OAuth flow: Instance-wide params should only be injected if a connector will be using oauth

[sherifnada]

Current Behavior

If instancewide oauth params are set, they are always injected when the source connector is created via the web_backend/sources/create endpoint.

However, there are instances where this is undesirable behavior.

For example, you can authenticate into various google APIs using a few methods e.g: Bigquery via service account key or oauth2. in this case the spec of the connector might be:

{
  "properties": {
    "credentials": {
      "oneOf": [
        {
          "type": "object",
          "required": ["auth_type", "client_id", "client_secret"],
          "auth_type": {
            "type": "string",
            "const": "oauth2"
          },
          "client_id":{
            "type": "string"
          },
          "client_secret": {
            "type": "string"
          }
        },
        {
          "type": "object",
          "required": ["auth_type", "service_account_key"],
          "auth_type": {
            "type": "string",
            "const": "service_account_key"
          },
          "service_account_key":{
            "type": "string"
          }
        }
      ]
    }
  }
}

then the config must have either

{
  "credentials": {
    "auth_type": "oauth2",
    "client_id": "abc",
    "client_secret": "xyz"
  }
}

or

{
  "credentials": {
    "auth_type": "service_account_key",
    "json": {
      ...
    }
  }
}

but in the current behavior if the user wants to use service account credentials, then validation for the connector will fail because we would have a config that looks like:

{
  "credentials": {
    "auth_type": "service_account_key",
    "json": {
      ...
    },
    "client_id": "abc",
    "client_secret": "xyz"
  }
}

This is not world ending but definitely error prone.

Expected Behavior

instancewide variables should only be injected if needed/if a config is using oauth

[ChristopheDuong]

In the case of a Facebook connector, it seems:

• you'd have instance wide parameters client_id and client_secret (which are used in the oauth flow to retrieve an access_token)
• but these are not required by the connector to use the access_token afterward. So it is unnecessary to inject them into the connector's configurations.

The specs.json of such connectors following up on #6456 should declare

• no oauthFlowInitParameters to inject
• an oauthFlowOutputParameters of access_token after completing the oauth flow

[sherifnada]

blocked on ratification of spec

[sherifnada]

@ChristopheDuong can this be closed?