feat(server): createOAuthPassthroughResolver — Shape B account resolver factory

[bokelley]

Parent: #452
Depends on: #456 (Account v3 wire fields)

JS source

6.7 changeset extend-v3-fallback.md and recipe #12 in migration guide.

Use case

For adapters wrapping a vendor OAuth + /me/adaccounts-shaped upstream (Meta, Snap, TikTok-shaped). Currently every adopter copies the same Shape B boilerplate: take the user's OAuth token, call /me/adaccounts, map each upstream record to an Account, return the one matching ref.

Proposed API

from adcp.decisioning import create_oauth_passthrough_resolver

resolve = create_oauth_passthrough_resolver(
    http_client=upstream_client,                 # from #1
    list_endpoint="/me/adaccounts",
    id_field="id",                               # which field on each row identifies the account
    to_account=lambda row, ctx: Account(...),    # adapter's row→Account mapping
)

# Use as AccountStore.resolve
store = ExplicitAccounts(resolve=resolve)

Auto-handles OAuth refresh via dynamic_bearer.get_token from #1's auth modes.

Acceptance criteria

• create_oauth_passthrough_resolver exported from adcp.decisioning.
• Tests cover: ref found, ref not found (returns None), upstream returns 401 (refresh path), to_account raises (propagates).

[bokelley]

Triage

Classification: Feature request
Bucket(s): client (adcp.decisioning) — no matching repo label; gap noted in run summary
Status: deferred

My take: create_oauth_passthrough_resolver is a clean non-breaking factory that eliminates high-friction Shape B boilerplate, and all four acceptance criteria look directly testable with pytest. It cannot land before #456 closes, however — the OAuth-refresh path explicitly calls dynamic_bearer.get_token from that issue's auth-modes surface, and the ResolveContext parameter signature doesn't exist yet.

Blocked-on: #456 — resurfaces on merge.

---

Triaged by Claude Code. Session: https://claude.ai/code/session_017YxWAYnY7s9tqqicF4qfHg

---

Generated by Claude Code