@superblocksteam/shared 0.9615.3 → 0.9616.0

package/src/socket/socketWithClientAuth.test.ts

@@ -0,0 +1,117 @@
+import { once } from 'node:events';
+
+import { trace } from '@opentelemetry/api';
+import WebSocket from 'isomorphic-ws';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import type { SocketMessage } from './socket.js';
+import { ISocketWithClientAuth } from './socketWithClientAuth.js';
+import { connectWebSocket } from './util.js';
+
+describe('socket request authorization', () => {
+  const servers: WebSocket.Server[] = [];
+  const authorizations: Array<string | undefined> = [];
+
+  async function connect(options: { authorization?: string; getAuthorization?: () => Promise<string> }) {
+    const server = new WebSocket.Server({ host: '127.0.0.1', port: 0 });
+    servers.push(server);
+    server.on('connection', (ws) => {
+      ws.on('message', (data) => {
+        const message: SocketMessage = JSON.parse(data.toString());
+        if (!message.request) throw new Error('Expected a socket request');
+        authorizations.push(message.request.setAuthorization);
+        ws.send(JSON.stringify({ response: { error: null, id: message.request.id, payload: 'ok' } }));
+      });
+    });
+    await once(server, 'listening');
+    const address = server.address();
+    if (!address || typeof address === 'string') throw new Error('Expected a TCP test server');
+    const ws = await connectWebSocket(`ws://127.0.0.1:${address.port}`);
+    return new ISocketWithClientAuth(ws, options.authorization, {}, [], trace.getTracer('socket-auth-test'), {
+      getAuthorization: options.getAuthorization,
+      onClose: () => undefined
+    });
+  }
+
+  afterEach(async () => {
+    authorizations.length = 0;
+    for (const server of servers.splice(0)) {
+      for (const client of server.clients) client.terminate();
+      await new Promise<void>((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+    }
+  });
+
+  it('refreshes authorization before each request and sends only changed credentials', async () => {
+    let authorization = 'Bearer first-token';
+    const socket = await connect({ authorization: 'Bearer expired-token', getAuthorization: async () => authorization });
+
+    await expect(socket.request('test.read', {})).resolves.toBe('ok');
+    await expect(socket.request('test.read', {})).resolves.toBe('ok');
+    authorization = 'Bearer second-token';
+    await expect(socket.request('test.read', {})).resolves.toBe('ok');
+
+    expect(authorizations).toEqual(['Bearer first-token', undefined, 'Bearer second-token']);
+    socket.close();
+  });
+
+  it('does not restore stale authorization when refreshes resolve out of order', async () => {
+    let resolveFirst!: (value: string) => void;
+    const first = new Promise<string>((resolve) => {
+      resolveFirst = resolve;
+    });
+    const getAuthorization = vi.fn().mockReturnValueOnce(first).mockResolvedValueOnce('Bearer new-token');
+    const socket = await connect({ getAuthorization });
+
+    const olderRequest = socket.request('test.read', {});
+    await expect(socket.request('test.read', {})).resolves.toBe('ok');
+    resolveFirst('Bearer old-token');
+    await expect(olderRequest).resolves.toBe('ok');
+
+    expect(authorizations).toEqual(['Bearer new-token', undefined]);
+    socket.close();
+  });
+
+  it('does not overwrite a manual account switch while refresh is pending', async () => {
+    let resolveRefresh!: (value: string) => void;
+    const refreshing = new Promise<string>((resolve) => {
+      resolveRefresh = resolve;
+    });
+    const socket = await connect({ getAuthorization: () => refreshing });
+
+    const pending = socket.request('test.read', {});
+    socket.setAuthorization('Bearer switched-token');
+    resolveRefresh('Bearer stale-token');
+    await expect(pending).resolves.toBe('ok');
+
+    expect(authorizations).toEqual(['Bearer switched-token']);
+    socket.close();
+  });
+
+  it('sends no request when refreshing authorization fails and allows a later retry', async () => {
+    let refreshFailed = true;
+    const socket = await connect({
+      authorization: 'Bearer expired-token',
+      getAuthorization: async () => {
+        if (refreshFailed) throw new Error('Refresh unavailable');
+        return 'Bearer refreshed-token';
+      }
+    });
+
+    await expect(socket.request('test.read', {})).rejects.toThrow('Refresh unavailable');
+    refreshFailed = false;
+    await expect(socket.request('test.read', {})).resolves.toBe('ok');
+
+    expect(authorizations).toEqual(['Bearer refreshed-token']);
+    socket.close();
+  });
+
+  it('preserves static authorization when no provider is supplied', async () => {
+    const socket = await connect({ authorization: 'Bearer personal-token' });
+
+    await expect(socket.request('test.read', {})).resolves.toBe('ok');
+    await expect(socket.request('test.read', {})).resolves.toBe('ok');
+
+    expect(authorizations).toEqual(['Bearer personal-token', undefined]);
+    socket.close();
+  });
+});

package/src/socket/socketWithClientAuth.ts

@@ -15,6 +15,8 @@ export class ISocketWithClientAuth<ImplementedMethods, CallableMethods, RequestC
 > {
   private authorization?: string;
   private authorizationVersion = 0;
+  private authorizationRequestVersion = 0;
+  private readonly getAuthorization?: () => Promise<string>;
   private hasSentAuth = false;
 
   constructor(
@@ -28,15 +30,27 @@ export class ISocketWithClientAuth<ImplementedMethods, CallableMethods, RequestC
       timeouts?: SocketTimeouts;
       logger?: { error: (message?: string) => void; info: (message?: string) => void; warn: (message?: string) => void };
       getAbortSignal?: () => AbortSignal | undefined;
+      getAuthorization?: () => Promise<string>;
     }
   ) {
     super(ws, requestHandlers, globalMiddlewares, tracer, options);
     this.authorization = authorization;
+    this.getAuthorization = options.getAuthorization;
   }
 
   // override `request` from the base class to send `authorization` when appropriate
   async request<Params, Result>(method: string, params: Params): Promise<Result> {
-    // only send `authorization` on the first request
+    if (this.getAuthorization) {
+      const requestVersion = ++this.authorizationRequestVersion;
+      const authorizationVersion = this.authorizationVersion;
+      const authorization = await this.getAuthorization();
+      if (
+        requestVersion === this.authorizationRequestVersion &&
+        authorizationVersion === this.authorizationVersion &&
+        authorization !== this.authorization
+      )
+        this.setAuthorization(authorization);
+    }
     const authorizationVersion = this.authorizationVersion;
     const authorization = this.hasSentAuth ? undefined : this.authorization;
     const result = await super.request<Params, Result>(method, params, authorization);

package/src/types/datasource/auth.ts

@@ -350,6 +350,7 @@ type PublicOAuthClientCredsConfig = {
 type OAuthClientCredsConfig = PublicOAuthClientCredsConfig & {
   clientSecret?: string;
   audience?: string;
+  clientAuthMethod?: ClientAuthMethod;
 };
 
 type PublicOAuthImplicitConfig = {
@@ -427,6 +428,9 @@ export enum TokenType {
 
 export type TokenMetadata = {
   email?: string;
+  // Host of the token endpoint the token was minted at. Recorded by every token store so a
+  // configuration that moves to another tenant can tell which rows belong to the previous one.
+  issuerHost?: string;
 };
 
 type FakeBoolean = boolean | string;

package/src/types/datasource/index.test.ts

@@ -1,11 +1,13 @@
 import { describe, test, expect } from 'vitest';
 
+import { SUPERBLOCKS_OPENAPI_TENANT_KEYWORD } from '../plugin/integration.js';
 import { IntegrationAuthType } from './auth.js';
 import {
   DatasourceConfiguration,
   isAuthenticatedDatasourceConfig,
   isAuthenticatedDatasourceConfigWithDynamicAuthType,
-  getAuthTypeFromConfig
+  getAuthTypeFromConfig,
+  withResolvedTenantOAuthUrls
 } from './index.js';
 
 describe('isAuthenticatedDatasourceConfig', () => {
@@ -499,3 +501,24 @@ describe('getAuthTypeFromConfig', () => {
     expect(getAuthTypeFromConfig(config)).toBe(IntegrationAuthType.OAUTH2_CODE);
   });
 });
+
+describe('withResolvedTenantOAuthUrls', () => {
+  test('resolves the OAuth URLs of a form-built configuration against the tenant it carries', () => {
+    // Test Connection sends live form values, which hold the template's placeholder; the payload
+    // that leaves the browser must not.
+    const configuration = {
+      authType: IntegrationAuthType.OAUTH2_CODE,
+      openApiTenantName: 'acme',
+      urlBase: `https://${SUPERBLOCKS_OPENAPI_TENANT_KEYWORD}.zendesk.com`,
+      authConfig: { clientId: 'abc', tokenUrl: `https://${SUPERBLOCKS_OPENAPI_TENANT_KEYWORD}.zendesk.com/oauth/tokens` }
+    } as unknown as Parameters<typeof withResolvedTenantOAuthUrls>[0];
+
+    expect(withResolvedTenantOAuthUrls(configuration)).toEqual({
+      ...configuration,
+      authConfig: { clientId: 'abc', tokenUrl: 'https://acme.zendesk.com/oauth/tokens' }
+    });
+    // urlBase is left to the executor, which has always substituted it itself.
+    const withoutTenant = { ...configuration, openApiTenantName: undefined };
+    expect(withResolvedTenantOAuthUrls(withoutTenant)).toBe(withoutTenant);
+  });
+});

package/src/types/datasource/index.ts

@@ -16,6 +16,7 @@ import { SecretsV1 as Secrets } from '@superblocksteam/types';
 
 import { Property } from '../common/property.js';
 import { Plugin, PluginMetadata } from '../plugin/index.js';
+import { resolveAuthConfigTenantUrls } from '../plugin/integration.js';
 import { CreatorDto } from '../rbac/index.js';
 import { AWSAuthType, AuthConfig, AuthId, AuthType, IntegrationAuthType, PostgresAuthType, getAuthId } from './auth.js';
 export { PluginCommonV1 as PluginCommon } from '@superblocksteam/types';
@@ -276,6 +277,36 @@ export function getAuthTypeFromConfig(dc: DatasourceConfiguration): AuthType | u
   return undefined;
 }
 
+/**
+ * The tenant a datasource is configured against, for the plugins that have one. Mirrors
+ * getAuthTypeFromConfig: the field only exists on REST-API-backed configurations, and callers
+ * hold the wider DatasourceConfiguration union.
+ */
+export function getOpenApiTenantNameFromConfig(dc: DatasourceConfiguration): string | undefined {
+  // Configurations are stored as JSON, so the declared type is a claim about the column rather
+  // than a guarantee. Narrow at runtime so the signature is true and a non-string cannot reach
+  // the URL construction downstream.
+  const tenantName = 'openApiTenantName' in dc ? dc.openApiTenantName : undefined;
+  return typeof tenantName === 'string' ? tenantName : undefined;
+}
+
+/**
+ * A configuration with its per-tenant OAuth URLs resolved against the tenant it carries.
+ *
+ * The integration form keeps those URLs as the template's placeholder so Connect can follow the
+ * tenant as it is edited; the server resolves them on save. Anything else built from live form
+ * values and sent for execution, such as Test Connection, has to resolve them itself or the
+ * request carries an unusable host.
+ */
+export function withResolvedTenantOAuthUrls<T extends DatasourceConfiguration>(dc: T): T {
+  const tenantName = getOpenApiTenantNameFromConfig(dc);
+  const authConfig = 'authConfig' in dc ? dc.authConfig : undefined;
+  if (!tenantName || !authConfig || typeof authConfig !== 'object') {
+    return dc;
+  }
+  return { ...dc, authConfig: resolveAuthConfigTenantUrls(authConfig as Record<string, unknown>, tenantName) };
+}
+
 export type GraphQLDatasourceConfiguration = AuthenticatedHttpDatasourceConfig & {
   path?: string;
 };

package/src/types/deployment/index.ts

@@ -21,4 +21,6 @@ export interface DeploymentDto {
   deployMessage: string;
   deploymentTime: number;
   deployedGitSha?: string | null;
+  /** True when this commit can publish again. Policy checks are off, or the stored checks already passed. */
+  policyChecksPassed?: boolean;
 }

package/src/types/event/index.ts

@@ -8,6 +8,7 @@ export enum EventEntityType {
   WORKFLOW = 'workflow',
   SCHEDULED_JOB = 'scheduled_job',
   DATASOURCE = 'datasource',
+  FEEDBACK = 'feedback',
   FOLDER = 'folder',
   USER = 'user',
   ORGANIZATION = 'organization',
@@ -128,6 +129,8 @@ export enum EventAction {
   DISABLED = 'disabled',
   ENABLED = 'enabled',
   PUBLISH_ANYWAY = 'publish_anyway',
+  RATED = 'rated',
+  SHOWN = 'shown',
   EDIT_AFTER_CLARK = 'edit_after_clark'
 }
 

package/src/types/observability/index.ts

@@ -25,8 +25,9 @@ export type PostSinksResponseDto = {
   observability: Observability;
 };
 
+// id, created and updated are server-owned; the create route rejects them with a 400.
 export type PostSinksRequestDto = {
-  observability: Observability;
+  observability: Pick<Observability, 'type' | 'datasource' | 'config' | 'organizationId'>;
 };
 
 export type PutSinksResponseDto = {

package/src/types/plugin/form.test.ts

@@ -6,9 +6,11 @@ import {
   assertPkcePrerequisites,
   assertSelectedDropdownOptionsSupported,
   getDisplayOnlyFieldNames,
-  isDropdownOptionSupported
+  isDropdownOptionSupported,
+  withTenantOAuthUrlTemplates
 } from './form.js';
 import type { FormTemplate } from './form.js';
+import { SUPERBLOCKS_OPENAPI_TENANT_KEYWORD } from './integration.js';
 
 describe('getDisplayOnlyFieldNames', () => {
   it('returns ALERT field names', () => {
@@ -332,3 +334,32 @@ describe('assertSelectedDropdownOptionsSupported', () => {
     expect(() => assertSelectedDropdownOptionsSupported({ authType: 'oauth', usePkce: true }, template, '0.0.16')).not.toThrow();
   });
 });
+
+describe('withTenantOAuthUrlTemplates', () => {
+  it('replaces a stored, already-resolved OAuth URL with the template so Connect follows the tenant being edited', () => {
+    const tokenUrlTemplate = `https://${SUPERBLOCKS_OPENAPI_TENANT_KEYWORD}.zendesk.com/oauth/tokens`;
+    const template = {
+      sections: [
+        {
+          name: 'auth',
+          items: [
+            { name: 'authConfig.tokenUrl', componentType: FormComponentType.INPUT_TEXT, initialValue: tokenUrlTemplate },
+            { name: 'authConfig.clientId', componentType: FormComponentType.INPUT_TEXT, initialValue: '' }
+          ]
+        }
+      ]
+    } as unknown as FormTemplate;
+
+    const seeded = withTenantOAuthUrlTemplates(
+      { 'authConfig.tokenUrl': 'https://acme.zendesk.com/oauth/tokens', 'authConfig.clientId': 'stored-client' },
+      template
+    );
+
+    // Only the placeholder-bearing field is taken from the template; the rest keeps its stored
+    // value, and a template with fixed endpoints leaves everything as it was.
+    expect(seeded).toEqual({ 'authConfig.tokenUrl': tokenUrlTemplate, 'authConfig.clientId': 'stored-client' });
+    expect(withTenantOAuthUrlTemplates({ 'authConfig.tokenUrl': 'https://api.box.com/oauth2/token' }, undefined)).toEqual({
+      'authConfig.tokenUrl': 'https://api.box.com/oauth2/token'
+    });
+  });
+});

package/src/types/plugin/form.ts

@@ -10,6 +10,7 @@ import {
 } from '../datasource/index.js';
 import { AgentType, compareSemVer } from '../organization/index.js';
 import { VERSION_INITIAL } from './index.js';
+import { resolveOpenApiTenantUrl } from './integration.js';
 
 export interface FormTemplate {
   sections: FormSection[];
@@ -287,6 +288,14 @@ export enum EditorLanguage {
 export interface DropdownFormItem extends BaseFormItem {
   componentType: FormComponentType.DROPDOWN;
   options: DropdownOption[];
+  /**
+   * Rollout gate on the options themselves. While the LaunchDarkly flag evaluates to false only
+   * the options whose value is listed in `keep` are offered (plus any the form is told to
+   * preserve, such as a stored value), and the initial value falls back to the first of them.
+   * An allowlist rather than a denylist, so an option added later is hidden by construction
+   * until the flag is on.
+   */
+  optionsLdFlag?: { ldFlag: string; keep: string[] };
   showSearch?: boolean;
   optionFilterProp?: string;
   subtitle?: string;
@@ -349,6 +358,9 @@ type RevokeOAuthTokensPayload = {
     integrationId: string;
     configurationId: string;
     isNew: boolean;
+    // Set for providers that host each customer on their own subdomain; resolves the tenant
+    // placeholder the plugin template stores in its OAuth URLs.
+    openApiTenantName?: string;
     authType?: AuthType;
     authConfig?: {
       tokenScope: TokenScope;
@@ -364,6 +376,8 @@ type ConnectOAuthPayload = {
     configurationId: string;
     isNew: boolean;
     pluginId: string;
+    // See RevokeOAuthTokensPayload.
+    openApiTenantName?: string;
     accessType?: string;
     responseType?: string;
     stateConfigExclude?: AuthorizationStateConfig[];
@@ -577,3 +591,43 @@ export function assertSelectedDropdownOptionsSupported(
     }
   }
 }
+
+// The OAuth URL fields a plugin template may declare with the tenant placeholder.
+const TENANT_OAUTH_URL_FIELDS = ['tokenUrl', 'authorizationUrl', 'revokeTokenUrl'] as const;
+
+export type TenantOAuthUrlField = (typeof TENANT_OAUTH_URL_FIELDS)[number];
+
+/**
+ * The initial values of a datasource template's OAuth URL fields that carry the tenant
+ * placeholder, keyed by the `authConfig` field they belong to. Empty for a template whose
+ * provider has fixed endpoints.
+ */
+export const tenantOAuthUrlTemplates = (template: FormTemplate | undefined): Map<TenantOAuthUrlField, string> => {
+  const templates = new Map<TenantOAuthUrlField, string>();
+  const items = template?.sections.flatMap((section) => section.items.flatMap(getRowItemsFromSectionItem)) ?? [];
+  for (const field of TENANT_OAUTH_URL_FIELDS) {
+    const item = items.find((candidate) => candidate.name === `authConfig.${field}`);
+    const value = item?.initialValue;
+    if (typeof value === 'string' && value !== resolveOpenApiTenantUrl(value, 'probe')) {
+      templates.set(field, value);
+    }
+  }
+  return templates;
+};
+
+/**
+ * Seed a form's values with the template's per-tenant OAuth URLs, over whatever the stored
+ * configuration holds for them.
+ *
+ * The stored configuration carries those URLs already resolved, because readers outside the
+ * browser use them verbatim. The form must not: Connect resolves the placeholder from the tenant
+ * as it is being edited, so a form seeded with the stored value would keep authorizing against
+ * the previous subdomain until the next save.
+ */
+export const withTenantOAuthUrlTemplates = <T extends Record<string, unknown>>(values: T, template: FormTemplate | undefined): T => {
+  const seeded = { ...values };
+  for (const [field, url] of tenantOAuthUrlTemplates(template)) {
+    (seeded as Record<string, unknown>)[`authConfig.${field}`] = url;
+  }
+  return seeded;
+};

package/src/types/plugin/integration.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest';
+
+import { resolveAuthConfigTenantUrls, resolveOpenApiTenantUrl, SUPERBLOCKS_OPENAPI_TENANT_KEYWORD } from './integration.js';
+
+const TEMPLATE = `https://${SUPERBLOCKS_OPENAPI_TENANT_KEYWORD}.zendesk.com/oauth/tokens`;
+
+describe('resolveOpenApiTenantUrl', () => {
+  it('refuses a tenant that would move the host out of the template', () => {
+    // The placeholder sits inside the host, so a tenant carrying a path, userinfo, query or
+    // fragment separator repoints the request -- `evil.com/` would aim it at evil.com. These
+    // URLs receive OAuth tokens and client secrets, so an unusable tenant is refused outright
+    // rather than escaped or trimmed.
+    for (const hostile of ['evil.com/', 'x@evil.com', 'evil.com#', 'evil.com?', 'evil.com:443', 'acme.zendesk.com']) {
+      expect(resolveOpenApiTenantUrl(TEMPLATE, hostile), hostile).toBe(TEMPLATE);
+    }
+  });
+
+  it('leaves the placeholder in place when no tenant is configured', () => {
+    // An unresolved placeholder is an unusable host, which is the point: the request fails
+    // instead of silently reaching whatever a stripped placeholder would resolve to.
+    expect(resolveOpenApiTenantUrl(TEMPLATE, undefined)).toBe(TEMPLATE);
+  });
+});
+
+describe('resolveAuthConfigTenantUrls', () => {
+  it('resolves the OAuth URLs a config carries, leaves other fields alone, and adds none it lacked', () => {
+    const resolved = resolveAuthConfigTenantUrls(
+      {
+        authorizationUrl: `https://${SUPERBLOCKS_OPENAPI_TENANT_KEYWORD}.zendesk.com/oauth/authorizations/new`,
+        tokenUrl: TEMPLATE,
+        clientId: 'client-id'
+      },
+      'acme'
+    );
+
+    expect(resolved).toEqual({
+      authorizationUrl: 'https://acme.zendesk.com/oauth/authorizations/new',
+      tokenUrl: 'https://acme.zendesk.com/oauth/tokens',
+      clientId: 'client-id'
+    });
+    // toEqual ignores explicit undefined, so pin the absence separately: a key that appears from
+    // nowhere shows up in serialisation diffs and key counts downstream.
+    expect(resolved).not.toHaveProperty('revokeTokenUrl');
+  });
+});

package/src/types/plugin/integration.ts

@@ -3,6 +3,68 @@ export const REST_API_BASE_PLUGIN_ID = 'restapi';
 const SALESFORCE_PLUGIN_ID = 'salesforce';
 export const SUPERBLOCKS_OPENAPI_TENANT_KEYWORD = '{SUPERBLOCKS_OPENAPI_TENANT_NAME}';
 
+/**
+ * A single DNS label, which is all a tenant is allowed to be. The placeholder sits in the host
+ * of a URL the caller did not write, so a tenant carrying `/`, `@`, `#`, `?` or `:` would move
+ * the host somewhere else entirely -- `evil.com/` turns `https://<tenant>.zendesk.com/x` into a
+ * request to `evil.com`. Anything outside this alphabet is refused rather than sanitized.
+ */
+const TENANT_LABEL = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;
+
+/**
+ * Substitute the tenant placeholder in a plugin URL with the tenant a datasource was
+ * configured with.
+ *
+ * Some providers host every customer on their own subdomain, so a plugin template cannot
+ * carry a fixed URL. Those templates store the placeholder and callers resolve it at the
+ * point of use, the same way `urlBase` is resolved when a request is executed.
+ *
+ * A URL without the placeholder is returned unchanged. When the tenant is missing or is not a
+ * single DNS label the placeholder is deliberately left in place: the result is an unresolvable
+ * host that fails at request time, which is preferable to emitting a URL that points somewhere
+ * the plugin template never intended.
+ *
+ * `split`/`join` rather than `replace` is belt and braces: TENANT_LABEL already excludes `$`, so
+ * a tenant cannot reach here carrying `$&` or `$1` for `replace` to expand.
+ */
+export const resolveOpenApiTenantUrl = (url: string | undefined, tenantName: string | undefined): string | undefined => {
+  if (!url || !url.includes(SUPERBLOCKS_OPENAPI_TENANT_KEYWORD)) {
+    return url;
+  }
+  if (typeof tenantName !== 'string' || !TENANT_LABEL.test(tenantName)) {
+    return url;
+  }
+  return url.split(SUPERBLOCKS_OPENAPI_TENANT_KEYWORD).join(tenantName);
+};
+
+/**
+ * Whether a URL still carries the tenant placeholder after resolution, i.e. the tenant was
+ * missing or refused. `new URL()` accepts the braces in the host, so callers that want to report
+ * this instead of navigating to an unresolvable host have to ask explicitly.
+ */
+export const hasUnresolvedTenant = (url: string | undefined): boolean =>
+  typeof url === 'string' && url.includes(SUPERBLOCKS_OPENAPI_TENANT_KEYWORD);
+
+/**
+ * Resolve every tenant-placeholder URL an OAuth config can carry, so callers do not each have to
+ * know which fields are affected. Fields that are absent or carry no placeholder are untouched.
+ */
+export const resolveAuthConfigTenantUrls = <T extends { authorizationUrl?: string; tokenUrl?: string; revokeTokenUrl?: string }>(
+  authConfig: T,
+  tenantName: string | undefined
+): T => {
+  const resolved = { ...authConfig };
+  // Only rewrite fields the config actually carries; a field that was absent stays absent rather
+  // than appearing as an explicit undefined.
+  for (const field of ['authorizationUrl', 'tokenUrl', 'revokeTokenUrl'] as const) {
+    const value = authConfig[field];
+    if (typeof value === 'string') {
+      resolved[field] = resolveOpenApiTenantUrl(value, tenantName) as T[typeof field];
+    }
+  }
+  return resolved;
+};
+
 export enum ExtendedIntegrationPluginId {
   GRAPHQL = 'graphqlintegration',
   REST_API = 'restapiintegration',