@adelie/server 0.5.7 → 0.5.9

package/dist/index.js

@@ -8,7 +8,7 @@ import {
 } from "./chunk-GO6G445C.js";
 import {
   TICKET_SLUG_PATTERN
-} from "./chunk-6IXN3YH4.js";
+} from "./chunk-7ROH3XZA.js";
 import {
   MachinesRepo
 } from "./chunk-HMTT2PX4.js";
@@ -25,9 +25,10 @@ import {
   isMissingCredential,
   mintApiToken,
   modelCredentialMissing,
+  normalizeError,
   storeApiToken,
   toUserInfo
-} from "./chunk-CXGWSWJA.js";
+} from "./chunk-3Y7I7J3W.js";
 import {
   acquireServerLock,
   liveServerLock,
@@ -3682,7 +3683,7 @@ import { DEFAULT_PROJECT_ID as DEFAULT_PROJECT_ID3, DEFAULT_PROJECT_NAME as DEFA
 
 // src/ifaces.json
 var ifaces_default = {
-  hash: "0b0f68e407b030585d1a39c05a849df1a4d025bd5b85d34c5246b92a42670a96",
+  hash: "82247e20cc9b17bc5831d03e41da41a2e8a8649fb9ea23c6589e2ba3c5713df2",
   ifaces: {
     "@adelie/server#Access": {
       name: "Access",
@@ -23171,7 +23172,10 @@ var ifaces_default = {
     "@adelie/server#ModelOAuthMode": "'callback'|'manual'",
     "@adelie/server#ModelOAuthStartResult": {
       flowId: "string",
-      authorizeUrl: "string"
+      authorizeUrl: "string",
+      mode: {
+        $ref: "@adelie/server#ModelOAuthMode"
+      }
     },
     "@adelie/server#ModelOAuthStatus": "'pending'|'done'|'error'",
     "@adelie/server#ModelPricingDto": {
@@ -25250,6 +25254,7 @@ var ifaces_default = {
       "toTs?": "string",
       "until?": "string",
       "agentId?": "string",
+      "kind?": "string",
       "includeGlobalErrors?": "boolean"
     },
     "@adelie/server#UsageErrorsPage": {
@@ -46727,12 +46732,12 @@ var UsageService = class {
   /**
    * Empties the error table for the filter the panel is showing, and answers how many rows went.
    *
-   * The filter is the same range (dates, and the trailing window when one is on) and Agent
-   * the dashboard and the paged route take, read with the same admin visibility, so a clear
-   * removes exactly the set the caller was looking at and never a row outside it: a reader
-   * who has narrowed to one Agent and one week does not lose the rest of the year to a button
-   * that said "clear", and an admin whose panel showed unattributed rows is not left holding
-   * them after clearing it (see ErrorsRepo.deleteFiltered).
+   * The filter is the same range (dates, and the trailing window when one is on), Agent and
+   * category the dashboard and the paged route take, read with the same admin visibility, so a
+   * clear removes exactly the set the caller was looking at and never a row outside it: a
+   * reader who has narrowed to one Agent, one week or one category does not lose the rest to a
+   * button that said "clear", and an admin whose panel showed unattributed rows is not left
+   * holding them after clearing it (see ErrorsRepo.deleteFiltered).
    */
   clearErrors(projectId, q) {
     return this.errors.deleteFiltered(projectId, {
@@ -46742,6 +46747,7 @@ var UsageService = class {
       ...q.fromTs !== void 0 ? { fromTs: q.fromTs } : {},
       ...q.toTs !== void 0 ? { toTs: q.toTs } : {},
       ...q.until !== void 0 ? { until: q.until } : {},
+      ...q.kind !== void 0 ? { kind: q.kind } : {},
       ...q.includeGlobalErrors === true ? { includeGlobal: true } : {}
     });
   }
@@ -47860,6 +47866,18 @@ import { APP_URL, providerInfo as providerInfo2 } from "@adelie/core/model-catal
 import { Component as Component35, Use as Use35 } from "@adelie/core/kernel";
 var FLOW_TTL_MS = 10 * 60 * 1e3;
 var MAX_FLOWS_PER_OWNER = 8;
+function openedMode(asked, callbackOrigin) {
+  if (asked === "manual") return "manual";
+  let origin;
+  try {
+    origin = new URL(callbackOrigin);
+  } catch {
+    return "manual";
+  }
+  if (origin.protocol === "https:") return "callback";
+  const loopback = origin.hostname === "localhost" || origin.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(origin.hostname);
+  return origin.protocol === "http:" && loopback ? "callback" : "manual";
+}
 function createVerifier() {
   return `${randomUUID6()}${randomUUID6()}`;
 }
@@ -47923,6 +47941,9 @@ var ModelOAuthService = class {
    * that declares no `oauth` cannot be talked into one, and the authorize/exchange
    * endpoints are always the catalog's, so client input never chooses who receives the
    * challenge or who is asked for a key.
+   *
+   * A redirect that the authorization page would refuse is not asked for: the flow opens in
+   * manual mode instead (see {@link openedMode}) and the result says so.
    */
   start(input) {
     const oauth = providerInfo2(input.provider)?.oauth;
@@ -47934,13 +47955,14 @@ var ModelOAuthService = class {
     const flowId3 = randomBytes7(32).toString("base64url");
     const verifier = createVerifier();
     const createdAt = this.now();
-    const callbackUrl = input.mode === "callback" ? `${input.callbackOrigin}/api/projects/${encodeURIComponent(input.projectId)}/model-oauth/callback?flow=${encodeURIComponent(flowId3)}` : void 0;
+    const mode = openedMode(input.mode, input.callbackOrigin);
+    const callbackUrl = mode === "callback" ? `${input.callbackOrigin}/api/projects/${encodeURIComponent(input.projectId)}/model-oauth/callback?flow=${encodeURIComponent(flowId3)}` : void 0;
     this.flows.set(flowId3, {
       flowId: flowId3,
       projectId: input.projectId,
       userId: input.userId,
       provider: input.provider,
-      mode: input.mode,
+      mode,
       exchangeUrl: oauth.exchangeUrl,
       verifier,
       code: null,
@@ -47954,7 +47976,8 @@ var ModelOAuthService = class {
         oauth,
         challenge: codeChallenge(verifier),
         ...callbackUrl !== void 0 ? { callbackUrl } : {}
-      })
+      }),
+      mode
     };
   }
   /**
@@ -55960,13 +55983,18 @@ function usageRoutes(deps) {
     const window = tsWindowQuery(c);
     const until = optionalTsParam(c.req.query("until"), "until");
     const agentId = c.req.query("agentId");
+    const kindRaw = c.req.query("kind");
+    if (kindRaw !== void 0 && kindRaw !== "" && !ERROR_KINDS.includes(kindRaw)) {
+      throw badRequest(`kind must be one of ${ERROR_KINDS.join(" / ")}.`);
+    }
     const deleted = deps.usageService.clearErrors(projectId, {
       includeGlobalErrors: c.var.user.isAdmin,
       from,
       to,
       ...window,
       ...until !== void 0 ? { until } : {},
-      ...agentId !== void 0 && agentId !== "" ? { agentId } : {}
+      ...agentId !== void 0 && agentId !== "" ? { agentId } : {},
+      ...kindRaw !== void 0 && kindRaw !== "" ? { kind: kindRaw } : {}
     });
     return c.json({ deleted });
   });
@@ -75235,12 +75263,13 @@ var HttpModule = class {
     const app = new Hono49();
     app.onError((err, c) => {
       const projectId = attributedProjectId(c, { access });
+      const normalized = normalizeError(err);
       errors.record({
         source: "http",
-        err,
+        err: normalized,
         ...projectId !== void 0 ? { ctx: { projectId } } : {}
       });
-      return handleError(err, c);
+      return handleError(normalized, c);
     });
     app.notFound(() => declined());
     app.use("*", async (c, next) => {
@@ -81553,12 +81582,13 @@ function createApp(boot3) {
   const app = new Hono55();
   app.onError((err, c) => {
     const projectId = attributedProjectId(c, { access: access() });
+    const normalized = normalizeError(err);
     errors().record({
       source: "http",
-      err,
+      err: normalized,
       ...projectId !== void 0 ? { ctx: { projectId } } : {}
     });
-    return handleError(err, c);
+    return handleError(normalized, c);
   });
   app.notFound((c) => c.json(errorBody("not_found", "Endpoint does not exist."), 404));
   app.use("*", async (c, next) => {