{"record":{"id":"2cd1afa6a79822c8","repo":"paperclipai/paperclip","slug":"connector-profile-invalid","errorCode":"connector_profile_invalid","errorMessage":"Managed authorization has an invalid connector profile","messagePattern":"Managed authorization has an invalid connector profile","errorType":"http","errorClass":"ToolGatewayHttpError","httpStatus":422,"severity":"error","filePath":"server/src/services/tool-gateway.ts","lineNumber":2751,"sourceCode":"  }\n\n  async function maybeRefreshPaperclipCloudGrant(\n    session: ToolGatewaySession,\n    connection: typeof toolConnections.$inferSelect,\n    grant: typeof connectionGrants.$inferSelect,\n    forceRefresh = false,\n  ): Promise<typeof connectionGrants.$inferSelect> {\n    const oauth = asRecord(asRecord(connection.config)?.oauth);\n    if (!oauth || !isPaperclipCloudConnectorStrategy(oauth.strategy)) return grant;\n    const configuredProfile = oauth.connectorProfile;\n    const connectorProfile: GoogleWorkspaceConnectorProfileId | GitHubConnectorProfileId = configuredProfile === undefined\n      ? \"gmail.draft\"\n      : typeof configuredProfile === \"string\" && (\n        isGoogleWorkspaceConnectorProfileId(configuredProfile) || isGitHubConnectorProfileId(configuredProfile)\n      )\n        ? configuredProfile\n        : (() => {\n            throw new ToolGatewayHttpError(422, \"Managed authorization has an invalid connector profile\", \"connector_profile_invalid\", {\n              connectionId: connection.id,\n              grantId: grant.id,\n            });\n          })();\n    const connectorSubject = typeof oauth.connectorSubjectAgentId === \"string\"\n      ? `agent:${oauth.connectorSubjectAgentId}`\n      : typeof oauth.connectorSubjectUserId === \"string\"\n      ? oauth.connectorSubjectUserId\n      : grant.kind === \"agent\" && grant.subjectAgentId\n        ? `agent:${grant.subjectAgentId}`\n        : grant.subjectUserId;\n    const grantOauth = asRecord(asRecord(grant.providerTenant)?.oauth);\n    const expiresAt = typeof grantOauth?.accessTokenExpiresAt === \"string\"\n      ? Date.parse(grantOauth.accessTokenExpiresAt)\n      : Number.NaN;\n    const currentTime = options.now?.() ?? Date.now();\n    // The preferred GitHub App policy yields a non-expiring ghu_ token and no\n    // refresh token. Absence of an expiry is deliberate, not an invitation to","sourceCodeStart":2733,"sourceCodeEnd":2769,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-gateway.ts#L2733-L2769","documentation":"Managed authorization (managed OAuth) requires a valid connector profile id. The code accepts specific well-known profiles (e.g. \"gmail.draft\") or any profile passing isGoogleWorkspaceConnectorProfileId / isGitHubConnectorProfileId; otherwise it throws HTTP 422 'Managed authorization has an invalid connector profile' (code connector_profile_invalid) with connectionId and grantId context.","triggerScenarios":"A connection/grant's configuredProfile is neither a recognized literal nor a valid Google Workspace or GitHub connector profile id — e.g. malformed string, profile id from an unsupported provider, empty/whitespace value, or a renamed profile id no longer matching the validators.","commonSituations":"Typo in a managed-authorization profile setting (\"gmai.draft\"); profile id copied from another integration (e.g. generic OAuth profile) that isn't in the Google/GitHub validator sets; schema/config drift after a version bump renamed profile ids.","solutions":["Set the connector profile to a supported value (e.g. \"gmail.draft\") or a profile id accepted by isGoogleWorkspaceConnectorProfileId/isGitHubConnectorProfileId.","Log/inspect the connection's configuredProfile and fix the typo or casing.","Migrate old profile ids to the current naming if a version changed the validator.","Add the new provider/profile to the validators only if it is genuinely a supported managed profile."],"exampleFix":"// before\nconst configuredProfile = connection.config.profile; // \"gmai.draft\"\n// after\nconst configuredProfile = isGoogleWorkspaceConnectorProfileId(connection.config.profile) || isGitHubConnectorProfileId(connection.config.profile)\n  ? connection.config.profile\n  : \"gmail.draft\"; // fallback to a known-valid managed profile","handlingStrategy":"validation","validationCode":"import { isGoogleWorkspaceConnectorProfileId, isGitHubConnectorProfileId } from \"@paperclipai/shared\";\nif (!(configuredProfile === \"gmail.draft\" || isGoogleWorkspaceConnectorProfileId(configuredProfile) || isGitHubConnectorProfileId(configuredProfile))) {\n  throw new Error(`Invalid connector profile: ${configuredProfile}`);\n}","typeGuard":"function isValidConnectorProfile(p: unknown): p is string {\n  return typeof p === \"string\" && (p === \"gmail.draft\" || isGoogleWorkspaceConnectorProfileId(p) || isGitHubConnectorProfileId(p));\n}","tryCatchPattern":"try {\n  await gateway.call(session, toolName, args);\n} catch (e) {\n  if (e instanceof ToolGatewayHttpError && e.code === \"connector_profile_invalid\") {\n    // fix connection.config.profile to a supported managed profile and retry\n  }\n  throw e;\n}","preventionTips":["Validate connector profile ids at connection save time, not only at dispatch.","Keep profile-id constants in shared packages so all surfaces use the same validators.","Add integration tests covering each supported managed profile id.","Reject unknown profiles in admin/UI forms with inline validation."],"tags":["validation","oauth","connector","config"],"backgroundTag":"invalid-config-value","analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-10T03:14:50.855Z","contentChangedAt":"2026-09-10T03:14:50.855Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}