@@ -0,0 +1,13 @@
+---
+'@objectstack/service-automation': patch
+---
+
+feat(automation): the connector connection read answers the deployment's OAuth `redirectUri`, and a client-less reconnect of an installer-client instance reuses the kept client
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+Two answers an administrator connecting an `oauth2` `authorization_code` instance with `clientSource: 'installer'` needs from the connector connection door (`/api/v1/automation/connectors/NAME/connection`):
+
+- **`GET` answers `redirectUri`.** The connection read (`getConnectorConnection`) now sets `ConnectorConnectionState.redirectUri`, the redirect URI the administrator registers with the vendor before any client exists, whatever the connection's `status`. It is the same derivation a begun connect uses: the automation plugin's `connectorOAuthRedirectUri` option, else `/api/v1/automation/connectors/oauth/callback` under `OS_AUTH_URL`, else under `OS_BASE_URL`. With no base to derive it from, the key is absent and the read still answers its status; it is never guessed from the request. A begun connect in that case is refused `503` as before.
+- **A reconnect without a client keeps the stored one.** A `POST` that names no client, on an instance that takes the installer's client, now reuses the client the organization's connection keeps (the secret is never read back, so the Console cannot resend it). With no kept client (a first connect, or after a revoke) it is refused `400 VALIDATION_ERROR` as before, and a `POST` that names a client replaces the kept one as before.
@@ -684,6 +684,7 @@ a rotating refresh token is never spent twice.
   it holds.
 
   ```http
+  GET  /api/v1/automation/connectors/:name/connection     → { status, …, redirectUri }
   POST /api/v1/automation/connectors/:name/connection     → { authorizationUrl, expiresAt }
   GET  /api/v1/automation/connectors/oauth/callback?code=…&state=…   (the vendor redirects here)
   DELETE /api/v1/automation/connectors/:name/connection   → revoke
@@ -692,13 +693,20 @@ a rotating refresh token is never spent twice.
   An instance declaring `clientSource: 'installer'` takes its client in the
   connect's body, `{ "clientId": "…", "clientSecret": "…" }` (omit
   `clientSecret` for a public client). Register that client with the vendor
-  first, with the redirect URI `<origin>/api/v1/automation/connectors/oauth/callback`.
-  The authorization request, the code exchange and every refresh of that
-  organization's connection then go out as that client, and a reconnect may
-  bring a new one. The connection keeps it encrypted; the status read shows
-  `client: { source: 'installer', clientId, hasSecret }`, never the secret. A
-  connect of such an instance without a client, a client offered to any other
-  instance, and any other body key are refused `400 VALIDATION_ERROR`.
+  first, with the redirect URI `<origin>/api/v1/automation/connectors/oauth/callback`:
+  the status read answers that exact URI as `redirectUri` before any client
+  exists. That is the one place a client, the Console included, reads it
+  from, never the browser's own origin (wrong behind a proxy, or when
+  `OS_AUTH_URL` / `OS_BASE_URL` name another origin). The authorization request, the code exchange and every
+  refresh of that organization's connection then go out as that client. A
+  reconnect keeps the stored client unless it brings a new one: a connect
+  that names no client reuses the one the organization's connection keeps
+  (the secret is never read back, so it need not be entered again), and one
+  that names a client replaces it. The connection keeps it encrypted; the
+  status read shows `client: { source: 'installer', clientId, hasSecret }`,
+  never the secret. A first connect of such an instance without a client (or
+  one after a revoke, which removes the kept client), a client offered to any
+  other instance, and any other body key are refused `400 VALIDATION_ERROR`.
 
   **In the Console**, **Setup → Integrations → Connector Connections** drives
   these calls; the entry is shown to holders of `manage_connector_connections`.
@@ -710,7 +718,11 @@ a rotating refresh token is never spent twice.
   revokes after a confirmation.
 
   `GET …/:name/connection` answers the organization's status
-  (`not_connected`, `connected`, `reconnect_required`), never a token. The
+  (`not_connected`, `connected`, `reconnect_required`), never a token, and,
+  whatever the status, `redirectUri`: the deployment's redirect URI to
+  register with the vendor. It is absent when the deployment has no base to
+  derive it from (the read still answers; a connect is then refused `503`),
+  never guessed from the request. The
   `state` and the PKCE verifier are bound to the user and organization that
   began the connect and are used once; a callback from anyone else is refused
   before its code is exchanged. While the connect waits (ten minutes at most)
 
@@ -11,11 +11,15 @@
 //  - ⛔ REFUSED: a begin with no client, and a begin body carrying a key other
 //    than `clientId` / `clientSecret`, answer `400 VALIDATION_ERROR` and store
 //    nothing; no refusal repeats a value the caller sent.
+//  - SERVED: the connection's read answers `redirectUri`, the URI to register
+//    with the vendor before any client exists, derived from the deployment's
+//    fixed origin; a connect then names exactly that URI.
 //  - CONNECTED: a begin with the administrator's client sends the browser to
 //    the vendor as that client; the callback exchanges the code as it (its
 //    secret in HTTP Basic); the connection's read shows which client is set,
 //    never its secret; the stored row keeps the id in plain text and the
-//    secret only behind the masked column; revoke removes it.
+//    secret only behind the masked column; a reconnect naming no client
+//    reuses the kept one; revoke removes it.
 //
 // Every credential below is an obviously-fake placeholder, and every
 // assertion on the secret is its absence from what a door served.
@@ -131,7 +135,12 @@ describe("connector connection door: an `oauth2` instance that takes the install
     expect(JSON.stringify(entry)).not.toContain('clientId');
     const read = await stack.apiAs(admin, 'GET', door);
     expect(read.status, await read.clone().text()).toBe(200);
-    expect(dataOf(await read.json())).toMatchObject({ connector: NAME, status: 'not_connected' });
+    const state = dataOf(await read.json());
+    expect(state).toMatchObject({ connector: NAME, status: 'not_connected' });
+    // The URI an administrator registers with the vendor, answered before any
+    // client exists: the deployment's origin plus the callback path.
+    const origin = String(process.env.OS_AUTH_URL || process.env.OS_BASE_URL).trim().replace(/\/+$/, '');
+    expect(state.redirectUri).toBe(`${origin}/api/v1/automation/connectors/oauth/callback`);
   });
 
   it('⛔ a begin with no client is refused 400 VALIDATION_ERROR, naming the vendor registration step; nothing is stored', async () => {
@@ -164,6 +173,9 @@ describe("connector connection door: an `oauth2` instance that takes the install
     const authorizationUrl = new URL(dataOf(JSON.parse(beginText)).authorizationUrl);
     expect(authorizationUrl.origin + authorizationUrl.pathname).toBe(`${idpUrl}/authorize`);
     expect(authorizationUrl.searchParams.get('client_id')).toBe(INSTALLER_ID);
+    // The connect names the very redirect URI the read showed.
+    const shown = dataOf(await (await stack.apiAs(admin, 'GET', door)).json()).redirectUri;
+    expect(authorizationUrl.searchParams.get('redirect_uri')).toBe(shown);
     const state = authorizationUrl.searchParams.get('state');
     expect(state).toBeTruthy();
 
@@ -193,6 +205,14 @@ describe("connector connection door: an `oauth2` instance that takes the install
     expect(row).toMatchObject({ connector_name: NAME, client_id: INSTALLER_ID });
     expect(JSON.stringify(row)).not.toContain(INSTALLER_SECRET);
 
+    // A reconnect naming no client reuses the kept one: the Console never
+    // reads the secret back, so it could never resend it.
+    const reconnect = await stack.apiAs(admin, 'POST', door);
+    const reconnectText = await reconnect.text();
+    expect(reconnect.status, reconnectText.slice(0, 400)).toBe(200);
+    expect(reconnectText).not.toContain(INSTALLER_SECRET);
+    expect(new URL(dataOf(JSON.parse(reconnectText)).authorizationUrl).searchParams.get('client_id')).toBe(INSTALLER_ID);
+
     const revoked = await stack.apiAs(admin, 'DELETE', door);
     expect(revoked.status, await revoked.clone().text()).toBe(200);
     expect(dataOf(await revoked.json())).toMatchObject({ connector: NAME, status: 'not_connected' });
 
@@ -288,7 +288,7 @@ describe('ADR-0143 D4/D5 — connect an instance nobody authorized yet', () => {
         expect(provider.state.materialized).toHaveLength(0);
         expect(engine.getConnectorDegradedReason('crm')).toContain("connector instance 'crm' is not connected");
         expect(await engine.getConnectorConnection({ connector: 'crm', context: ADMIN_A as never }))
-            .toEqual({ connector: 'crm', organizationId: 'org_a', status: 'not_connected' });
+            .toEqual({ connector: 'crm', organizationId: 'org_a', status: 'not_connected', redirectUri: REDIRECT_URI });
 
         const { begun, done } = await connect();
         const url = new URL(begun.authorizationUrl);
@@ -440,6 +440,54 @@ describe('ADR-0143 D4/D5 — connect an instance nobody authorized yet', () => {
             if (saved.b === undefined) delete process.env.OS_BASE_URL; else process.env.OS_BASE_URL = saved.b;
         }
     });
+    it('the read answers the redirect URI to register with the vendor: the option, else OS_AUTH_URL, else OS_BASE_URL; with no base it is absent, never a refusal', async () => {
+        const CALLBACK = '/api/v1/automation/connectors/oauth/callback';
+        const saved = { a: process.env.OS_AUTH_URL, b: process.env.OS_BASE_URL };
+        delete process.env.OS_AUTH_URL;
+        delete process.env.OS_BASE_URL;
+        try {
+            const { engine, connect } = await boot([crm()], { redirectUri: null });
+            const read = () => engine.getConnectorConnection({ connector: 'crm', context: ADMIN_A as never });
+
+            // No base: the status still answers, the key is absent (not a
+            // guess, not a 503) — and a begin is still the 503 it was.
+            const bare = await read();
+            expect(bare).toEqual({ connector: 'crm', organizationId: 'org_a', status: 'not_connected' });
+            expect('redirectUri' in bare).toBe(false);
+            await expect(engine.beginConnectorConnection({ connector: 'crm', context: ADMIN_A as never }))
+                .rejects.toMatchObject({ status: 503, code: 'SERVICE_UNAVAILABLE' });
+            // A base that is no absolute http(s) URL derives nothing either.
+            process.env.OS_BASE_URL = 'os.example.com';
+            expect('redirectUri' in (await read())).toBe(false);
+
+            process.env.OS_BASE_URL = 'https://base.example.com/';
+            expect((await read()).redirectUri).toBe(`https://base.example.com${CALLBACK}`);
+            process.env.OS_AUTH_URL = 'https://auth.example.com';
+            expect((await read()).redirectUri).toBe(`https://auth.example.com${CALLBACK}`);
+
+            // The URI the read shows is the one a connect names, and a
+            // connected read still answers it.
+            const { begun, done } = await connect();
+            expect(new URL(begun.authorizationUrl).searchParams.get('redirect_uri')).toBe(`https://auth.example.com${CALLBACK}`);
+            await done();
+            expect(await read()).toMatchObject({ status: 'connected', redirectUri: `https://auth.example.com${CALLBACK}` });
+
+            // The plugin option outranks both variables.
+            const { engine: optioned } = await boot([crm()]);
+            expect((await optioned.getConnectorConnection({ connector: 'crm', context: ADMIN_A as never })).redirectUri).toBe(REDIRECT_URI);
+        } finally {
+            if (saved.a === undefined) delete process.env.OS_AUTH_URL; else process.env.OS_AUTH_URL = saved.a;
+            if (saved.b === undefined) delete process.env.OS_BASE_URL; else process.env.OS_BASE_URL = saved.b;
+        }
+    });
+
+    it('⛔ a client_credentials instance has no connection, so its read is refused 400 and answers no redirect URI', async () => {
+        const clientCredentials = crm({ name: 'svc', auth: { ...crm().auth, grant: 'client_credentials', authorizationUrl: undefined } });
+        const { engine } = await boot([crm(), clientCredentials]);
+        const err = (await engine.getConnectorConnection({ connector: 'svc', context: ADMIN_A as never }).catch((e: unknown) => e)) as Record<string, unknown>;
+        expect(err).toMatchObject({ status: 400, code: 'VALIDATION_ERROR', message: expect.stringContaining('does not use the oauth2 authorization_code grant') });
+        expect(String(err.message)).not.toContain('oauth/callback');
+    });
 });
 
 // ─── D4 dispatch ─────────────────────────────────────────────────────
@@ -732,6 +780,42 @@ describe("ADR-0143 D2.1 — an instance that takes the installer's OAuth client"
             .toEqual({ source: 'installer', clientId: 'installer-client-a2', hasSecret: false });
     });
 
+    it("a reconnect without a client reuses the one the organization's connection keeps; another organization's, or a revoked one, is never reused", async () => {
+        const { engine, ql } = await boot([installerCrm()]);
+        await (await connectWith(engine, INSTALLER_CLIENT)).done();
+
+        // Reconnect naming no client: no 400 — the authorization request, the
+        // code exchange and the stored row all use the kept client.
+        const { begun, done } = await connectWith(engine, undefined);
+        expect(new URL(begun.authorizationUrl).searchParams.get('client_id')).toBe(INSTALLER_ID);
+        expect(JSON.stringify(begun)).not.toContain(INSTALLER_SECRET);
+        expect(await done()).toMatchObject({ status: 'connected', client: { source: 'installer', clientId: INSTALLER_ID, hasSecret: true } });
+        expect(idp.requests).toHaveLength(2);
+        expect(idp.requests[1].authorization).toBe(basicOf(INSTALLER_ID, INSTALLER_SECRET));
+        const [row] = await rowsOf(ql);
+        expect(row).toMatchObject({ organization_id: 'org_a', client_id: INSTALLER_ID, revision: 2 });
+        expect(JSON.parse(await (ql as any).resolveSecretField(CONNECTOR_CONNECTION_OBJECT, row.id, 'registered_client')))
+            .toEqual({ source: 'installer', clientId: INSTALLER_ID, clientSecret: INSTALLER_SECRET });
+
+        // The client belongs to org_a's connection: org_b, connecting first, is refused as before.
+        await expect(engine.beginConnectorConnection({ connector: 'crm', context: ADMIN_B as never }))
+            .rejects.toMatchObject({ status: 400, code: 'VALIDATION_ERROR', message: expect.stringContaining('Register an OAuth client') });
+        // Revoked, nothing is kept to reuse.
+        await engine.revokeConnectorConnection({ connector: 'crm', context: ADMIN_A as never });
+        await expect(engine.beginConnectorConnection({ connector: 'crm', context: ADMIN_A as never }))
+            .rejects.toMatchObject({ status: 400, code: 'VALIDATION_ERROR', message: expect.stringContaining('Register an OAuth client') });
+        expect(idp.requests).toHaveLength(2);
+    });
+
+    it('a reconnect without a client reuses a kept public client as it is: its id in the form, no secret', async () => {
+        const { engine } = await boot([installerCrm()]);
+        await (await connectWith(engine, { clientId: INSTALLER_ID })).done();
+        const state = await (await connectWith(engine, undefined)).done();
+        expect(state.client).toEqual({ source: 'installer', clientId: INSTALLER_ID, hasSecret: false });
+        expect(idp.requests[1].authorization).toBeUndefined();
+        expect(idp.requests[1].form.client_id).toBe(INSTALLER_ID);
+    });
+
     it('⛔ a connect without a client is refused 400, naming the instance and the vendor registration step; nothing is kept', async () => {
         const { engine, ql } = await boot([installerCrm()]);
         const err = (await engine.beginConnectorConnection({ connector: 'crm', context: ADMIN_A as never }).catch((e: Error) => e)) as Error & { status?: number; code?: string };