusedTitle: string;
+        refusedBody: string;
     };
 };
 export declare const oauthCompletionStyles = "\n:root {\n  --background: hsl(0 0% 100%);\n  --foreground: hsl(222.2 84% 4.9%);\n  --card: hsl(0 0% 100%);\n  --card-foreground: hsl(222.2 84% 4.9%);\n  --muted: hsl(210 40% 96.1%);\n  --muted-foreground: hsl(215.4 16.3% 46.9%);\n  --border: hsl(214.3 31.8% 91.4%);\n  --primary: hsl(222.2 47.4% 11.2%);\n  --primary-foreground: hsl(210 40% 98%);\n  --ring: hsl(222.2 84% 4.9%);\n}\n* {\n  box-sizing: border-box;\n}\nbody {\n  min-height: 100vh;\n  margin: 0;\n  display: grid;\n  place-items: center;\n  padding: 24px;\n  background: var(--background);\n  color: var(--foreground);\n  font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n}\n.card {\n  width: min(100%, 420px);\n  padding: 24px;\n  border: 1px solid var(--border);\n  border-radius: 12px;\n  background: var(--card);\n  color: var(--card-foreground);\n  box-shadow: 0 1px 2px hsl(222.2 84% 4.9% / 0.04), 0 12px 32px hsl(222.2 84% 4.9% / 0.08);\n}\n.header {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n}\n.badge {\n  width: fit-content;\n  display: inline-flex;\n  align-items: center;\n  border: 1px solid transparent;\n  border-radius: 999px;\n  padding: 2px 10px;\n  background: var(--primary);\n  color: var(--primary-foreground);\n  font-size: 12px;\n  font-weight: 600;\n  line-height: 20px;\n}\nh1 {\n  margin: 0;\n  font-size: 20px;\n  line-height: 28px;\n  font-weight: 600;\n}\np {\n  margin: 0;\n  color: var(--muted-foreground);\n  font-size: 14px;\n  line-height: 22px;\n}\ncode {\n  border-radius: 6px;\n  background: var(--muted);\n  padding: 2px 6px;\n  color: var(--foreground);\n  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", monospace;\n  font-size: 13px;\n}\n.actions {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n  flex-wrap: wrap;\n  margin-top: 24px;\n}\n.button {\n  appearance: none;\n  border: 1px solid var(--border);\n  border-radius: 8px;\n  background: var(--card);\n  color: var(--foreground);\n  padding: 8px 14px;\n  font: inherit;\n  font-size: 14px;\n  font-weight: 500;\n  line-height: 20px;\n  cursor: pointer;\n}\n.button:focus-visible {\n  outline: 2px solid var(--ring);\n  outline-offset: 2px;\n}\n.button:hover {\n  background: var(--muted);\n}\n.close-note {\n  font-size: 12px;\n  line-height: 18px;\n}\n\n[hidden]{display:none!important}\n.button:disabled{opacity:.5;cursor:wait}\na.button{text-decoration:none}\n.actions{justify-content:flex-start}\n";
@@ -125,3 +149,36 @@ export declare const oauthCompletionLocaleScript = "const pick=()=>{try{const st
 /** Seconds the OAuth completion page counts down before it tries to close its window. */
 export declare const DEFAULT_OAUTH_CLOSE_DELAY_SECONDS = 5;
 export declare function renderOAuthCompletionPage(service: string, closeDelaySeconds?: number): string;
+/** The `type` of the message a refusal page posts to the window that opened it. */
+export declare const oauthRefusedType = "oauth.refused";
+/**
+ * Reads the origins a refusal page may post its result to: a comma-separated
+ * list of exact HTTP(S) origins. `*` and anything that is not an origin are
+ * rejected, so the result can never be broadcast to an arbitrary opener.
+ */
+export declare function parseOAuthResultOrigins(value: string | undefined): string[];
+/**
+ * The same rules for origins given as a list, such as the `oauthResultOrigins`
+ * runtime option: blank entries are skipped and duplicates dropped; anything
+ * that is not an exact http(s) origin, `*` included, throws.
+ */
+export declare function normalizeOAuthResultOrigins(entries: readonly string[]): string[];
+/** A provider error code that is safe to echo: short and code-shaped, else `provider_error`. */
+export declare function oauthProviderErrorCode(providerError: string): string;
+export interface OAuthRefusedPageInput {
+    /** The provider's error code, already passed through `oauthProviderErrorCode`. */
+    code: string;
+    /** The state of the refused authorization; set only when this callback ended a pending one. */
+    state?: string;
+    /** Origins allowed to receive the result; empty means the page posts nothing. */
+    resultOrigins: readonly string[];
+    closeDelaySeconds?: number;
+}
+/**
+ * The page a provider's refusal lands on when the authorization has no return
+ * address. When this window was opened by a page on an allowed origin, it
+ * posts `{ type: "oauth.refused", status, code, state }` to that origin only;
+ * either way the shared countdown closes it after `closeDelaySeconds`. Success is never
+ * reported this way: the opener learns it from its own server.
+ */
+export declare function renderOAuthRefusedPage(input: OAuthRefusedPageInput): string;