@superblocksteam/shared 0.9618.2 → 0.9619.0

package/dist/plugins/templates/shared/auth.js

@@ -1,14 +1,11 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BASE_SCOPE = exports.BASE_AUDIENCE = exports.BASE_CLIENT_SECRET = exports.BASE_CLIENT_ID = exports.BASE_TOKEN_URL = exports.BASE_SUBJECT_TOKEN_STATIC_TOKEN = exports.BASE_SUBJECT_TOKEN_TYPE = exports.BASE_SUBJECT_TOKEN_SOURCE = exports.authSections = exports.ClientAuthMethod = void 0;
-const index_js_1 = require("../../../types/index.js");
-const restapiintegration_js_1 = require("./restapiintegration.js");
-var ClientAuthMethod;
+import { ApiKeyMethod, EditorLanguage, ExtendedIntegrationPluginId, FormComponentType, getDisplayName, GoogleSheetsAuthType, InputDataType, IntegrationAuthType, NewAuthType, OAUTH_CALLBACK_PATH, RestApiFields, TokenScope } from '../../../types/index.js';
+import { RestApiIntegrationPluginVersions } from './restapiintegration.js';
+export var ClientAuthMethod;
 (function (ClientAuthMethod) {
     ClientAuthMethod["BASIC"] = "BASIC";
     ClientAuthMethod["BEARER"] = "BEARER";
     ClientAuthMethod["POST"] = "POST";
-})(ClientAuthMethod || (exports.ClientAuthMethod = ClientAuthMethod = {}));
+})(ClientAuthMethod || (ClientAuthMethod = {}));
 /**
  * Every value `authConfig.usePkce` can hold while PKCE is off. `display.show`
  * matches on the stringified form value, so a spelling missing from this list
@@ -29,25 +26,25 @@ const CLIENT_AUTH_METHOD_OPTIONS = [
     }
 ];
 const AUTH_METHODS_TO_TYPES = {
-    basic: index_js_1.IntegrationAuthType.BASIC,
-    firebase: index_js_1.IntegrationAuthType.FIREBASE,
-    oauth: index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS,
-    bearer: index_js_1.IntegrationAuthType.BEARER,
-    apiKey: index_js_1.IntegrationAuthType.API_KEY,
-    apiKeyForm: index_js_1.IntegrationAuthType.API_KEY_FORM,
-    tokenPrefixed: index_js_1.IntegrationAuthType.TOKEN_PREFIXED,
-    oauth2BringYourOwn: index_js_1.IntegrationAuthType.OAUTH2_CODE,
-    oauth2SuperblocksClient: index_js_1.IntegrationAuthType.OAUTH2_CODE,
-    oauth2ClientCredentials: index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS,
+    basic: IntegrationAuthType.BASIC,
+    firebase: IntegrationAuthType.FIREBASE,
+    oauth: IntegrationAuthType.OAUTH2_CLIENT_CREDS,
+    bearer: IntegrationAuthType.BEARER,
+    apiKey: IntegrationAuthType.API_KEY,
+    apiKeyForm: IntegrationAuthType.API_KEY_FORM,
+    tokenPrefixed: IntegrationAuthType.TOKEN_PREFIXED,
+    oauth2BringYourOwn: IntegrationAuthType.OAUTH2_CODE,
+    oauth2SuperblocksClient: IntegrationAuthType.OAUTH2_CODE,
+    oauth2ClientCredentials: IntegrationAuthType.OAUTH2_CLIENT_CREDS,
     // those matches proto types auth.method.case
-    passwordGrantFlow: index_js_1.NewAuthType.OAUTH2_PASSWORD_GRANT_FLOW,
-    authorizationCodeFlow: index_js_1.NewAuthType.OAUTH2_AUTH_CODE_FLOW,
-    clientCredentialsFlow: index_js_1.NewAuthType.OAUTH2_CLIENT_CREDS_FLOW,
-    tokenExchangeFlow: index_js_1.NewAuthType.OAUTH2_TOKEN_EXCHANGE_FLOW
+    passwordGrantFlow: NewAuthType.OAUTH2_PASSWORD_GRANT_FLOW,
+    authorizationCodeFlow: NewAuthType.OAUTH2_AUTH_CODE_FLOW,
+    clientCredentialsFlow: NewAuthType.OAUTH2_CLIENT_CREDS_FLOW,
+    tokenExchangeFlow: NewAuthType.OAUTH2_TOKEN_EXCHANGE_FLOW
 };
-const authSections = ({ startVersion, pkceStartVersion, confidentialPkceStartVersion, endVersion, pluginId, pluginName, defaultMethod, enabledMethods, allowNone = true, fieldNamesToHide = [], isProto = false, 
+export const authSections = ({ startVersion, pkceStartVersion, confidentialPkceStartVersion, endVersion, pluginId, pluginName, defaultMethod, enabledMethods, allowNone = true, fieldNamesToHide = [], isProto = false, 
 // allow caller to provide optional customized auth items
-prependItems = [], authOptionsLdFlag }) => {
+prependItems = [], authOptionsLdFlag, defaultTokenScope, excludedAuthTypes = [], authTypeOrder, oauthConnect = false, sendBearerHeader = false }) => {
     // Extract display name override before filtering methods
     const apiKeyFormDisplayName = enabledMethods.apiKeyFormDisplayName;
     // Filter out any disabled methods (exclude non-method keys like apiKeyFormDisplayName)
@@ -68,7 +65,7 @@ prependItems = [], authOptionsLdFlag }) => {
         authTypeInitialValue = AUTH_METHODS_TO_TYPES[defaultMethod];
     }
     else if (allowNone) {
-        authTypeInitialValue = index_js_1.IntegrationAuthType.NONE;
+        authTypeInitialValue = IntegrationAuthType.NONE;
     }
     else {
         authTypeInitialValue = AUTH_METHODS_TO_TYPES[enabledMethodKeys[0]];
@@ -88,9 +85,16 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Authentication',
                 secondaryName: pkceStartVersion ? 'authConfig.usePkce' : undefined,
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.DROPDOWN,
+                componentType: FormComponentType.DROPDOWN,
                 initialValue: authTypeInitialValue,
-                options: authTypeOptions({ enabledMethods, allowNone, apiKeyFormDisplayName, pkceStartVersion }),
+                options: authTypeOptions({
+                    enabledMethods,
+                    allowNone,
+                    apiKeyFormDisplayName,
+                    pkceStartVersion,
+                    excludedAuthTypes,
+                    authTypeOrder
+                }),
                 ...(authOptionsLdFlag ? { optionsLdFlag: authOptionsLdFlag } : {}),
                 disabled: !allowNone && enabledMethodKeys.length === 1
             }
@@ -117,7 +121,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 // default to opposite values for example.
                 name: 'authConfig.shareBasicAuthCreds',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.CHECKBOX,
+                componentType: FormComponentType.CHECKBOX,
                 tooltip: {
                     markdownText: `When enabled, all users will share a fixed set of
       credentials. When disabled, users will be prompted to enter a
@@ -125,7 +129,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 },
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.BASIC]
+                        authType: [IntegrationAuthType.BASIC]
                     }
                 },
                 initialValue: true
@@ -134,12 +138,12 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: usernameLabel,
                 name: 'authConfig.username',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+                componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
                 placeholder: usernamePlaceholder,
                 singleLine: true,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.BASIC],
+                        authType: [IntegrationAuthType.BASIC],
                         // Adding undefined is a bit of a hack here to show this field
                         // when the default value is set. This will be removed soon.
                         'authConfig.shareBasicAuthCreds': ['true', 'undefined']
@@ -150,13 +154,13 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: passwordLabel,
                 name: 'authConfig.password',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 placeholder: passwordPlaceholder,
-                dataType: index_js_1.InputDataType.PASSWORD,
+                dataType: InputDataType.PASSWORD,
                 singleLine: false,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.BASIC],
+                        authType: [IntegrationAuthType.BASIC],
                         // Adding undefined is a bit of a hack here to show this field
                         // when the default value is set. This will be removed soon.
                         'authConfig.shareBasicAuthCreds': ['true', 'undefined']
@@ -169,10 +173,10 @@ prependItems = [], authOptionsLdFlag }) => {
           Learn more about [Basic Auth](https://docs.superblocks.com/integrations/auth/authentication-types) authorization.`,
                 name: 'HTTPBasicAlert',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.ALERT,
+                componentType: FormComponentType.ALERT,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.BASIC]
+                        authType: [IntegrationAuthType.BASIC]
                     }
                 }
             }
@@ -184,17 +188,17 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Token',
                 name: 'authConfig.bearerToken',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 rules: [{ required: true, message: 'Bearer token is required' }],
                 placeholder: `bearer-token`,
-                dataType: index_js_1.InputDataType.PASSWORD,
+                dataType: InputDataType.PASSWORD,
                 tooltip: {
                     markdownText: `Specify the bearer token to be used for authentication`
                 },
                 singleLine: false,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.BEARER]
+                        authType: [IntegrationAuthType.BEARER]
                     }
                 }
             }
@@ -205,18 +209,18 @@ prependItems = [], authOptionsLdFlag }) => {
             {
                 label: 'Token',
                 name: 'authConfig.token',
-                startVersion: restapiintegration_js_1.RestApiIntegrationPluginVersions.V13,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                startVersion: RestApiIntegrationPluginVersions.V13,
+                componentType: FormComponentType.INPUT_TEXT,
                 rules: [{ required: true, message: 'Token is required' }],
                 placeholder: `token`,
-                dataType: index_js_1.InputDataType.PASSWORD,
+                dataType: InputDataType.PASSWORD,
                 tooltip: {
                     markdownText: `Specify the token to be used for authentication`
                 },
                 singleLine: false,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.TOKEN_PREFIXED]
+                        authType: [IntegrationAuthType.TOKEN_PREFIXED]
                     }
                 }
             }
@@ -226,12 +230,12 @@ prependItems = [], authOptionsLdFlag }) => {
                 {
                     label: '',
                     name: 'authConfig.prefix',
-                    startVersion: restapiintegration_js_1.RestApiIntegrationPluginVersions.V13,
-                    componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                    startVersion: RestApiIntegrationPluginVersions.V13,
+                    componentType: FormComponentType.INPUT_TEXT,
                     initialValue: enabledMethods.tokenPrefixed.prefix,
                     display: {
                         show: {
-                            authType: [index_js_1.IntegrationAuthType.TOKEN_PREFIXED]
+                            authType: [IntegrationAuthType.TOKEN_PREFIXED]
                         }
                     },
                     hidden: true,
@@ -246,12 +250,12 @@ prependItems = [], authOptionsLdFlag }) => {
                 {
                     label: '',
                     name: `authConfig.apiKeys.${apiKey.key}.header`,
-                    startVersion: restapiintegration_js_1.RestApiIntegrationPluginVersions.V13,
-                    componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                    startVersion: RestApiIntegrationPluginVersions.V13,
+                    componentType: FormComponentType.INPUT_TEXT,
                     initialValue: apiKey.header,
                     display: {
                         show: {
-                            authType: [index_js_1.IntegrationAuthType.API_KEY_FORM]
+                            authType: [IntegrationAuthType.API_KEY_FORM]
                         }
                     },
                     hidden: true,
@@ -262,12 +266,12 @@ prependItems = [], authOptionsLdFlag }) => {
                 {
                     label: '',
                     name: `authConfig.apiKeys.${apiKey.key}.prefix`,
-                    startVersion: restapiintegration_js_1.RestApiIntegrationPluginVersions.V13,
-                    componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                    startVersion: RestApiIntegrationPluginVersions.V13,
+                    componentType: FormComponentType.INPUT_TEXT,
                     initialValue: apiKey.valuePrefix || '',
                     display: {
                         show: {
-                            authType: [index_js_1.IntegrationAuthType.API_KEY_FORM]
+                            authType: [IntegrationAuthType.API_KEY_FORM]
                         }
                     },
                     hidden: true,
@@ -278,9 +282,9 @@ prependItems = [], authOptionsLdFlag }) => {
                 {
                     label: apiKey.label,
                     name: `authConfig.apiKeys.${apiKey.key}.token`,
-                    startVersion: restapiintegration_js_1.RestApiIntegrationPluginVersions.V13,
-                    componentType: index_js_1.FormComponentType.INPUT_TEXT,
-                    dataType: index_js_1.InputDataType.PASSWORD,
+                    startVersion: RestApiIntegrationPluginVersions.V13,
+                    componentType: FormComponentType.INPUT_TEXT,
+                    dataType: InputDataType.PASSWORD,
                     singleLine: false,
                     rules: [
                         {
@@ -291,7 +295,7 @@ prependItems = [], authOptionsLdFlag }) => {
                     ...(apiKey.tooltip ? { tooltip: apiKey.tooltip } : {}),
                     display: {
                         show: {
-                            authType: [index_js_1.IntegrationAuthType.API_KEY_FORM]
+                            authType: [IntegrationAuthType.API_KEY_FORM]
                         }
                     }
                 }
@@ -299,19 +303,22 @@ prependItems = [], authOptionsLdFlag }) => {
         }
     }
     if (enabledMethods.apiKey) {
+        const apiKeyOverrides = typeof enabledMethods.apiKey === 'object' ? enabledMethods.apiKey : {};
+        const apiKeyPlaceholder = apiKeyOverrides.key?.placeholder ?? 'api key';
+        const apiKeyValuePlaceholder = apiKeyOverrides.value?.placeholder ?? 'value';
         addField(authFields, [
             {
                 label: 'Key',
                 name: 'authConfig.key',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+                componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
                 rules: [{ required: true, message: 'Key is required' }],
-                placeholder: `api key`,
+                placeholder: apiKeyPlaceholder,
                 tooltip: { markdownText: apiKeyMarkdownText(pluginId) },
                 singleLine: true,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.API_KEY]
+                        authType: [IntegrationAuthType.API_KEY]
                     }
                 }
             },
@@ -319,29 +326,29 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Value',
                 name: 'authConfig.value',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 rules: [{ required: true, message: 'Value is required' }],
-                placeholder: `value`,
-                dataType: index_js_1.InputDataType.PASSWORD,
+                placeholder: apiKeyValuePlaceholder,
+                dataType: InputDataType.PASSWORD,
                 tooltip: {
                     markdownText: `The value corresponding to the API key`
                 },
                 singleLine: false,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.API_KEY]
+                        authType: [IntegrationAuthType.API_KEY]
                     }
                 }
             }
         ], fieldNamesToHide);
-        if (pluginId === index_js_1.ExtendedIntegrationPluginId.REST_API) {
+        if (pluginId === ExtendedIntegrationPluginId.REST_API) {
             addField(authFields, [
                 {
                     label: 'Add to',
                     name: 'authConfig.method',
                     startVersion: startVersion,
-                    componentType: index_js_1.FormComponentType.DROPDOWN,
-                    initialValue: index_js_1.ApiKeyMethod.HEADER,
+                    componentType: FormComponentType.DROPDOWN,
+                    initialValue: ApiKeyMethod.HEADER,
                     options: apiKeyAuthOptions(pluginId),
                     tooltip: {
                         markdownText: `How the API key is passed to the API (as a header or as a query parameter)`
@@ -349,24 +356,25 @@ prependItems = [], authOptionsLdFlag }) => {
                     singleLine: true,
                     display: {
                         show: {
-                            authType: [index_js_1.IntegrationAuthType.API_KEY]
+                            authType: [IntegrationAuthType.API_KEY]
                         }
                     }
                 }
             ], fieldNamesToHide);
         }
-        else if (pluginId === index_js_1.ExtendedIntegrationPluginId.GRAPHQL) {
+        else if (HEADER_ONLY_API_KEY_PLUGINS.has(pluginId)) {
+            // Other templates never persisted authConfig.method; leave them alone.
             addField(authFields, [
                 {
                     label: '',
                     name: 'authConfig.method',
                     startVersion,
-                    componentType: index_js_1.FormComponentType.INPUT_TEXT,
-                    initialValue: index_js_1.ApiKeyMethod.HEADER,
+                    componentType: FormComponentType.INPUT_TEXT,
+                    initialValue: ApiKeyMethod.HEADER,
                     hidden: true,
                     display: {
                         show: {
-                            authType: [index_js_1.IntegrationAuthType.API_KEY]
+                            authType: [IntegrationAuthType.API_KEY]
                         }
                     }
                 }
@@ -381,10 +389,10 @@ prependItems = [], authOptionsLdFlag }) => {
   Note: REST APIs authenticated with firebase cannot be used in Superblocks Workflows & Scheduled Jobs since both can be called headlessly without user interaction.`,
                 name: 'FirebaseAlert',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.ALERT,
+                componentType: FormComponentType.ALERT,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.FIREBASE]
+                        authType: [IntegrationAuthType.FIREBASE]
                     }
                 }
             },
@@ -392,8 +400,8 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'API config',
                 name: 'authConfig.apiKey',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.CODE_EDITOR,
-                language: index_js_1.EditorLanguage.JSON,
+                componentType: FormComponentType.CODE_EDITOR,
+                language: EditorLanguage.JSON,
                 tooltip: {
                     markdownText: `The API config can be found through the Firebase
       portal. It's used to identify your app to Firebase.`
@@ -410,7 +418,7 @@ prependItems = [], authOptionsLdFlag }) => {
       `,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.FIREBASE]
+                        authType: [IntegrationAuthType.FIREBASE]
                     }
                 }
             },
@@ -418,10 +426,10 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Enable login with email/password',
                 name: 'authConfig.email',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.CHECKBOX,
+                componentType: FormComponentType.CHECKBOX,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.FIREBASE]
+                        authType: [IntegrationAuthType.FIREBASE]
                     }
                 },
                 initialValue: true
@@ -430,10 +438,10 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Enable login with Google',
                 name: 'authConfig.google',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.CHECKBOX,
+                componentType: FormComponentType.CHECKBOX,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.FIREBASE]
+                        authType: [IntegrationAuthType.FIREBASE]
                     }
                 }
             },
@@ -444,10 +452,10 @@ prependItems = [], authOptionsLdFlag }) => {
       currently authenticated user's ID.`,
                 name: 'FirebaseAlertToken',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.ALERT,
+                componentType: FormComponentType.ALERT,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.FIREBASE]
+                        authType: [IntegrationAuthType.FIREBASE]
                     }
                 }
             }
@@ -460,7 +468,7 @@ prependItems = [], authOptionsLdFlag }) => {
             label: 'Token URL',
             name: 'connection.auth.method.value.tokenUrl',
             startVersion: startVersion,
-            componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+            componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
             rules: [{ required: true, message: 'Token URL is required' }],
             tooltip: {
                 markdownText: `The endpoint for authorization server. This is used to get the access token.`
@@ -476,7 +484,7 @@ prependItems = [], authOptionsLdFlag }) => {
             label: 'Consumer key',
             name: 'connection.auth.method.value.clientId',
             startVersion: startVersion,
-            componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+            componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
             placeholder: `my consumer key`,
             rules: [{ required: true, message: 'Consumer Key is required' }],
             tooltip: {
@@ -493,10 +501,10 @@ prependItems = [], authOptionsLdFlag }) => {
             label: 'Consumer secret',
             name: 'connection.auth.method.value.clientSecret',
             startVersion: startVersion,
-            componentType: index_js_1.FormComponentType.INPUT_TEXT,
+            componentType: FormComponentType.INPUT_TEXT,
             rules: [{ required: true, message: 'Consumer secret is required' }],
             placeholder: `my consumer secret`,
-            dataType: index_js_1.InputDataType.PASSWORD,
+            dataType: InputDataType.PASSWORD,
             tooltip: {
                 markdownText: `A secret shared between the Salesforce consumer and the
     authorizing/token servers to verify the Consumer Key.`
@@ -511,7 +519,7 @@ prependItems = [], authOptionsLdFlag }) => {
             label: 'Username',
             name: 'connection.auth.method.value.username',
             startVersion: startVersion,
-            componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+            componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
             placeholder: `username`,
             singleLine: true,
             rules: [{ required: true, message: 'Username is required' }],
@@ -524,9 +532,9 @@ prependItems = [], authOptionsLdFlag }) => {
             label: 'Password',
             name: 'connection.auth.method.value.password',
             startVersion: startVersion,
-            componentType: index_js_1.FormComponentType.INPUT_TEXT,
+            componentType: FormComponentType.INPUT_TEXT,
             placeholder: 'password',
-            dataType: index_js_1.InputDataType.PASSWORD,
+            dataType: InputDataType.PASSWORD,
             singleLine: false,
             rules: [{ required: true, message: 'Password is required' }],
             display: {
@@ -544,7 +552,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 startVersion,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_IMPLICIT]
+                        authType: [IntegrationAuthType.OAUTH2_IMPLICIT]
                     }
                 }
             },
@@ -553,7 +561,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 startVersion,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 }
             },
@@ -561,16 +569,16 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Callback URL',
                 name: 'oauth-callback-alert',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 disabled: true,
                 immutable: true,
-                initialValue: `<%= origin %>/${index_js_1.OAUTH_CALLBACK_PATH}`,
+                initialValue: `<%= origin %>/${OAUTH_CALLBACK_PATH}`,
                 tooltip: {
                     markdownText: `This is where users will be redirected after authorization. Add this to your application's list of allowed callback URLs.`
                 },
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE, index_js_1.IntegrationAuthType.OAUTH2_IMPLICIT]
+                        authType: [IntegrationAuthType.OAUTH2_CODE, IntegrationAuthType.OAUTH2_IMPLICIT]
                     }
                 },
                 enableCopy: true,
@@ -580,7 +588,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Authorization URL',
                 name: 'authConfig.authorizationUrl',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+                componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
                 rules: [{ required: true, message: 'Authorization URL is required' }],
                 tooltip: {
                     markdownText: `The endpoint for authorization server. This is used to get the authorization code.`
@@ -588,64 +596,64 @@ prependItems = [], authOptionsLdFlag }) => {
                 singleLine: true,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_IMPLICIT, index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_IMPLICIT, IntegrationAuthType.OAUTH2_CODE]
                     }
                 },
                 placeholder: `https://example.com/login/oauth/authorize`
             },
             {
-                ...exports.BASE_SUBJECT_TOKEN_SOURCE,
+                ...BASE_SUBJECT_TOKEN_SOURCE,
                 startVersion,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE]
+                        authType: [IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE]
                     }
                 }
             },
             {
-                ...exports.BASE_SUBJECT_TOKEN_STATIC_TOKEN,
+                ...BASE_SUBJECT_TOKEN_STATIC_TOKEN,
                 startVersion,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE],
+                        authType: [IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE],
                         'authConfig.subjectTokenSource': ['SUBJECT_TOKEN_SOURCE_STATIC_TOKEN']
                     }
                 }
             },
             {
-                ...exports.BASE_SUBJECT_TOKEN_TYPE,
+                ...BASE_SUBJECT_TOKEN_TYPE,
                 startVersion,
                 singleLine: false,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE]
+                        authType: [IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE]
                     }
                 }
             },
             {
-                ...exports.BASE_TOKEN_URL,
+                ...BASE_TOKEN_URL,
                 startVersion,
                 display: {
                     show: {
                         authType: [
-                            index_js_1.IntegrationAuthType.OAUTH2_PASSWORD,
-                            index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS,
-                            index_js_1.IntegrationAuthType.OAUTH2_CODE,
-                            index_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE
+                            IntegrationAuthType.OAUTH2_PASSWORD,
+                            IntegrationAuthType.OAUTH2_CLIENT_CREDS,
+                            IntegrationAuthType.OAUTH2_CODE,
+                            IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE
                         ]
                     }
                 }
             },
             {
-                ...exports.BASE_CLIENT_ID,
+                ...BASE_CLIENT_ID,
                 startVersion,
                 display: {
                     show: {
                         authType: [
-                            index_js_1.IntegrationAuthType.OAUTH2_PASSWORD,
-                            index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS,
-                            index_js_1.IntegrationAuthType.OAUTH2_IMPLICIT,
-                            index_js_1.IntegrationAuthType.OAUTH2_CODE
+                            IntegrationAuthType.OAUTH2_PASSWORD,
+                            IntegrationAuthType.OAUTH2_CLIENT_CREDS,
+                            IntegrationAuthType.OAUTH2_IMPLICIT,
+                            IntegrationAuthType.OAUTH2_CODE
                         ]
                     }
                 }
@@ -653,7 +661,7 @@ prependItems = [], authOptionsLdFlag }) => {
             ...(confidentialPkceStartVersion
                 ? [
                     {
-                        ...exports.BASE_CLIENT_SECRET,
+                        ...BASE_CLIENT_SECRET,
                         startVersion: confidentialPkceStartVersion,
                         rules: [{ required: false }],
                         tooltip: {
@@ -661,7 +669,7 @@ prependItems = [], authOptionsLdFlag }) => {
                         },
                         display: {
                             show: {
-                                authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE],
+                                authType: [IntegrationAuthType.OAUTH2_CODE],
                                 'authConfig.usePkce': PKCE_ON_MARKERS
                             }
                         }
@@ -669,21 +677,21 @@ prependItems = [], authOptionsLdFlag }) => {
                 ]
                 : []),
             {
-                ...exports.BASE_CLIENT_ID,
+                ...BASE_CLIENT_ID,
                 startVersion,
                 rules: [{ required: false }],
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE]
+                        authType: [IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE]
                     }
                 }
             },
             {
-                ...exports.BASE_CLIENT_SECRET,
+                ...BASE_CLIENT_SECRET,
                 startVersion,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_PASSWORD, index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS, index_js_1.IntegrationAuthType.OAUTH2_CODE],
+                        authType: [IntegrationAuthType.OAUTH2_PASSWORD, IntegrationAuthType.OAUTH2_CLIENT_CREDS, IntegrationAuthType.OAUTH2_CODE],
                         ...(pkceStartVersion ? { 'authConfig.usePkce': PKCE_OFF_MARKERS } : {})
                     }
                 }
@@ -693,13 +701,13 @@ prependItems = [], authOptionsLdFlag }) => {
                     {
                         // Keep a confidential client's stored secret if the current
                         // agent only supports public PKCE.
-                        ...exports.BASE_CLIENT_SECRET,
+                        ...BASE_CLIENT_SECRET,
                         startVersion: pkceStartVersion,
                         hidden: true,
                         rules: [{ required: false }],
                         display: {
                             show: {
-                                authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE],
+                                authType: [IntegrationAuthType.OAUTH2_CODE],
                                 'authConfig.usePkce': PKCE_ON_MARKERS
                             }
                         }
@@ -707,26 +715,26 @@ prependItems = [], authOptionsLdFlag }) => {
                 ]
                 : []),
             {
-                ...exports.BASE_CLIENT_SECRET,
+                ...BASE_CLIENT_SECRET,
                 startVersion,
                 rules: [{ required: false }],
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE]
+                        authType: [IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE]
                     }
                 }
             },
             {
-                ...exports.BASE_AUDIENCE,
+                ...BASE_AUDIENCE,
                 startVersion,
                 display: {
                     show: {
                         authType: [
-                            index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS,
-                            index_js_1.IntegrationAuthType.OAUTH2_CODE,
-                            index_js_1.IntegrationAuthType.OAUTH2_IMPLICIT,
-                            index_js_1.IntegrationAuthType.OAUTH2_PASSWORD,
-                            index_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE
+                            IntegrationAuthType.OAUTH2_CLIENT_CREDS,
+                            IntegrationAuthType.OAUTH2_CODE,
+                            IntegrationAuthType.OAUTH2_IMPLICIT,
+                            IntegrationAuthType.OAUTH2_PASSWORD,
+                            IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE
                         ]
                     }
                 }
@@ -736,26 +744,26 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Prompt',
                 name: 'authConfig.promptType',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+                componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
                 initialValue: 'consent',
                 placeholder: 'consent',
                 singleLine: true,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE, index_js_1.IntegrationAuthType.OAUTH2_IMPLICIT]
+                        authType: [IntegrationAuthType.OAUTH2_CODE, IntegrationAuthType.OAUTH2_IMPLICIT]
                     }
                 }
             },
             {
-                ...exports.BASE_SCOPE,
+                ...BASE_SCOPE,
                 startVersion,
                 display: {
                     show: {
                         authType: [
-                            index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS,
-                            index_js_1.IntegrationAuthType.OAUTH2_IMPLICIT,
-                            index_js_1.IntegrationAuthType.OAUTH2_CODE,
-                            index_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE
+                            IntegrationAuthType.OAUTH2_CLIENT_CREDS,
+                            IntegrationAuthType.OAUTH2_IMPLICIT,
+                            IntegrationAuthType.OAUTH2_CODE,
+                            IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE
                         ]
                     }
                 }
@@ -764,14 +772,14 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Client authentication',
                 name: 'authConfig.clientAuthMethod',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.DROPDOWN,
+                componentType: FormComponentType.DROPDOWN,
                 // Existing client credentials integrations authenticate with the
                 // Basic header, so the default stays Basic to leave them unchanged.
                 initialValue: ClientAuthMethod.BASIC,
                 options: CLIENT_AUTH_METHOD_OPTIONS,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS]
+                        authType: [IntegrationAuthType.OAUTH2_CLIENT_CREDS]
                     }
                 }
             },
@@ -779,13 +787,13 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Share username/password across all users',
                 name: 'authConfig.useFixedPasswordCreds',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.CHECKBOX,
+                componentType: FormComponentType.CHECKBOX,
                 tooltip: {
                     markdownText: `Username/password credentials to use when connecting. If not set, users will be prompted for their credentials.`
                 },
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_PASSWORD]
+                        authType: [IntegrationAuthType.OAUTH2_PASSWORD]
                     }
                 },
                 initialValue: false
@@ -794,12 +802,12 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Client authentication',
                 name: 'authConfig.clientAuthMethod',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.DROPDOWN,
+                componentType: FormComponentType.DROPDOWN,
                 initialValue: ClientAuthMethod.POST,
                 options: CLIENT_AUTH_METHOD_OPTIONS,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE],
+                        authType: [IntegrationAuthType.OAUTH2_CODE],
                         ...(pkceStartVersion ? { 'authConfig.usePkce': PKCE_OFF_MARKERS } : {})
                     }
                 }
@@ -810,12 +818,12 @@ prependItems = [], authOptionsLdFlag }) => {
                         label: 'Client authentication',
                         name: 'authConfig.clientAuthMethod',
                         startVersion: confidentialPkceStartVersion,
-                        componentType: index_js_1.FormComponentType.DROPDOWN,
+                        componentType: FormComponentType.DROPDOWN,
                         initialValue: ClientAuthMethod.POST,
                         options: CLIENT_AUTH_METHOD_OPTIONS,
                         display: {
                             show: {
-                                authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE],
+                                authType: [IntegrationAuthType.OAUTH2_CODE],
                                 'authConfig.usePkce': PKCE_ON_MARKERS
                             }
                         }
@@ -831,12 +839,12 @@ prependItems = [], authOptionsLdFlag }) => {
                         label: 'Client authentication',
                         name: 'authConfig.clientAuthMethod',
                         startVersion: pkceStartVersion,
-                        componentType: index_js_1.FormComponentType.DROPDOWN,
+                        componentType: FormComponentType.DROPDOWN,
                         hidden: true,
                         options: CLIENT_AUTH_METHOD_OPTIONS,
                         display: {
                             show: {
-                                authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE],
+                                authType: [IntegrationAuthType.OAUTH2_CODE],
                                 'authConfig.usePkce': PKCE_ON_MARKERS
                             }
                         }
@@ -849,11 +857,11 @@ prependItems = [], authOptionsLdFlag }) => {
                         label: '',
                         name: 'authConfig.usePkce',
                         startVersion: pkceStartVersion,
-                        componentType: index_js_1.FormComponentType.CHECKBOX,
+                        componentType: FormComponentType.CHECKBOX,
                         hidden: true,
                         display: {
                             show: {
-                                authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                                authType: [IntegrationAuthType.OAUTH2_CODE]
                             }
                         }
                     }
@@ -863,14 +871,14 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Send state parameter',
                 name: 'authConfig.sendOAuthState',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.CHECKBOX,
+                componentType: FormComponentType.CHECKBOX,
                 tooltip: {
                     markdownText: `Opaque state value will be sent to prevent cross-site request forgery.`
                 },
                 initialValue: true,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 }
             },
@@ -878,12 +886,12 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Username',
                 name: 'authConfig.username',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+                componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
                 placeholder: `username`,
                 singleLine: true,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_PASSWORD],
+                        authType: [IntegrationAuthType.OAUTH2_PASSWORD],
                         'authConfig.useFixedPasswordCreds': ['true']
                     }
                 }
@@ -892,13 +900,13 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Password',
                 name: 'authConfig.password',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 placeholder: `password`,
-                dataType: index_js_1.InputDataType.PASSWORD,
+                dataType: InputDataType.PASSWORD,
                 singleLine: false,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_PASSWORD],
+                        authType: [IntegrationAuthType.OAUTH2_PASSWORD],
                         'authConfig.useFixedPasswordCreds': ['true']
                     }
                 }
@@ -909,15 +917,15 @@ prependItems = [], authOptionsLdFlag }) => {
           Learn more in our docs on [using OAuth2.0 in Superblocks](https://docs.superblocks.com/integrations/auth/oauth-20).`,
                 name: 'OAuth2PasswordAlert',
                 startVersion,
-                componentType: index_js_1.FormComponentType.ALERT,
+                componentType: FormComponentType.ALERT,
                 display: {
                     show: {
                         authType: [
-                            index_js_1.IntegrationAuthType.OAUTH2_PASSWORD,
-                            index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS,
-                            index_js_1.IntegrationAuthType.OAUTH2_IMPLICIT,
-                            index_js_1.IntegrationAuthType.OAUTH2_CODE,
-                            index_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE
+                            IntegrationAuthType.OAUTH2_PASSWORD,
+                            IntegrationAuthType.OAUTH2_CLIENT_CREDS,
+                            IntegrationAuthType.OAUTH2_IMPLICIT,
+                            IntegrationAuthType.OAUTH2_CODE,
+                            IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE
                         ]
                     }
                 }
@@ -928,31 +936,91 @@ prependItems = [], authOptionsLdFlag }) => {
           This method requires an interactive session — it cannot be used in Workflows or Scheduled Jobs.`,
                 name: 'IdpTokenPassthroughAlert',
                 startVersion,
-                componentType: index_js_1.FormComponentType.ALERT,
+                componentType: FormComponentType.ALERT,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH]
+                        authType: [IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH]
                     }
                 }
             }
         ], fieldNamesToHide);
     }
+    if (enabledMethods.oauth && sendBearerHeader) {
+        addField(authFields, [
+            {
+                label: 'Send bearer header',
+                name: 'authConfig.sendBearerHeader',
+                startVersion: startVersion,
+                componentType: FormComponentType.CHECKBOX,
+                hidden: true,
+                initialValue: true,
+                display: {
+                    show: {
+                        authType: [IntegrationAuthType.OAUTH2_CLIENT_CREDS]
+                    }
+                }
+            }
+        ], fieldNamesToHide);
+    }
+    if (enabledMethods.oauth && oauthConnect) {
+        // The bring-your-own flow carries a hidden, template-fixed revoke URL under
+        // the same name; a template enabling both keeps that one.
+        const revokeUrlField = enabledMethods.oauth2BringYourOwn
+            ? []
+            : [
+                {
+                    label: 'Revoke token URL',
+                    name: 'authConfig.revokeTokenUrl',
+                    startVersion: startVersion,
+                    componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
+                    placeholder: `https://example.com/login/oauth/revoke`,
+                    tooltip: {
+                        markdownText: `Optional. The endpoint tokens are revoked at when you click Revoke token. Without it, Revoke token only deletes the tokens Superblocks stored.`
+                    },
+                    singleLine: true,
+                    display: {
+                        show: {
+                            authType: [IntegrationAuthType.OAUTH2_CODE]
+                        }
+                    }
+                }
+            ];
+        const accessTypeField = {
+            label: 'Access type',
+            name: 'authConfig.accessType',
+            startVersion: startVersion,
+            componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
+            // Same default the per-user login has always sent for the authorization code flow.
+            initialValue: 'offline',
+            placeholder: `offline`,
+            tooltip: {
+                markdownText: `Sent as \`access_type\` on the authorization request. Google needs \`offline\` to issue a refresh token; most other servers ignore it. Clear it for a server that rejects unknown parameters.`
+            },
+            singleLine: true,
+            display: {
+                show: {
+                    authType: [IntegrationAuthType.OAUTH2_CODE]
+                }
+            }
+        };
+        addField(authFields, [...revokeUrlField, accessTypeField, sharedTokenCheckbox({ startVersion, pluginName, defaultTokenScope })], fieldNamesToHide);
+    }
     if (enabledMethods.oauth2BringYourOwn) {
         addField(authFields, [
             {
                 label: 'Callback URL',
                 name: 'oauth-callback-alert',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 disabled: true,
                 immutable: true,
-                initialValue: `<%= origin %>/${index_js_1.OAUTH_CALLBACK_PATH}`,
+                initialValue: `<%= origin %>/${OAUTH_CALLBACK_PATH}`,
                 tooltip: {
                     markdownText: `This is where users will be redirected after authorization. Add this to your application's list of allowed callback URLs.`
                 },
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 },
                 enableCopy: true,
@@ -962,7 +1030,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Access token URL',
                 name: 'authConfig.tokenUrl',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 hidden: true,
                 initialValue: enabledMethods.oauth2BringYourOwn?.tokenUrl
             },
@@ -970,7 +1038,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Authorization URL',
                 name: 'authConfig.authorizationUrl',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 hidden: true,
                 initialValue: enabledMethods.oauth2BringYourOwn?.authorizationUrl
             },
@@ -978,7 +1046,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Revoke token URL',
                 name: 'authConfig.revokeTokenUrl',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 hidden: true,
                 initialValue: enabledMethods?.oauth2BringYourOwn?.revokeTokenUrl
             },
@@ -986,7 +1054,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'User info URL',
                 name: 'authConfig.userInfoUrl',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 hidden: true,
                 initialValue: enabledMethods?.oauth2BringYourOwn?.userInfoUrl
             },
@@ -994,7 +1062,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Server-side token refresh',
                 name: 'authConfig.refreshTokenFromServer',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.CHECKBOX,
+                componentType: FormComponentType.CHECKBOX,
                 hidden: true,
                 initialValue: false
             },
@@ -1002,7 +1070,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Client ID',
                 name: 'authConfig.clientId',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+                componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
                 placeholder: `Client ID`,
                 rules: [{ required: true, message: 'Client ID is required' }],
                 tooltip: {
@@ -1011,7 +1079,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 singleLine: true,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 }
             },
@@ -1019,17 +1087,17 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Client secret',
                 name: 'authConfig.clientSecret',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 rules: [{ required: true, message: 'Client secret is required' }],
                 placeholder: `Client Secret`,
-                dataType: index_js_1.InputDataType.PASSWORD,
+                dataType: InputDataType.PASSWORD,
                 tooltip: {
                     markdownText: `The client secret issues to the client during the application registration process.`
                 },
                 singleLine: false,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 }
             },
@@ -1037,14 +1105,14 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Audience',
                 name: 'authConfig.audience',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+                componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
                 tooltip: {
                     markdownText: `The intended recipient of the token, most likely a resource server.`
                 },
                 singleLine: true,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 }
             },
@@ -1052,7 +1120,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Scope',
                 name: 'authConfig.scope',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+                componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
                 placeholder: `e.g. openid email read:org`,
                 tooltip: {
                     markdownText: `The scope of access request. It may have multiple space-separated values.`
@@ -1061,7 +1129,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 initialValue: enabledMethods.oauth2BringYourOwn?.defaultScope ?? enabledMethods.oauth2SuperblocksClient?.defaultScope,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 }
             },
@@ -1069,7 +1137,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Client authentication',
                 name: 'authConfig.clientAuthMethod',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 hidden: true,
                 initialValue: enabledMethods.oauth2BringYourOwn?.clientAuthMethod ?? ClientAuthMethod.POST
             },
@@ -1077,40 +1145,18 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Send state parameter',
                 name: 'authConfig.sendOAuthState',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.CHECKBOX,
+                componentType: FormComponentType.CHECKBOX,
                 initialValue: true,
                 tooltip: {
                     markdownText: `Opaque state value will be sent to prevent cross-site request forgery.`
                 },
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 }
             },
-            {
-                label: 'Share access token across all users',
-                name: 'authConfig.tokenScope',
-                startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.CHECKBOX,
-                display: {
-                    show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
-                    }
-                },
-                mapBooleansTo: {
-                    true: index_js_1.TokenScope.DATASOURCE,
-                    false: index_js_1.TokenScope.USER
-                },
-                initialValue: index_js_1.TokenScope.DATASOURCE,
-                validateReduxPath: {
-                    true: {
-                        selector: 'selectHasConnectedTokens',
-                        validValue: true,
-                        errorMessage: `You must connect to ${pluginName} before you can share access token`
-                    }
-                }
-            }
+            sharedTokenCheckbox({ startVersion, pluginName, defaultTokenScope })
         ], fieldNamesToHide);
     }
     if (enabledMethods.oauth2ClientCredentials) {
@@ -1133,7 +1179,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Access token URL',
                 name: 'authConfig.tokenUrl',
                 startVersion: clientCredentialsStartVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 hidden: true,
                 initialValue: enabledMethods.oauth2ClientCredentials.tokenUrl
             },
@@ -1145,7 +1191,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Send bearer header',
                 name: 'authConfig.sendBearerHeader',
                 startVersion: clientCredentialsStartVersion,
-                componentType: index_js_1.FormComponentType.CHECKBOX,
+                componentType: FormComponentType.CHECKBOX,
                 hidden: true,
                 initialValue: true
             },
@@ -1157,12 +1203,12 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Share access token across all users',
                 name: 'authConfig.tokenScope',
                 startVersion: clientCredentialsStartVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 hidden: true,
-                initialValue: index_js_1.TokenScope.DATASOURCE,
+                initialValue: TokenScope.DATASOURCE,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS]
+                        authType: [IntegrationAuthType.OAUTH2_CLIENT_CREDS]
                     }
                 }
             },
@@ -1170,7 +1216,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Client ID',
                 name: 'authConfig.clientId',
                 startVersion: clientCredentialsStartVersion,
-                componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+                componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
                 placeholder: `Client ID`,
                 rules: [{ required: true, message: 'Client ID is required' }],
                 tooltip: {
@@ -1179,7 +1225,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 singleLine: true,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS]
+                        authType: [IntegrationAuthType.OAUTH2_CLIENT_CREDS]
                     }
                 }
             },
@@ -1187,17 +1233,17 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Client secret',
                 name: 'authConfig.clientSecret',
                 startVersion: clientCredentialsStartVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 rules: [{ required: true, message: 'Client secret is required' }],
                 placeholder: `Client Secret`,
-                dataType: index_js_1.InputDataType.PASSWORD,
+                dataType: InputDataType.PASSWORD,
                 tooltip: {
                     markdownText: `The client secret issued to the client during the application registration process. This grant is for confidential clients only: the token is minted from the secret alone, with no user involved.`
                 },
                 singleLine: false,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS]
+                        authType: [IntegrationAuthType.OAUTH2_CLIENT_CREDS]
                     }
                 }
             },
@@ -1205,7 +1251,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Scope',
                 name: 'authConfig.scope',
                 startVersion: clientCredentialsStartVersion,
-                componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+                componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
                 placeholder: `e.g. read write`,
                 tooltip: {
                     markdownText: `The scope of access request. It may have multiple space-separated values.`
@@ -1214,7 +1260,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 initialValue: enabledMethods.oauth2ClientCredentials.defaultScope,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS]
+                        authType: [IntegrationAuthType.OAUTH2_CLIENT_CREDS]
                     }
                 }
             }
@@ -1226,13 +1272,13 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Callback URL',
                 name: 'oauth-callback-alert',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 disabled: true,
                 immutable: true,
-                initialValue: `<%= origin %>/${index_js_1.OAUTH_CALLBACK_PATH}`,
+                initialValue: `<%= origin %>/${OAUTH_CALLBACK_PATH}`,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 },
                 enableCopy: true,
@@ -1242,7 +1288,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Access token URL',
                 name: 'authConfig.tokenUrl',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 hidden: true,
                 initialValue: enabledMethods?.oauth2SuperblocksClient?.tokenUrl
             },
@@ -1250,7 +1296,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Authorization URL',
                 name: 'authConfig.authorizationUrl',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 hidden: true,
                 initialValue: enabledMethods?.oauth2SuperblocksClient?.authorizationUrl
             },
@@ -1258,7 +1304,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Revoke token URL',
                 name: 'authConfig.revokeTokenUrl',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 hidden: true,
                 initialValue: enabledMethods?.oauth2SuperblocksClient?.revokeTokenUrl
             },
@@ -1266,7 +1312,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'User info URL',
                 name: 'authConfig.userInfoUrl',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 hidden: true,
                 initialValue: enabledMethods?.oauth2SuperblocksClient?.userInfoUrl
             },
@@ -1274,7 +1320,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Server-side token refresh',
                 name: 'authConfig.refreshTokenFromServer',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.CHECKBOX,
+                componentType: FormComponentType.CHECKBOX,
                 hidden: true,
                 initialValue: true
             },
@@ -1282,7 +1328,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Client ID',
                 name: 'authConfig.clientId',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 placeholder: `Client ID`,
                 rules: [{ required: true, message: 'Client ID is required' }],
                 tooltip: {
@@ -1292,7 +1338,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 singleLine: true,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 },
                 hidden: true,
@@ -1302,7 +1348,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Audience',
                 name: 'authConfig.audience',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 tooltip: {
                     markdownText: `The intended recipient of the token, most likely a resource server.`
                 },
@@ -1310,7 +1356,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 hidden: true,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 }
             },
@@ -1318,7 +1364,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: 'Scope',
                 name: 'authConfig.scope',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.INPUT_TEXT,
+                componentType: FormComponentType.INPUT_TEXT,
                 placeholder: `e.g. openid email read:org`,
                 tooltip: {
                     markdownText: `The scope of access request. It may have multiple space-separated values.`
@@ -1327,42 +1373,21 @@ prependItems = [], authOptionsLdFlag }) => {
                 hidden: true,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE, index_js_1.GoogleSheetsAuthType.SERVICE_ACCOUNT]
+                        authType: [IntegrationAuthType.OAUTH2_CODE, GoogleSheetsAuthType.SERVICE_ACCOUNT]
                     }
                 }
             },
-            {
-                label: 'Share access token across all users',
-                name: 'authConfig.tokenScope',
-                startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.CHECKBOX,
-                display: {
-                    show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
-                    }
-                },
-                mapBooleansTo: {
-                    true: index_js_1.TokenScope.DATASOURCE,
-                    false: index_js_1.TokenScope.USER
-                },
-                initialValue: index_js_1.TokenScope.DATASOURCE,
-                validateReduxPath: {
-                    true: {
-                        selector: 'selectHasConnectedTokens',
-                        validValue: true,
-                        errorMessage: `You must connect to ${pluginName} before you can share access token`
-                    }
-                }
-            }
+            sharedTokenCheckbox({ startVersion, pluginName, defaultTokenScope })
         ], fieldNamesToHide);
     }
-    if (enabledMethods.oauth2SuperblocksClient || enabledMethods.oauth2BringYourOwn) {
+    const rendersConnectButton = Boolean(enabledMethods.oauth2SuperblocksClient || enabledMethods.oauth2BringYourOwn || (enabledMethods.oauth && oauthConnect));
+    if (rendersConnectButton) {
         addField(authFields, [
             {
                 label: '',
                 name: 'OAuth2ConnectedAlert',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.ALERT,
+                componentType: FormComponentType.ALERT,
                 messageTemplate: `<%= datasourceMeta?.metadata?.connectedUserTokens?.[configurationId]?.[0]
               ? 'You are connected to ${pluginName}'
               : undefined %>` +
@@ -1383,15 +1408,19 @@ prependItems = [], authOptionsLdFlag }) => {
         items: authFields
     });
     const authButtons = [];
-    if (enabledMethods.oauth2BringYourOwn || enabledMethods.oauth2SuperblocksClient) {
+    if (rendersConnectButton) {
         const authorizationExtraParams = enabledMethods?.oauth2BringYourOwn?.authorizationExtraParams || enabledMethods.oauth2SuperblocksClient?.authorizationExtraParams;
+        // The fixed-endpoint flows declare their authorization parameters per template. The generic
+        // flow talks to a server the user typed in, so it carries what every authorization code grant
+        // needs (response_type=code) and takes prompt / access_type from the form.
+        const genericConnectParams = enabledMethods.oauth && oauthConnect ? { responseType: 'code' } : {};
         const iconUrl = enabledMethods?.oauth2BringYourOwn?.iconUrl || enabledMethods.oauth2SuperblocksClient?.iconUrl;
         addField(authButtons, [
             {
                 label: `Connect to ${pluginName}`,
                 name: 'oauth-connect-button',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.BUTTON,
+                componentType: FormComponentType.BUTTON,
                 buttonType: 'connectOAuth',
                 valuesFromContext: [
                     'authType',
@@ -1405,20 +1434,23 @@ prependItems = [], authOptionsLdFlag }) => {
                     'authConfig.refreshTokenFromServer',
                     'authConfig.clientAuthMethod',
                     'authConfig.usePkce',
+                    'authConfig.promptType',
+                    'authConfig.accessType',
                     // Resolves the tenant placeholder in the URLs above for providers that host each
                     // customer on their own subdomain.
-                    index_js_1.RestApiFields.OPENAPI_TENANT_NAME,
+                    RestApiFields.OPENAPI_TENANT_NAME,
                     'dynamicWorkflowConfiguration.enabled',
                     'dynamicWorkflowConfiguration.workflowId'
                 ],
                 extraValues: {
                     pluginId: pluginId,
+                    ...genericConnectParams,
                     ...authorizationExtraParams
                 },
                 iconUrl,
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 },
                 dependencies: ['authConfig.tokenScope']
@@ -1427,7 +1459,7 @@ prependItems = [], authOptionsLdFlag }) => {
                 label: `Revoke token`,
                 name: 'oauth-revoke-shared-tokens-button',
                 startVersion: startVersion,
-                componentType: index_js_1.FormComponentType.BUTTON,
+                componentType: FormComponentType.BUTTON,
                 buttonType: 'revokeOAuthTokens',
                 valuesFromContext: [
                     'authType',
@@ -1441,11 +1473,11 @@ prependItems = [], authOptionsLdFlag }) => {
                     'authConfig.refreshTokenFromServer',
                     'authConfig.revokeTokenUrl',
                     // See the connect button.
-                    index_js_1.RestApiFields.OPENAPI_TENANT_NAME
+                    RestApiFields.OPENAPI_TENANT_NAME
                 ],
                 display: {
                     show: {
-                        authType: [index_js_1.IntegrationAuthType.OAUTH2_CODE]
+                        authType: [IntegrationAuthType.OAUTH2_CODE]
                     }
                 }
             }
@@ -1480,134 +1512,152 @@ prependItems = [], authOptionsLdFlag }) => {
     }
     return formSections;
 };
-exports.authSections = authSections;
+// Plugins whose API key can only travel in a header. GraphQL has no query
+// parameters to put it in; the MCP authorization spec forbids credentials in
+// the query string.
+const HEADER_ONLY_API_KEY_PLUGINS = new Set([
+    ExtendedIntegrationPluginId.GRAPHQL,
+    ExtendedIntegrationPluginId.MCP
+]);
 function apiKeyMarkdownText(pluginId) {
-    return `Specify the header key ${pluginId === index_js_1.ExtendedIntegrationPluginId.GRAPHQL ? '' : 'or the query parameter'} used to pass the API key`;
+    return `Specify the header key ${HEADER_ONLY_API_KEY_PLUGINS.has(pluginId) ? '' : 'or the query parameter'} used to pass the API key`;
 }
 function apiKeyAuthOptions(pluginId) {
     const options = [
         {
             displayName: 'Header',
-            key: index_js_1.ApiKeyMethod.HEADER,
-            value: index_js_1.ApiKeyMethod.HEADER
+            key: ApiKeyMethod.HEADER,
+            value: ApiKeyMethod.HEADER
         }
     ];
-    if (pluginId === index_js_1.ExtendedIntegrationPluginId.REST_API) {
+    if (!HEADER_ONLY_API_KEY_PLUGINS.has(pluginId)) {
         options.push({
             displayName: 'Query parameter',
-            key: index_js_1.ApiKeyMethod.QUERY_PARAM,
-            value: index_js_1.ApiKeyMethod.QUERY_PARAM
+            key: ApiKeyMethod.QUERY_PARAM,
+            value: ApiKeyMethod.QUERY_PARAM
         });
     }
     return options;
 }
 // This generates the dropdown set of authentication methods available
 // for the given plugin/integration.
-function authTypeOptions({ enabledMethods, allowNone = true, apiKeyFormDisplayName, pkceStartVersion }) {
+function authTypeOptions({ enabledMethods, allowNone = true, apiKeyFormDisplayName, pkceStartVersion, excludedAuthTypes = [], authTypeOrder }) {
+    const options = baseAuthTypeOptions({ enabledMethods, allowNone, apiKeyFormDisplayName, pkceStartVersion }).filter((option) => !excludedAuthTypes.includes(option.value));
+    if (!authTypeOrder) {
+        return options;
+    }
+    const rank = (option) => {
+        const index = authTypeOrder.indexOf(String(option.key));
+        return index === -1 ? authTypeOrder.length : index;
+    };
+    // Array.prototype.sort is stable, so unlisted options keep their order.
+    return [...options].sort((a, b) => rank(a) - rank(b));
+}
+function baseAuthTypeOptions({ enabledMethods, allowNone = true, apiKeyFormDisplayName, pkceStartVersion }) {
     const options = allowNone
         ? [
             {
-                displayName: (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.NONE),
-                value: index_js_1.IntegrationAuthType.NONE,
-                key: index_js_1.IntegrationAuthType.NONE
+                displayName: getDisplayName(IntegrationAuthType.NONE),
+                value: IntegrationAuthType.NONE,
+                key: IntegrationAuthType.NONE
             }
         ]
         : [];
     if (enabledMethods.basic) {
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.BASIC),
-            value: index_js_1.IntegrationAuthType.BASIC,
-            key: index_js_1.IntegrationAuthType.BASIC
+            displayName: getDisplayName(IntegrationAuthType.BASIC),
+            value: IntegrationAuthType.BASIC,
+            key: IntegrationAuthType.BASIC
         });
     }
     if (enabledMethods.bearer) {
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.BEARER),
-            value: index_js_1.IntegrationAuthType.BEARER,
-            key: index_js_1.IntegrationAuthType.BEARER
+            displayName: getDisplayName(IntegrationAuthType.BEARER),
+            value: IntegrationAuthType.BEARER,
+            key: IntegrationAuthType.BEARER
         });
     }
     if (enabledMethods.tokenPrefixed) {
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.TOKEN_PREFIXED),
-            value: index_js_1.IntegrationAuthType.TOKEN_PREFIXED,
-            key: index_js_1.IntegrationAuthType.TOKEN_PREFIXED
+            displayName: getDisplayName(IntegrationAuthType.TOKEN_PREFIXED),
+            value: IntegrationAuthType.TOKEN_PREFIXED,
+            key: IntegrationAuthType.TOKEN_PREFIXED
         });
     }
     if (enabledMethods.apiKeyForm) {
         options.push({
-            displayName: apiKeyFormDisplayName ?? (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.API_KEY_FORM),
-            value: index_js_1.IntegrationAuthType.API_KEY_FORM,
-            key: index_js_1.IntegrationAuthType.API_KEY_FORM
+            displayName: apiKeyFormDisplayName ?? getDisplayName(IntegrationAuthType.API_KEY_FORM),
+            value: IntegrationAuthType.API_KEY_FORM,
+            key: IntegrationAuthType.API_KEY_FORM
         });
     }
     if (enabledMethods.apiKey) {
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.API_KEY),
-            value: index_js_1.IntegrationAuthType.API_KEY,
-            key: index_js_1.IntegrationAuthType.API_KEY
+            displayName: getDisplayName(IntegrationAuthType.API_KEY),
+            value: IntegrationAuthType.API_KEY,
+            key: IntegrationAuthType.API_KEY
         });
     }
     if (enabledMethods.firebase) {
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.FIREBASE),
-            value: index_js_1.IntegrationAuthType.FIREBASE,
-            key: index_js_1.IntegrationAuthType.FIREBASE
+            displayName: getDisplayName(IntegrationAuthType.FIREBASE),
+            value: IntegrationAuthType.FIREBASE,
+            key: IntegrationAuthType.FIREBASE
         });
     }
     if (enabledMethods.oauth) {
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS),
-            value: index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS,
-            key: index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS
+            displayName: getDisplayName(IntegrationAuthType.OAUTH2_CLIENT_CREDS),
+            value: IntegrationAuthType.OAUTH2_CLIENT_CREDS,
+            key: IntegrationAuthType.OAUTH2_CLIENT_CREDS
         });
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.OAUTH2_CODE),
-            value: index_js_1.IntegrationAuthType.OAUTH2_CODE,
-            key: index_js_1.IntegrationAuthType.OAUTH2_CODE
+            displayName: getDisplayName(IntegrationAuthType.OAUTH2_CODE),
+            value: IntegrationAuthType.OAUTH2_CODE,
+            key: IntegrationAuthType.OAUTH2_CODE
         });
         if (pkceStartVersion) {
             options.push({
-                displayName: `${(0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.OAUTH2_CODE)} (with PKCE)`,
-                value: index_js_1.IntegrationAuthType.OAUTH2_CODE,
-                key: `${index_js_1.IntegrationAuthType.OAUTH2_CODE}-pkce`,
+                displayName: `${getDisplayName(IntegrationAuthType.OAUTH2_CODE)} (with PKCE)`,
+                value: IntegrationAuthType.OAUTH2_CODE,
+                key: `${IntegrationAuthType.OAUTH2_CODE}-pkce`,
                 secondaryValue: true,
                 startVersion: pkceStartVersion
             });
         }
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.OAUTH2_IMPLICIT),
-            value: index_js_1.IntegrationAuthType.OAUTH2_IMPLICIT,
-            key: index_js_1.IntegrationAuthType.OAUTH2_IMPLICIT
+            displayName: getDisplayName(IntegrationAuthType.OAUTH2_IMPLICIT),
+            value: IntegrationAuthType.OAUTH2_IMPLICIT,
+            key: IntegrationAuthType.OAUTH2_IMPLICIT
         });
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.OAUTH2_PASSWORD),
-            value: index_js_1.IntegrationAuthType.OAUTH2_PASSWORD,
-            key: index_js_1.IntegrationAuthType.OAUTH2_PASSWORD
+            displayName: getDisplayName(IntegrationAuthType.OAUTH2_PASSWORD),
+            value: IntegrationAuthType.OAUTH2_PASSWORD,
+            key: IntegrationAuthType.OAUTH2_PASSWORD
         });
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE),
-            value: index_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE,
-            key: index_js_1.IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE
+            displayName: getDisplayName(IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE),
+            value: IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE,
+            key: IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE
         });
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH),
-            value: index_js_1.IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH,
-            key: index_js_1.IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH
+            displayName: getDisplayName(IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH),
+            value: IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH,
+            key: IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH
         });
     }
     if (enabledMethods.oauth2BringYourOwn) {
         options.push({
             displayName: `OAuth2.0 - Authorization Code`,
-            value: index_js_1.IntegrationAuthType.OAUTH2_CODE,
-            key: index_js_1.IntegrationAuthType.OAUTH2_CODE
+            value: IntegrationAuthType.OAUTH2_CODE,
+            key: IntegrationAuthType.OAUTH2_CODE
         });
     }
     if (enabledMethods.oauth2ClientCredentials) {
         options.push({
             displayName: `OAuth2.0 - Client Credentials`,
-            value: index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS,
-            key: index_js_1.IntegrationAuthType.OAUTH2_CLIENT_CREDS,
+            value: IntegrationAuthType.OAUTH2_CLIENT_CREDS,
+            key: IntegrationAuthType.OAUTH2_CLIENT_CREDS,
             startVersion: enabledMethods.oauth2ClientCredentials.startVersion
         });
     }
@@ -1615,20 +1665,48 @@ function authTypeOptions({ enabledMethods, allowNone = true, apiKeyFormDisplayNa
     // the keys are proto oneof case options
     if (enabledMethods.passwordGrantFlow) {
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.NewAuthType.OAUTH2_PASSWORD_GRANT_FLOW),
-            value: index_js_1.NewAuthType.OAUTH2_PASSWORD_GRANT_FLOW,
-            key: index_js_1.NewAuthType.OAUTH2_PASSWORD_GRANT_FLOW
+            displayName: getDisplayName(NewAuthType.OAUTH2_PASSWORD_GRANT_FLOW),
+            value: NewAuthType.OAUTH2_PASSWORD_GRANT_FLOW,
+            key: NewAuthType.OAUTH2_PASSWORD_GRANT_FLOW
         });
     }
     if (enabledMethods.clientCredentialsFlow) {
         options.push({
-            displayName: (0, index_js_1.getDisplayName)(index_js_1.NewAuthType.OAUTH2_CLIENT_CREDS_FLOW),
-            value: index_js_1.NewAuthType.OAUTH2_CLIENT_CREDS_FLOW,
-            key: index_js_1.NewAuthType.OAUTH2_CLIENT_CREDS_FLOW
+            displayName: getDisplayName(NewAuthType.OAUTH2_CLIENT_CREDS_FLOW),
+            value: NewAuthType.OAUTH2_CLIENT_CREDS_FLOW,
+            key: NewAuthType.OAUTH2_CLIENT_CREDS_FLOW
         });
     }
     return options;
 }
+// The "Share access token across all users" checkbox. Rendered as a checkbox
+// but persisted as a TokenScope string; the saga and server normalize a raw
+// boolean that slips through (see normalizeTokenScope).
+function sharedTokenCheckbox({ startVersion, pluginName, defaultTokenScope }) {
+    return {
+        label: 'Share access token across all users',
+        name: 'authConfig.tokenScope',
+        startVersion: startVersion,
+        componentType: FormComponentType.CHECKBOX,
+        display: {
+            show: {
+                authType: [IntegrationAuthType.OAUTH2_CODE]
+            }
+        },
+        mapBooleansTo: {
+            true: TokenScope.DATASOURCE,
+            false: TokenScope.USER
+        },
+        initialValue: defaultTokenScope ?? TokenScope.DATASOURCE,
+        validateReduxPath: {
+            true: {
+                selector: 'selectHasConnectedTokens',
+                validValue: true,
+                errorMessage: `You must connect to ${pluginName} before you can share access token`
+            }
+        }
+    };
+}
 function addField(authFields, fieldsToAdd, fieldNamesToHide) {
     for (const field of fieldsToAdd) {
         authFields.push({ ...field, hidden: field.hidden || fieldNamesToHide.includes(field.name) });
@@ -1638,20 +1716,20 @@ const BASE_OAUTH_BINDING_ALERT = {
     label: '',
     messageTemplate: `Bindings such as \`{{ Env.client_secret }}\` aren't supported for this auth type. Please explicitly set configuration values.`,
     name: 'oauth-binding-alert',
-    componentType: index_js_1.FormComponentType.ALERT,
+    componentType: FormComponentType.ALERT,
     type: 'warning'
 };
 const BASE_OAUTH_BINDING_ALERT_AUTH_CODE = {
     label: '',
     messageTemplate: `Bindings such as \`{{ Env.client_secret }}\` are only supported for the "Client secret" field for this auth type. Please explicitly set configuration values for the remaining fields.`,
     name: 'oauth-binding-alert',
-    componentType: index_js_1.FormComponentType.ALERT,
+    componentType: FormComponentType.ALERT,
     type: 'warning'
 };
-exports.BASE_SUBJECT_TOKEN_SOURCE = {
+export const BASE_SUBJECT_TOKEN_SOURCE = {
     label: 'Subject token source',
     name: 'authConfig.subjectTokenSource',
-    componentType: index_js_1.FormComponentType.DROPDOWN,
+    componentType: FormComponentType.DROPDOWN,
     tooltip: {
         markdownText: `The source of the subject token to be used in the token exchange. The Login Identity Provider option sends the token granted to the current user by an identity provider like Okta.`
     },
@@ -1670,30 +1748,30 @@ exports.BASE_SUBJECT_TOKEN_SOURCE = {
     initialValue: 'SUBJECT_TOKEN_SOURCE_LOGIN_IDENTITY_PROVIDER',
     singleLine: false
 };
-exports.BASE_SUBJECT_TOKEN_TYPE = {
+export const BASE_SUBJECT_TOKEN_TYPE = {
     label: 'Subject token type',
     name: 'authConfig.subjectTokenType',
-    componentType: index_js_1.FormComponentType.INPUT_TEXT,
+    componentType: FormComponentType.INPUT_TEXT,
     tooltip: {
         markdownText: 'The type of the subject token to be used in the token exchange.'
     },
     placeholder: 'urn:ietf:params:oauth:token-type:access_token',
     singleLine: false
 };
-exports.BASE_SUBJECT_TOKEN_STATIC_TOKEN = {
+export const BASE_SUBJECT_TOKEN_STATIC_TOKEN = {
     label: 'Static subject token',
     name: 'authConfig.subjectTokenSourceStaticToken',
-    componentType: index_js_1.FormComponentType.INPUT_TEXT,
-    dataType: index_js_1.InputDataType.PASSWORD,
+    componentType: FormComponentType.INPUT_TEXT,
+    dataType: InputDataType.PASSWORD,
     tooltip: {
         markdownText: `A static token to be used in the token exchange. This option can be leveraged for testing purposes.`
     },
     singleLine: false
 };
-exports.BASE_TOKEN_URL = {
+export const BASE_TOKEN_URL = {
     label: 'Token URL',
     name: 'authConfig.tokenUrl',
-    componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+    componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
     rules: [{ required: true, message: 'Token URL is required' }],
     tooltip: {
         markdownText: `The endpoint for authorization server. This is used to get the access token.`
@@ -1701,10 +1779,10 @@ exports.BASE_TOKEN_URL = {
     singleLine: true,
     placeholder: `https://example.com/login/oauth/token`
 };
-exports.BASE_CLIENT_ID = {
+export const BASE_CLIENT_ID = {
     label: 'Client ID',
     name: 'authConfig.clientId',
-    componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+    componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
     placeholder: `Client ID`,
     rules: [{ required: true, message: 'Client ID is required' }],
     tooltip: {
@@ -1712,32 +1790,32 @@ exports.BASE_CLIENT_ID = {
     },
     singleLine: true
 };
-exports.BASE_CLIENT_SECRET = {
+export const BASE_CLIENT_SECRET = {
     label: 'Client secret',
     name: 'authConfig.clientSecret',
-    componentType: index_js_1.FormComponentType.INPUT_TEXT,
+    componentType: FormComponentType.INPUT_TEXT,
     rules: [{ required: true, message: 'Client secret is required' }],
     placeholder: `Client Secret`,
-    dataType: index_js_1.InputDataType.PASSWORD,
+    dataType: InputDataType.PASSWORD,
     tooltip: {
         markdownText: `The secret issued to the client during client registration.`
     },
     singleLine: false
 };
-exports.BASE_AUDIENCE = {
+export const BASE_AUDIENCE = {
     // TODO: Ideally hide behind an advanced setting with audience.
     label: 'Audience',
     name: 'authConfig.audience',
-    componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+    componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
     tooltip: {
         markdownText: `The intended recipient of the token, most likely a resource server.`
     },
     singleLine: true
 };
-exports.BASE_SCOPE = {
+export const BASE_SCOPE = {
     label: 'Scope',
     name: 'authConfig.scope',
-    componentType: index_js_1.FormComponentType.DYNAMIC_INPUT_TEXT,
+    componentType: FormComponentType.DYNAMIC_INPUT_TEXT,
     placeholder: `e.g. openid email read:org`,
     tooltip: {
         markdownText: `The scope of access request. It may have multiple space-separated values.`