{"record":{"id":"fa320bcb6af550b2","repo":"paperclipai/paperclip","slug":"oauth-metadata-failed","errorCode":"oauth_metadata_failed","errorMessage":"OAuth provider metadata could not be loaded","messagePattern":"OAuth provider metadata could not be loaded","errorType":"http","errorClass":"HttpError","httpStatus":502,"severity":"error","filePath":"server/src/services/tool-access.ts","lineNumber":4204,"sourceCode":"      toolName: entry.toolName ?? null,\n      riskLevel: entry.riskLevel ?? null,\n      conditions: entry.conditions ?? null,\n    })));\n  }\n\n  async function replaceProfileEntries(companyId: string, profileId: string, entries: CreateToolProfileEntryForProfile[]) {\n    for (const entry of entries) {\n      await assertProfileEntryInput(companyId, entry);\n    }\n    await db\n      .delete(toolProfileEntries)\n      .where(and(eq(toolProfileEntries.companyId, companyId), eq(toolProfileEntries.profileId, profileId)));\n    await createProfileEntries(companyId, profileId, entries);\n  }\n\n  /**\n   * @param grantSecretRefs Secret refs held by a grant rather than the connection\n   *   row. A personal credential lives only on its user grant (PAP-17835), so it\n   *   would otherwise have no `company_secret_bindings` row and drop out of\n   *   secret projection and removal teardown.\n   */\n  async function syncCredentialBindings(\n    connection: typeof toolConnections.$inferSelect,\n    grantSecretRefs: ToolCredentialSecretRef[] = [],\n    dbClient: ToolAccessMutationDb = db,\n  ) {\n    await dbClient\n      .delete(companySecretBindings)\n      .where(\n        and(\n          eq(companySecretBindings.companyId, connection.companyId),\n          eq(companySecretBindings.targetType, \"tool_connection\"),\n          eq(companySecretBindings.targetId, connection.id),\n        ),\n      );\n    // A metadata edit or pause/resume must retain declarations for every","sourceCodeStart":4186,"sourceCodeEnd":4222,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-access.ts#L4186-L4222","documentation":"Discovery guard in the OAuth endpoint resolution chain: none of the well-known metadata URLs (oauth-authorization-server / openid-configuration) returned usable endpoints. Without metadata the provider flow cannot proceed; the remote provider's discovery documents are at fault.","triggerScenarios":"Thrown at server/src/services/tool-access.ts:4054 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The OAuth provider metadata document could not be fetched. Verify the issuer URL, network egress, and that the provider supports discovery."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}