app_bridge 4.1.1 → 5.0.0

data/Cargo.toml

@@ -5,4 +5,4 @@
 [workspace]
 members = ["./ext/app_bridge"]
 resolver = "2"
-exclude = ["./spec/fixtures/components/rust_app", "./spec/fixtures/components/rust_app_v3"]
+exclude = ["./spec/fixtures/components/rust_app", "./spec/fixtures/components/rust_app_v3", "./spec/fixtures/components/rust_app_v5"]

data/README.md

@@ -305,6 +305,12 @@ impl v5::standout::app::new_feature::Host for AppState {
 - **Gradual migration**: Update connectors to new WIT versions at your own pace
 - **Type safety**: Each version's types are converted to the latest version internally
 
+- **Connections interface** (WIT 5.0.0+): Embeds `connection-config` JSON in WASM; platform extracts it at version upload
+
+## Connection configuration (WIT 5)
+
+Connectors embed `connection-config.json` via `include_str!` and export it through the `connections` interface. Integrationer reads it **once when the WASM version is saved**, validates against [connection-config-schema.json](ext/app_bridge/docs/connection-config-schema.json), and stores it on the version. Runtime connection flows use the stored JSON, not a live WASM call.
+
 ## Development
 
 To contribute or modify this gem, ensure you have the following dependencies installed:

data/Rakefile

@@ -1,12 +1,6 @@
 # frozen_string_literal: true
 
 require "bundler/gem_tasks"
-require "rspec/core/rake_task"
-
-require "rubocop/rake_task"
-
-RuboCop::RakeTask.new
-
 require "rb_sys/extensiontask"
 
 task build: :compile
@@ -17,12 +11,21 @@ RbSys::ExtensionTask.new("app_bridge", GEMSPEC) do |ext|
   ext.lib_dir = "lib/app_bridge"
 end
 
-# Load all project specific rake tasks
-Dir.glob(File.expand_path("tasks/**/*.rake", __dir__)).each { |file| load file }
+if ENV.key?("RUBY_TARGET")
+  task default: :compile
+else
+  require "rspec/core/rake_task"
+  require "rubocop/rake_task"
 
-# Set test mode environment variable for specs
-RSpec::Core::RakeTask.new(:spec) do |_t|
-  ENV["APP_BRIDGE_TEST_MODE"] = "1"
-end
+  RuboCop::RakeTask.new
 
-task default: %i[fixtures compile rust:test spec rubocop]
+  # Load all project specific rake tasks
+  Dir.glob(File.expand_path("tasks/**/*.rake", __dir__)).each { |file| load file }
+
+  # Set test mode environment variable for specs
+  RSpec::Core::RakeTask.new(:spec) do |_t|
+    ENV["APP_BRIDGE_TEST_MODE"] = "1"
+  end
+
+  task default: %i[fixtures compile rust:test spec rubocop]
+end

data/ext/app_bridge/Cargo.toml

@@ -2,7 +2,7 @@
 name = "app_bridge"
 # When updating the version, please also update the version in the
 # lib/app_bridge/version.rb file to keep them in sync.
-version = "4.1.1"
+version = "5.0.0"
 edition = "2021"
 authors = ["Alexander Ross <ross@standout.se>"]
 publish = false
@@ -11,14 +11,16 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-magnus = { version = "0.7.1" }
-wasmtime = "33.0.2"
-wasmtime-wasi = "33.0.2"
+magnus = { version = "0.8.2" }
+wasmtime = "44.0.2"
+wasmtime-wasi = "44.0.2"
+wasmtime-wasi-io = "44.0.2"
 reqwest = { version = "0.12", features = ["blocking", "json", "native-tls-vendored"] }
 base64 = "0.22"
 infer = "0.16"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
+rustls-webpki = "0.103.13"
 
 [dev-dependencies]
 httpmock = "0.8.2"

data/ext/app_bridge/docs/connection-config-schema.json

@@ -0,0 +1,500 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:standout:schemas:connection-config:2",
+  "title": "Connection Config",
+  "description": "Declares how a connector authenticates and what runtime data the platform passes to actions/triggers. OAuth uses RFC 8414 authorization_server metadata and RFC 9728 protected_resource at the top level, with Standout-specific oauth_client credentials and platform hooks alongside. Generated at connector build time (see base-connector-tools). The platform does not fetch well-known metadata at runtime.",
+  "type": "object",
+  "required": ["strategies", "default_strategy", "runtime"],
+  "properties": {
+    "protected_resource": {
+      "$ref": "#/$defs/protected_resource",
+      "description": "RFC 9728 protected resource metadata for the API. runtime.base_url defaults to resource when omitted."
+    },
+    "strategies": {
+      "type": "array",
+      "minItems": 0,
+      "description": "Connection strategies. An empty array disables WASM-driven connections.",
+      "items": { "$ref": "#/$defs/strategy" }
+    },
+    "default_strategy": {
+      "type": "string",
+      "description": "ID of the strategy used when connecting"
+    },
+    "connection_schema": {
+      "type": "object",
+      "description": "JSON Schema for user input before connection (shared fallback). Field values listed in strategy storage are available as {{field}} in templates."
+    },
+    "runtime": {
+      "$ref": "#/$defs/runtime",
+      "description": "Default runtime payload merged with strategy.runtime. Headers and optional base_url override."
+    },
+    "post_connect": { "$ref": "#/$defs/post_connect_hook" }
+  },
+  "$defs": {
+    "templated_value": {
+      "description": "Literal string or template resolved by the platform. Use {{field}} for connection storage keys and {{env:NAME}} for app environment variables.",
+      "oneOf": [
+        { "type": "string" },
+        {
+          "type": "object",
+          "required": ["template"],
+          "additionalProperties": false,
+          "properties": {
+            "template": {
+              "type": "string",
+              "description": "e.g. Bearer {{access_token}}, {{username}}:{{password}}, {{env:CLIENT_ID}}"
+            },
+            "as": {
+              "enum": ["basic_authorization"],
+              "description": "Interpolate template then encode as HTTP Basic (Basic + Base64)"
+            }
+          }
+        }
+      ]
+    },
+    "templated_uri": {
+      "description": "Static URI or template that resolves to a URI at runtime",
+      "oneOf": [
+        { "type": "string", "format": "uri" },
+        {
+          "type": "object",
+          "required": ["template"],
+          "additionalProperties": false,
+          "properties": {
+            "template": {
+              "type": "string",
+              "description": "e.g. https://api.example.com/v1, https://{{subdomain}}.example.com/api, {{env:API_BASE_URL}}"
+            }
+          }
+        }
+      ]
+    },
+    "protected_resource": {
+      "type": "object",
+      "description": "RFC 9728 OAuth Protected Resource Metadata",
+      "required": ["resource", "authorization_servers"],
+      "properties": {
+        "resource": {
+          "type": "string",
+          "format": "uri",
+          "description": "API resource identifier (typically the API base URL)"
+        },
+        "authorization_servers": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string", "format": "uri" },
+          "description": "Issuer URLs of authorization servers that can issue tokens for this resource"
+        },
+        "scopes_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Scopes supported when accessing this resource"
+        },
+        "bearer_methods_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "e.g. header"
+        }
+      }
+    },
+    "authorization_server": {
+      "type": "object",
+      "description": "RFC 8414 OAuth Authorization Server Metadata (server capabilities and endpoints)",
+      "required": ["issuer", "token_endpoint"],
+      "properties": {
+        "issuer": {
+          "type": "string",
+          "format": "uri",
+          "description": "Authorization server issuer identifier"
+        },
+        "authorization_endpoint": {
+          "type": "string",
+          "format": "uri",
+          "description": "OAuth authorization endpoint"
+        },
+        "token_endpoint": {
+          "type": "string",
+          "format": "uri",
+          "description": "OAuth token endpoint"
+        },
+        "response_types_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "e.g. code"
+        },
+        "grant_types_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "e.g. authorization_code, refresh_token, client_credentials"
+        },
+        "scopes_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Scopes the authorization server supports"
+        },
+        "code_challenge_methods_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "PKCE methods supported, e.g. S256"
+        },
+        "token_endpoint_auth_methods_supported": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "e.g. client_secret_basic, client_secret_post"
+        },
+        "revocation_endpoint": {
+          "type": "string",
+          "format": "uri"
+        },
+        "introspection_endpoint": {
+          "type": "string",
+          "format": "uri"
+        },
+        "registration_endpoint": {
+          "type": "string",
+          "format": "uri"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "required": ["grant_types_supported"],
+            "properties": {
+              "grant_types_supported": {
+                "type": "array",
+                "contains": { "const": "client_credentials" },
+                "not": { "contains": { "const": "authorization_code" } }
+              }
+            }
+          },
+          "then": {},
+          "else": {
+            "required": ["authorization_endpoint"]
+          }
+        }
+      ]
+    },
+    "oauth_client": {
+      "type": "object",
+      "description": "Standout client registration and OAuth request choices (not part of RFC 8414)",
+      "required": ["client_id", "client_secret"],
+      "properties": {
+        "grant_type": {
+          "enum": ["authorization_code", "client_credentials"],
+          "default": "authorization_code",
+          "description": "OAuth grant used when connecting"
+        },
+        "response_type": {
+          "type": "string",
+          "default": "code",
+          "description": "Override response_type; defaults to code or first response_types_supported"
+        },
+        "scopes": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Fixed scope list when scopes_from_field is not used"
+        },
+        "scopes_from_field": {
+          "type": "string",
+          "description": "Connection form field containing selected scopes (array of strings)"
+        },
+        "scopes_always_include": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Scopes always appended to scopes_from_field"
+        },
+        "client_id": {
+          "$ref": "#/$defs/templated_value",
+          "description": "OAuth client_id, e.g. {{env:OAUTH_CLIENT_ID}}"
+        },
+        "client_secret": {
+          "$ref": "#/$defs/templated_value",
+          "description": "OAuth client_secret, e.g. {{env:OAUTH_CLIENT_SECRET}}"
+        },
+        "authorization_parameters": {
+          "type": "object",
+          "description": "Extra query parameters appended to the authorization request",
+          "additionalProperties": { "type": "string" }
+        },
+        "authorization_parameters_from_form": {
+          "type": "object",
+          "description": "Map connection form field values to authorization query parameters",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "object",
+              "additionalProperties": { "type": "string" }
+            }
+          }
+        },
+        "token_request_method": {
+          "enum": ["POST", "GET"],
+          "default": "POST"
+        },
+        "token_request_parameters": {
+          "type": "object",
+          "description": "Extra parameters sent to the token endpoint",
+          "additionalProperties": { "type": "string" }
+        }
+      }
+    },
+    "strategy": {
+      "type": "object",
+      "required": ["id", "type"],
+      "properties": {
+        "id": { "type": "string" },
+        "title": {
+          "type": "string",
+          "description": "Label shown when the user picks authentication type before connecting"
+        },
+        "type": {
+          "enum": ["oauth2", "basic_auth", "api_key", "session", "none", "custom"]
+        },
+        "authorization_server": {
+          "$ref": "#/$defs/authorization_server",
+          "description": "RFC 8414 metadata (required when type is oauth2)"
+        },
+        "oauth_client": {
+          "$ref": "#/$defs/oauth_client",
+          "description": "Client credentials and request options (required when type is oauth2)"
+        },
+        "session": {
+          "$ref": "#/$defs/session",
+          "description": "Session login configuration (required when type is session)"
+        },
+        "token_response": {
+          "$ref": "#/$defs/token_response",
+          "description": "Maps token response fields to storage keys. Optional for oauth2 — platform defaults to standard RFC 6749 field names."
+        },
+        "refresh": {
+          "$ref": "#/$defs/refresh",
+          "description": "Token refresh policy. Optional for oauth2 — platform defaults to enabled for authorization_code."
+        },
+        "storage": {
+          "description": "Fields persisted in connection storage. Array of keys or object with optional display titles. Available as {{field}} in runtime templates.",
+          "oneOf": [
+            {
+              "type": "array",
+              "items": { "type": "string" },
+              "minItems": 1
+            },
+            {
+              "type": "object",
+              "minProperties": 1,
+              "additionalProperties": { "$ref": "#/$defs/storage_field" }
+            }
+          ]
+        },
+        "connection_schema": {
+          "type": "object",
+          "description": "Strategy-specific pre-connection form schema (JSON Schema)"
+        },
+        "form_persist": {
+          "type": "object",
+          "description": "Map pre-connection form fields to account storage keys after connect",
+          "additionalProperties": {
+            "oneOf": [
+              { "type": "string" },
+              {
+                "type": "object",
+                "required": ["as"],
+                "properties": {
+                  "as": { "type": "string" },
+                  "join": {
+                    "type": "string",
+                    "description": "Join array values before persisting, e.g. a space for OAuth scopes"
+                  }
+                }
+              }
+            ]
+          }
+        },
+        "runtime": {
+          "$ref": "#/$defs/runtime",
+          "description": "Strategy-specific runtime override"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": { "type": { "const": "oauth2" } },
+            "required": ["type"]
+          },
+          "then": { "required": ["authorization_server", "oauth_client"] }
+        },
+        {
+          "if": {
+            "properties": { "type": { "const": "session" } },
+            "required": ["type"]
+          },
+          "then": { "required": ["session", "token_response"] }
+        }
+      ]
+    },
+    "session": {
+      "type": "object",
+      "required": ["token_endpoint"],
+      "additionalProperties": false,
+      "description": "HTTP request that creates an API session",
+      "properties": {
+        "token_endpoint": {
+          "$ref": "#/$defs/templated_uri",
+          "description": "Login URL that returns a session token"
+        },
+        "method": {
+          "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"],
+          "default": "POST"
+        },
+        "headers": {
+          "type": "object",
+          "additionalProperties": { "$ref": "#/$defs/templated_value" }
+        },
+        "body": {
+          "type": "object",
+          "additionalProperties": { "$ref": "#/$defs/templated_value" }
+        },
+        "body_format": {
+          "enum": ["json", "form"],
+          "default": "json"
+        },
+        "token_source": {
+          "enum": ["body", "header"],
+          "default": "body",
+          "description": "Whether token_response reads from JSON response body or a response header"
+        },
+        "token_header": {
+          "type": "string",
+          "description": "Response header name when token_source is header"
+        },
+        "success_status": {
+          "type": "array",
+          "items": { "type": "integer" },
+          "default": [200]
+        }
+      }
+    },
+    "token_response": {
+      "type": "object",
+      "description": "Maps token or session response fields to connection storage keys",
+      "properties": {
+        "access_token": { "type": "string" },
+        "refresh_token": { "type": "string" },
+        "expires_at": {
+          "type": "object",
+          "properties": {
+            "from": { "type": "string" },
+            "type": { "enum": ["relative_seconds", "absolute_timestamp", "iso8601"] }
+          }
+        }
+      }
+    },
+    "refresh": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "grant_type": { "enum": ["refresh_token", "client_credentials"] },
+        "token_endpoint": {
+          "$ref": "#/$defs/templated_uri",
+          "description": "Override authorization_server.token_endpoint for refresh"
+        },
+        "expires_latency": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Seconds to reduce token validity by before refresh (oauth2 expires_latency)"
+        }
+      }
+    },
+    "storage_field": {
+      "type": "object",
+      "description": "Storage field metadata for account display and connect forms.",
+      "additionalProperties": false,
+      "properties": {
+        "title": {
+          "type": "string",
+          "description": "Label shown for this field"
+        },
+        "description": {
+          "type": "string",
+          "description": "Help text shown on connect forms. Not persisted."
+        }
+      }
+    },
+    "post_connect_hook": {
+      "type": "object",
+      "description": "Platform-run validation after connect. Uses resolved runtime headers and base_url for the active strategy.",
+      "required": ["request"],
+      "properties": {
+        "request": {
+          "type": "object",
+          "properties": {
+            "method": {
+              "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"],
+              "default": "GET"
+            },
+            "path": {
+              "type": "string",
+              "description": "Appended to runtime base_url, e.g. /v1/me"
+            },
+            "url": {
+              "$ref": "#/$defs/templated_uri",
+              "description": "Optional full URL override instead of base_url + path"
+            },
+            "body": {
+              "type": "object",
+              "additionalProperties": { "$ref": "#/$defs/templated_value" }
+            },
+            "body_format": {
+              "enum": ["json", "form"],
+              "default": "json"
+            }
+          },
+          "anyOf": [
+            { "required": ["path"] },
+            { "required": ["url"] }
+          ]
+        },
+        "success_status": {
+          "type": "array",
+          "items": { "type": "integer" },
+          "default": [200]
+        },
+        "persist": {
+          "type": "object",
+          "description": "Map response values to connection storage keys",
+          "additionalProperties": {
+            "oneOf": [
+              {
+                "type": "string",
+                "description": "Dot path from response context, e.g. body.account.id"
+              },
+              {
+                "type": "object",
+                "required": ["from"],
+                "additionalProperties": false,
+                "properties": {
+                  "from": { "type": "string" },
+                  "as": { "enum": ["string"] }
+                }
+              }
+            ]
+          }
+        }
+      }
+    },
+    "runtime": {
+      "type": "object",
+      "description": "Runtime payload for actions/triggers. base_url defaults to protected_resource.resource when omitted.",
+      "properties": {
+        "base_url": { "$ref": "#/$defs/templated_uri" },
+        "headers": {
+          "type": "object",
+          "additionalProperties": { "$ref": "#/$defs/templated_value" }
+        },
+        "fields": {
+          "type": "object",
+          "additionalProperties": { "$ref": "#/$defs/templated_value" }
+        }
+      }
+    }
+  }
+}

data/ext/app_bridge/src/app_state.rs

@@ -1,10 +1,11 @@
-use crate::component::{v3, v4, v4_1};
+use crate::component::{v3, v4, v4_1, v5};
 use crate::component::v4::standout::app::http::Request;
 use reqwest::blocking::Client;
 use std::collections::HashMap;
 use std::sync::{Arc, Mutex};
 use wasmtime::component::ResourceTable;
-use wasmtime_wasi::p2::{WasiCtx, WasiCtxBuilder, WasiView, IoView};
+use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, WasiCtxView, WasiView};
+use wasmtime_wasi_io::IoView;
 
 pub struct AppState {
     ctx: WasiCtx,
@@ -56,20 +57,24 @@ macro_rules! impl_host_for_version {
 impl_host_for_version!(v3);
 impl_host_for_version!(v4);
 impl_host_for_version!(v4_1);
+impl_host_for_version!(v5);
 
 // ============================================================================
 // WASI implementations
 // ============================================================================
 
-impl IoView for AppState {
-    fn table(&mut self) -> &mut ResourceTable {
-        &mut self.table
+impl WasiView for AppState {
+    fn ctx(&mut self) -> WasiCtxView<'_> {
+        WasiCtxView {
+            ctx: &mut self.ctx,
+            table: &mut self.table,
+        }
     }
 }
 
-impl WasiView for AppState {
-    fn ctx(&mut self) -> &mut WasiCtx {
-        &mut self.ctx
+impl IoView for AppState {
+    fn table(&mut self) -> &mut ResourceTable {
+        &mut self.table
     }
 }