@slates/provider 1.0.0-rc.16 → 1.0.0-rc.17

package/dist/index.module.js

@@ -56,6 +56,124 @@ var SlateAction = class {
   }
 };
 
+// src/error/api.ts
+import { badRequestError, ServiceError } from "@lowerdeck/error";
+var DEFAULT_DETAIL_KEYS = ["message", "detail", "error", "error_description", "code"];
+var DEFAULT_NESTED_KEYS = ["errors"];
+var isApiErrorRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var pushDetail = (details, value, options = {}) => {
+  if (typeof value !== "string" && (options.includeNumbers === false || typeof value !== "number")) {
+    return;
+  }
+  let detail = String(value).trim();
+  if (detail && !details.includes(detail)) {
+    details.push(detail);
+  }
+};
+var collectApiErrorDetails = (value, details, options = {}) => {
+  if (Array.isArray(value)) {
+    for (let item of value) {
+      collectApiErrorDetails(item, details, options);
+    }
+    return;
+  }
+  if (!isApiErrorRecord(value)) {
+    pushDetail(details, value, options);
+    return;
+  }
+  for (let key of options.detailKeys ?? DEFAULT_DETAIL_KEYS) {
+    pushDetail(details, value[key], options);
+  }
+  for (let key of options.nestedKeys ?? DEFAULT_NESTED_KEYS) {
+    collectApiErrorDetails(value[key], details, options);
+  }
+};
+var getSlateErrorResponse = (error) => {
+  if (error.name !== "SlateError" || !isApiErrorRecord(error.data)) {
+    return void 0;
+  }
+  let data = error.data;
+  let upstream = isApiErrorRecord(data.upstream) ? data.upstream : void 0;
+  let status = upstream?.status ?? data.status;
+  return typeof status === "number" || typeof status === "string" ? { status } : void 0;
+};
+var getApiErrorResponse = (error) => {
+  if (!isApiErrorRecord(error)) {
+    return void 0;
+  }
+  if (!isApiErrorRecord(error.response)) {
+    return getSlateErrorResponse(error);
+  }
+  let response = error.response;
+  return {
+    status: typeof response.status === "number" || typeof response.status === "string" ? response.status : void 0,
+    statusText: typeof response.statusText === "string" ? response.statusText : void 0,
+    data: response.data
+  };
+};
+var getApiErrorStatus = (error) => getApiErrorResponse(error)?.status;
+var statusLabelForApiError = (status, statusText) => status !== void 0 ? `HTTP ${status}${statusText ? ` ${statusText}` : ""}: ` : "";
+var extractApiErrorMessage = (error, options = {}) => {
+  let details = [];
+  let response = options.response ?? getApiErrorResponse(error);
+  collectApiErrorDetails(response?.data, details, options);
+  if (details.length > 0) {
+    return details.join(options.separator ?? " - ");
+  }
+  if (error instanceof Error && error.message) {
+    return error.message;
+  }
+  return options.fallbackMessage ?? "Unknown error";
+};
+var createApiServiceError = (message, options = {}) => {
+  let error = new ServiceError(badRequestError({ message }));
+  if (options.reason !== void 0) {
+    error.data.reason = options.reason;
+  }
+  if ("upstreamStatus" in options) {
+    error.data.upstreamStatus = options.upstreamStatus;
+  }
+  if ("upstreamCode" in options) {
+    error.data.upstreamCode = options.upstreamCode;
+  }
+  if (options.parent instanceof Error) {
+    error.setParent(options.parent);
+  }
+  return error;
+};
+var helpers = {
+  collectDetails: collectApiErrorDetails,
+  extractMessage: extractApiErrorMessage,
+  getResponse: getApiErrorResponse,
+  getStatus: getApiErrorStatus,
+  isRecord: isApiErrorRecord,
+  statusLabelFor: statusLabelForApiError
+};
+var buildApiServiceError = (error, options) => {
+  if (error instanceof ServiceError) {
+    return error;
+  }
+  let operation = options.operation ?? "request";
+  let response = options.extractResponse?.(error, helpers) ?? getApiErrorResponse(error);
+  let status = options.extractStatus?.(error, response, helpers) ?? response?.status;
+  let message = options.extractMessage?.(error, helpers) ?? extractApiErrorMessage(error, { ...options, response });
+  let statusLabel = statusLabelForApiError(status, response?.statusText);
+  let fullMessage = options.formatMessage?.({
+    providerLabel: options.providerLabel,
+    operation,
+    statusLabel,
+    message,
+    response,
+    status
+  }) ?? `${options.providerLabel} API ${operation} failed: ${statusLabel}${message}`;
+  return createApiServiceError(fullMessage, {
+    reason: options.reason,
+    upstreamStatus: status,
+    upstreamCode: options.extractUpstreamCode?.(error, response, helpers),
+    parent: options.parent ?? error
+  });
+};
+
 // src/error/axios.ts
 import { isAxiosError } from "axios";
 
@@ -745,7 +863,8 @@ var SlateActionBuilder = class {
       handleEvent: props.handleEvent,
       handleRequest: props.handleRequest,
       autoRegisterWebhook: props.autoRegisterWebhook,
-      autoUnregisterWebhook: props.autoUnregisterWebhook
+      autoUnregisterWebhook: props.autoUnregisterWebhook,
+      http: props.http
     };
     return this;
   }
@@ -820,6 +939,7 @@ var SlateTrigger = class _SlateTrigger extends SlateAction {
   #polling;
   #handleEvent;
   #handleRequest;
+  #http;
   #pollEvents;
   #autoRegisterWebhook;
   #autoUnregisterWebhook;
@@ -831,6 +951,7 @@ var SlateTrigger = class _SlateTrigger extends SlateAction {
     };
     this.#handleEvent = params.handleEvent;
     this.#handleRequest = params.handleRequest;
+    this.#http = params.http;
     this.#pollEvents = params.pollEvents;
     this.#autoRegisterWebhook = params.autoRegisterWebhook;
     this.#autoUnregisterWebhook = params.autoUnregisterWebhook;
@@ -853,6 +974,9 @@ var SlateTrigger = class _SlateTrigger extends SlateAction {
   get handleRequest() {
     return this.#handleRequest;
   }
+  get http() {
+    return this.#http;
+  }
   get pollEvents() {
     return this.#pollEvents;
   }
@@ -947,6 +1071,90 @@ var SlateAuth = class _SlateAuth {
 };
 var auth = () => SlateAuth.create();
 
+// src/auth/oauth.ts
+var isOAuthTokenResponse = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var formatOAuthTokenResponseMessage = (fieldLabel, providerLabel = "OAuth provider", operation = "token response") => `${providerLabel} OAuth ${operation} did not return ${fieldLabel}.`;
+var getOAuthExpiresAtFromExpiresIn = (expiresIn, options = {}) => {
+  let {
+    nowMs = Date.now(),
+    providerLabel,
+    operation,
+    required = false,
+    expiresInType = "numberLike",
+    message
+  } = options;
+  if (expiresIn === void 0 || expiresIn === null || expiresIn === "") {
+    if (required) {
+      throw createApiServiceError(
+        message ?? formatOAuthTokenResponseMessage(
+          "a valid expires_in value",
+          providerLabel,
+          operation
+        ),
+        { reason: "oauth_token_response" }
+      );
+    }
+    return void 0;
+  }
+  let seconds = typeof expiresIn === "number" ? expiresIn : expiresInType === "numberLike" && typeof expiresIn === "string" ? Number(expiresIn) : Number.NaN;
+  if (!Number.isFinite(seconds)) {
+    throw createApiServiceError(
+      message ?? formatOAuthTokenResponseMessage("a valid expires_in value", providerLabel, operation),
+      { reason: "oauth_token_response" }
+    );
+  }
+  return new Date(nowMs + seconds * 1e3).toISOString();
+};
+var getRefreshToken = (refreshToken, previousRefreshToken, fallbackMode) => {
+  if (typeof refreshToken === "string") {
+    if (fallbackMode === "falsy" && !refreshToken) {
+      return previousRefreshToken;
+    }
+    return refreshToken;
+  }
+  if (fallbackMode === "falsy" && !refreshToken) {
+    return previousRefreshToken;
+  }
+  return refreshToken === void 0 || refreshToken === null ? previousRefreshToken : void 0;
+};
+var normalizeOAuthTokenResponse = (data, options = {}) => {
+  let {
+    providerLabel,
+    operation,
+    previousRefreshToken,
+    refreshTokenFallbackMode = "nullish",
+    accessTokenMessage,
+    expiresInMessage,
+    ...expiresAtOptions
+  } = options;
+  if (!isOAuthTokenResponse(data)) {
+    throw createApiServiceError(
+      accessTokenMessage ?? formatOAuthTokenResponseMessage("a token response object", providerLabel, operation),
+      { reason: "oauth_token_response" }
+    );
+  }
+  if (typeof data.access_token !== "string" || !data.access_token) {
+    throw createApiServiceError(
+      accessTokenMessage ?? formatOAuthTokenResponseMessage("an access token", providerLabel, operation),
+      { reason: "oauth_token_response" }
+    );
+  }
+  return {
+    token: data.access_token,
+    refreshToken: getRefreshToken(
+      data.refresh_token,
+      previousRefreshToken,
+      refreshTokenFallbackMode
+    ),
+    expiresAt: getOAuthExpiresAtFromExpiresIn(data.expires_in, {
+      ...expiresAtOptions,
+      providerLabel,
+      operation,
+      message: expiresInMessage
+    })
+  };
+};
+
 // src/axios/index.ts
 import baseAxios, { getAdapter, isAxiosError as isAxiosError2 } from "axios";
 
@@ -1530,6 +1738,35 @@ var createAxios = (config2) => {
   applySlateInterceptors(instance, errorMapping);
   return instance;
 };
+var createAuthenticatedAxios = (config2) => {
+  let { authHeader, contentType = "application/json", errorAdapter, ...axiosConfig } = config2;
+  let instance = createAxios({
+    ...axiosConfig,
+    headers: {
+      ...contentType === false ? {} : { "Content-Type": contentType },
+      ...authHeader ? { [authHeader.name ?? "Authorization"]: authHeader.value } : {},
+      ...axiosConfig.headers
+    }
+  });
+  if (errorAdapter) {
+    instance.interceptors.response.use(
+      (response) => response,
+      (error) => Promise.reject(errorAdapter(error))
+    );
+  }
+  return instance;
+};
+var requestAxios = async (operation, request, errorAdapter) => {
+  try {
+    return await request();
+  } catch (error) {
+    throw errorAdapter(error, operation);
+  }
+};
+var requestAxiosData = async (operation, request, errorAdapter) => {
+  let response = await requestAxios(operation, request, errorAdapter);
+  return response.data;
+};
 var axios = createAxios();
 
 // src/config/config.ts
@@ -1608,6 +1845,11 @@ var SlateContext = class {
   get request() {
     return Object.freeze(this.#input.request);
   }
+  get registrationDetails() {
+    return Object.freeze(
+      this.#input.registrationDetails
+    );
+  }
   get auth() {
     return Object.freeze(this.#auth);
   }
@@ -1646,6 +1888,45 @@ var SlateContext = class {
   }
 };
 
+// src/crypto/hmac.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var createHmacSignature = ({
+  secret,
+  payload,
+  algorithm = "sha256",
+  digest,
+  prefix = ""
+}) => `${prefix}${createHmac(algorithm, secret).update(payload).digest(digest)}`;
+var verifyHmacSignature = (options) => {
+  let expected = createHmacSignature(options);
+  let expectedBytes = Buffer.from(expected);
+  let signatureBytes = Buffer.from(options.signature);
+  let lengthsMatch = signatureBytes.length === expectedBytes.length;
+  let comparableSignature = lengthsMatch ? signatureBytes : Buffer.alloc(expectedBytes.length);
+  return timingSafeEqual(comparableSignature, expectedBytes) && lengthsMatch;
+};
+
+// src/file/index.ts
+var getResponseHeaderValue = (headers, name) => {
+  if (!headers) return void 0;
+  if (typeof headers.get === "function") {
+    let value = headers.get(name);
+    return typeof value === "string" ? value : void 0;
+  }
+  if (typeof headers !== "object") return void 0;
+  let lowerName = name.toLowerCase();
+  for (let [headerName, value] of Object.entries(headers)) {
+    if (headerName.toLowerCase() !== lowerName) continue;
+    if (Array.isArray(value)) {
+      let first = value.find((item) => typeof item === "string");
+      return typeof first === "string" ? first : void 0;
+    }
+    return typeof value === "string" ? value : void 0;
+  }
+  return void 0;
+};
+var getBase64ByteLength = (contentBase64) => Buffer.from(contentBase64, "base64").byteLength;
+
 // src/logger/logger.ts
 import { encode } from "@toon-format/toon";
 var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -1741,6 +2022,17 @@ var SlateLogger = class {
   }
 };
 
+// src/object/index.ts
+var pickDefined = (value) => Object.fromEntries(
+  Object.entries(value).filter(([, child]) => child !== void 0)
+);
+var setIfDefined = (target, key, value) => {
+  if (value !== void 0) {
+    target[key] = value;
+  }
+  return target;
+};
+
 // src/specification/slate.ts
 var Slate = class _Slate {
   constructor(_spec, _actions) {
@@ -1803,6 +2095,59 @@ var SlateSpecification = class _SlateSpecification {
   }
 };
 var spec = (params) => SlateSpecification.create(params);
+
+// src/webhook/graph.ts
+var graphWebhookHttp = {
+  methods: ["POST"],
+  sync: {
+    mode: "match",
+    match: [{ hasQueryParam: "validationToken" }]
+  }
+};
+var getGraphWebhookValidationResponse = (request) => {
+  let validationToken = new URL(request.url).searchParams.get("validationToken");
+  if (validationToken === null) return null;
+  return {
+    status: 200,
+    headers: { "content-type": "text/plain" },
+    body: validationToken
+  };
+};
+
+// src/webhook/meta.ts
+var metaWebhookHttp = {
+  methods: ["GET", "POST"],
+  sync: {
+    mode: "match",
+    match: [{ method: "GET", hasQueryParam: "hub.mode" }]
+  }
+};
+var getMetaWebhookVerificationResponse = (request, expectedVerifyToken) => {
+  if (request.method !== "GET") return null;
+  let url = new URL(request.url);
+  let mode = url.searchParams.get("hub.mode");
+  let verifyToken = url.searchParams.get("hub.verify_token");
+  let challenge = url.searchParams.get("hub.challenge");
+  if (mode !== "subscribe" || challenge === null) {
+    return {
+      status: 400,
+      headers: { "content-type": "text/plain" },
+      body: "invalid webhook verification request"
+    };
+  }
+  if (expectedVerifyToken !== void 0 && verifyToken !== expectedVerifyToken) {
+    return {
+      status: 403,
+      headers: { "content-type": "text/plain" },
+      body: "invalid verify token"
+    };
+  }
+  return {
+    status: 200,
+    headers: { "content-type": "text/plain" },
+    body: challenge
+  };
+};
 export {
   Slate,
   SlateAction,
@@ -1820,24 +2165,47 @@ export {
   anyOf,
   auth,
   axios,
+  buildApiServiceError,
+  collectApiErrorDetails,
   config,
+  createApiServiceError,
+  createAuthenticatedAxios,
   createAxios,
   createBase64Attachment,
+  createHmacSignature,
   createSlateError,
   createTextAttachment,
   createUrlAttachment,
+  extractApiErrorMessage,
+  getApiErrorResponse,
+  getApiErrorStatus,
+  getBase64ByteLength,
   getCurrentContext,
+  getGraphWebhookValidationResponse,
+  getMetaWebhookVerificationResponse,
+  getOAuthExpiresAtFromExpiresIn,
+  getResponseHeaderValue,
   getServiceErrorData,
+  graphWebhookHttp,
   inferSlateErrorFromAxios,
+  isApiErrorRecord,
   isAxiosErrorLike,
   isServiceErrorData,
   mapServiceErrorCode,
   mapServiceErrorToSlateErrorInput,
   mergeScopes,
+  metaWebhookHttp,
+  normalizeOAuthTokenResponse,
+  pickDefined,
+  requestAxios,
+  requestAxiosData,
   runWithContext,
   scopeClause,
+  setIfDefined,
   spec,
+  statusLabelForApiError,
   tool,
   trigger,
-  validateScopes
+  validateScopes,
+  verifyHmacSignature
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@slates/provider",
-  "version": "1.0.0-rc.16",
+  "version": "1.0.0-rc.17",
   "publishConfig": {
     "access": "public"
   },

package/src/action/action.ts

@@ -62,15 +62,58 @@ export type SlateTriggerPollingHandler<
   updatedState?: any;
 }>;
 
+export interface SlateWebhookHttpResponseInit {
+  status?: number;
+  headers?: Record<string, string>;
+  body?: string | Uint8Array | null;
+}
+
+export type SlateWebhookHttpMethod =
+  | 'GET'
+  | 'POST'
+  | 'PUT'
+  | 'PATCH'
+  | 'DELETE'
+  | 'HEAD'
+  | 'OPTIONS';
+
+export interface SlateWebhookRequestMatcher {
+  method?: string;
+  hasQueryParam?: string;
+  hasHeader?: string;
+  jsonBodyField?: {
+    path: string;
+    equals?: string;
+  };
+  formBodyField?: {
+    path: string;
+    equals?: string;
+  };
+}
+
+export interface SlateWebhookHttpOptions {
+  methods?: SlateWebhookHttpMethod[];
+  sync?: {
+    mode: 'never' | 'match' | 'always';
+    match?: SlateWebhookRequestMatcher[];
+    timeoutMs?: number;
+  };
+}
+
 export type SlateTriggerWebhookRequestHandler<
   ConfigType extends {},
   AuthType extends {},
   InputType extends {}
 > = (
-  context: SlateContext<ConfigType, AuthType, { request: Request; state: any | null }>
+  context: SlateContext<
+    ConfigType,
+    AuthType,
+    { request: Request; state: any | null; registrationDetails: any | null }
+  >
 ) => Promise<{
   inputs: InputType[];
   updatedState?: any;
+  response?: Response | SlateWebhookHttpResponseInit;
 }>;
 
 export type SlateTriggerWebhookAutoRegistrationHandler<
@@ -117,6 +160,7 @@ export interface SlateActionParametersTrigger<
   polling?: SlatePollingOptions;
   handleEvent: SlateTriggerMappingHandler<ConfigType, AuthType, InputType, OutputType>;
   handleRequest?: SlateTriggerWebhookRequestHandler<ConfigType, AuthType, InputType>;
+  http?: SlateWebhookHttpOptions;
   pollEvents?: SlateTriggerPollingHandler<ConfigType, AuthType, InputType>;
   autoRegisterWebhook?: SlateTriggerWebhookAutoRegistrationHandler<ConfigType, AuthType>;
   autoUnregisterWebhook?: SlateTriggerWebhookAutoUnregistrationHandler<ConfigType, AuthType>;

package/src/action/builder.ts

@@ -15,7 +15,8 @@ import type {
   SlateTriggerPollingHandler,
   SlateTriggerWebhookAutoRegistrationHandler,
   SlateTriggerWebhookAutoUnregistrationHandler,
-  SlateTriggerWebhookRequestHandler
+  SlateTriggerWebhookRequestHandler,
+  SlateWebhookHttpOptions
 } from './action';
 import { validateScopes } from './scopes';
 
@@ -115,6 +116,7 @@ export class SlateActionBuilder<
     handleRequest: SlateTriggerWebhookRequestHandler<ConfigType, AuthType, InputType>;
     autoRegisterWebhook?: SlateTriggerWebhookAutoRegistrationHandler<ConfigType, AuthType>;
     autoUnregisterWebhook?: SlateTriggerWebhookAutoUnregistrationHandler<ConfigType, AuthType>;
+    http?: SlateWebhookHttpOptions;
   }): SlateActionBuilder<Type, ConfigType, AuthType, InputType, OutputType, Result> {
     if (this.type !== 'trigger') {
       throw new SlateDeclarationError('handleEvent can only be set for trigger actions');
@@ -126,7 +128,8 @@ export class SlateActionBuilder<
       handleEvent: props.handleEvent,
       handleRequest: props.handleRequest,
       autoRegisterWebhook: props.autoRegisterWebhook,
-      autoUnregisterWebhook: props.autoUnregisterWebhook
+      autoUnregisterWebhook: props.autoUnregisterWebhook,
+      http: props.http
     };
 
     return this;

package/src/action/trigger.ts

@@ -8,7 +8,8 @@ import {
   type SlateTriggerPollingHandler,
   type SlateTriggerWebhookAutoRegistrationHandler,
   type SlateTriggerWebhookAutoUnregistrationHandler,
-  type SlateTriggerWebhookRequestHandler
+  type SlateTriggerWebhookRequestHandler,
+  type SlateWebhookHttpOptions
 } from './action';
 import { SlateActionBuilder } from './builder';
 
@@ -27,6 +28,7 @@ export interface SlateTriggerParameters<
   polling?: SlatePollingOptions;
   handleEvent: SlateTriggerMappingHandler<ConfigType, AuthType, InputType, OutputType>;
   handleRequest?: SlateTriggerWebhookRequestHandler<ConfigType, AuthType, InputType>;
+  http?: SlateWebhookHttpOptions;
   pollEvents?: SlateTriggerPollingHandler<ConfigType, AuthType, InputType>;
   autoRegisterWebhook?: SlateTriggerWebhookAutoRegistrationHandler<ConfigType, AuthType>;
   autoUnregisterWebhook?: SlateTriggerWebhookAutoUnregistrationHandler<ConfigType, AuthType>;
@@ -44,6 +46,7 @@ export class SlateTrigger<
   #polling: SlatePollingOptions;
   #handleEvent: SlateTriggerMappingHandler<ConfigType, AuthType, InputType, OutputType>;
   #handleRequest?: SlateTriggerWebhookRequestHandler<ConfigType, AuthType, InputType>;
+  #http?: SlateWebhookHttpOptions;
   #pollEvents?: SlateTriggerPollingHandler<ConfigType, AuthType, InputType>;
   #autoRegisterWebhook?: SlateTriggerWebhookAutoRegistrationHandler<ConfigType, AuthType>;
   #autoUnregisterWebhook?: SlateTriggerWebhookAutoUnregistrationHandler<ConfigType, AuthType>;
@@ -62,6 +65,7 @@ export class SlateTrigger<
     };
     this.#handleEvent = params.handleEvent;
     this.#handleRequest = params.handleRequest;
+    this.#http = params.http;
     this.#pollEvents = params.pollEvents;
     this.#autoRegisterWebhook = params.autoRegisterWebhook;
     this.#autoUnregisterWebhook = params.autoUnregisterWebhook;
@@ -93,6 +97,10 @@ export class SlateTrigger<
     return this.#handleRequest;
   }
 
+  get http() {
+    return this.#http;
+  }
+
   get pollEvents() {
     return this.#pollEvents;
   }

package/src/auth/index.ts

@@ -1,2 +1,3 @@
 export * from './auth';
+export * from './oauth';
 export * from './types';

package/src/auth/oauth.test.ts

@@ -0,0 +1,83 @@
+import { ServiceError } from '@lowerdeck/error';
+import { describe, expect, it } from 'vitest';
+import type { ApiServiceError } from '../error/api';
+import { getOAuthExpiresAtFromExpiresIn, normalizeOAuthTokenResponse } from './oauth';
+
+describe('OAuth auth helpers', () => {
+  it('converts expires_in seconds to an ISO expiresAt timestamp', () => {
+    expect(getOAuthExpiresAtFromExpiresIn(60, { nowMs: 0 })).toBe('1970-01-01T00:01:00.000Z');
+  });
+
+  it('normalizes token responses and preserves omitted refresh tokens', () => {
+    expect(
+      normalizeOAuthTokenResponse(
+        {
+          access_token: 'access-token',
+          expires_in: '120'
+        },
+        {
+          nowMs: 0,
+          previousRefreshToken: 'existing-refresh-token'
+        }
+      )
+    ).toEqual({
+      token: 'access-token',
+      refreshToken: 'existing-refresh-token',
+      expiresAt: '1970-01-01T00:02:00.000Z'
+    });
+  });
+
+  it('supports falsy refresh-token fallback semantics', () => {
+    expect(
+      normalizeOAuthTokenResponse(
+        {
+          access_token: 'access-token',
+          refresh_token: ''
+        },
+        {
+          previousRefreshToken: 'existing-refresh-token',
+          refreshTokenFallbackMode: 'falsy'
+        }
+      ).refreshToken
+    ).toBe('existing-refresh-token');
+  });
+
+  it('throws ServiceError for missing access tokens', () => {
+    let call = () =>
+      normalizeOAuthTokenResponse(
+        {
+          expires_in: 120
+        },
+        {
+          providerLabel: 'Example',
+          operation: 'token exchange'
+        }
+      );
+
+    expect(call).toThrow(ServiceError);
+
+    try {
+      call();
+    } catch (error) {
+      expect(error).toBeInstanceOf(ServiceError);
+      expect((error as ApiServiceError).data.reason).toBe('oauth_token_response');
+    }
+  });
+
+  it('can require a numeric expires_in value', () => {
+    expect(() =>
+      normalizeOAuthTokenResponse(
+        {
+          access_token: 'access-token',
+          expires_in: '120'
+        },
+        {
+          providerLabel: 'Example',
+          operation: 'token exchange',
+          required: true,
+          expiresInType: 'number'
+        }
+      )
+    ).toThrow(ServiceError);
+  });
+});