{"record":{"id":"fa320bcb6af550b2","repo":"paperclipai/paperclip","slug":"oauth-metadata-failed","errorCode":"oauth_metadata_failed","errorMessage":"OAuth provider metadata could not be loaded","messagePattern":"OAuth provider metadata could not be loaded","errorType":"http","errorClass":"HttpError","httpStatus":502,"severity":"error","filePath":"server/src/services/tool-access.ts","lineNumber":5775,"sourceCode":"    entries: CreateToolProfileEntryForProfile[],\n  ) {\n    for (const entry of entries) {\n      await assertProfileEntryInput(companyId, entry);\n    }\n    await db\n      .delete(toolProfileEntries)\n      .where(\n        and(\n          eq(toolProfileEntries.companyId, companyId),\n          eq(toolProfileEntries.profileId, profileId),\n        ),\n      );\n    await createProfileEntries(companyId, profileId, entries);\n  }\n\n  /**\n   * @param grantSecretRefs Secret refs held by a grant rather than the connection\n   *   row. A personal credential lives only on its user grant (PAP-17835), so it\n   *   would otherwise have no `company_secret_bindings` row and drop out of\n   *   secret projection and removal teardown.\n   */\n  async function syncCredentialBindings(\n    connection: typeof toolConnections.$inferSelect,\n    grantSecretRefs: ToolCredentialSecretRef[] = [],\n    dbClient: ToolAccessMutationDb = db,\n  ) {\n    await dbClient\n      .delete(companySecretBindings)\n      .where(\n        and(\n          eq(companySecretBindings.companyId, connection.companyId),\n          eq(companySecretBindings.targetType, \"tool_connection\"),\n          eq(companySecretBindings.targetId, connection.id),\n        ),\n      );\n    // A metadata edit or pause/resume must retain declarations for every","sourceCodeStart":5757,"sourceCodeEnd":5793,"githubUrl":"https://github.com/paperclipai/paperclip/blob/3f1d897a7c018d76563a21c6e39c3c9b03933622/server/src/services/tool-access.ts#L5757-L5793","documentation":"Discovery guard in the OAuth endpoint resolution chain: none of the well-known metadata URLs (oauth-authorization-server / openid-configuration) returned usable endpoints. Without metadata the provider flow cannot proceed; the remote provider's discovery documents are at fault.","triggerScenarios":"Thrown at server/src/services/tool-access.ts:4054 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The OAuth provider metadata document could not be fetched. Verify the issuer URL, network egress, and that the provider supports discovery."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3f1d897a7c018d76563a21c6e39c3c9b03933622","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}