@agent-native/core 0.105.0 → 0.106.1

package/dist/server/workspace-provider-oauth.d.ts

@@ -1,7 +1,7 @@
 import { type H3Event } from "h3";
 import { type WorkspaceConnectionProvider } from "../connections/catalog.js";
 import { type OAuthStatePayload } from "./google-oauth.js";
-export type GenericWorkspaceOAuthProvider = "figma" | "google_drive" | "notion";
+export type GenericWorkspaceOAuthProvider = "figma" | "google_drive" | "github" | "hubspot" | "jira" | "sentry" | "notion";
 export interface WorkspaceProviderOAuthFlow {
     provider: GenericWorkspaceOAuthProvider;
     flowId: string;
@@ -32,10 +32,14 @@ export declare function exchangeWorkspaceProviderOAuthCode(input: {
     verifier: string;
     redirectUri: string;
 }): Promise<Record<string, unknown>>;
-export declare function resolveWorkspaceProviderIdentity(providerId: GenericWorkspaceOAuthProvider, tokens: Record<string, unknown>): Promise<{
+export declare function resolveWorkspaceProviderIdentity(providerId: GenericWorkspaceOAuthProvider, tokens: Record<string, unknown>): Promise<WorkspaceProviderIdentity>;
+export declare function resolveWorkspaceProviderIdentities(providerId: GenericWorkspaceOAuthProvider, tokens: Record<string, unknown>): Promise<WorkspaceProviderIdentity[]>;
+type WorkspaceProviderIdentity = {
     accountId: string;
     label: string;
-}>;
+    scopes?: string[];
+    config?: Record<string, unknown>;
+};
 export declare function isWorkspaceProviderOAuthFlowValid(input: {
     flow: WorkspaceProviderOAuthFlow;
     state: OAuthStatePayload;
@@ -44,5 +48,8 @@ export declare function isWorkspaceProviderOAuthFlowValid(input: {
     sessionOrgId?: string;
     now?: number;
 }): boolean;
+export declare function canConnectWorkspaceProviderOAuth(orgId: string | null | undefined, role: string | null | undefined): boolean;
+export declare function scopedOAuthAccountId(provider: GenericWorkspaceOAuthProvider, owner: string, accountId: string): string;
 export declare function mergeWorkspaceOAuthValues(existing: readonly string[], incoming: readonly string[]): string[];
+export {};
 //# sourceMappingURL=workspace-provider-oauth.d.ts.map

package/dist/server/workspace-provider-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-provider-oauth.d.ts","sourceRoot":"","sources":["../../src/server/workspace-provider-oauth.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAEZ,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,2BAA2B,CAAC;AAUnC,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAG3B,MAAM,MAAM,6BAA6B,GAAG,OAAO,GAAG,cAAc,GAAG,QAAQ,CAAC;AAWhF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,6BAA6B,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,6BAA6B,EACvC,KAAK,EAAE,OAAO,GAAG,UAAU,GAC1B,MAAM,CAER;AAED,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,6BAA6B,EACvC,KAAK,EAAE,OAAO,GAAG,UAAU,qHAU5B;AAED,wBAAsB,iCAAiC,CACrD,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,6BAA6B,GACxC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmF7C;AAED,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,6BAA6B,GACxC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA0G7C;AAED,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,QAAQ,EAAE,2BAA2B,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAsBT;AAED,wBAAsB,kCAAkC,CAAC,KAAK,EAAE;IAC9D,UAAU,EAAE,6BAA6B,CAAC;IAC1C,QAAQ,EAAE,2BAA2B,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAkDnC;AAED,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,6BAA6B,EACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA4D/C;AA0BD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,IAAI,EAAE,0BAA0B,CAAC;IACjC,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,6BAA6B,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAYV;AA6DD,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,EAAE,CAEV"}
+{"version":3,"file":"workspace-provider-oauth.d.ts","sourceRoot":"","sources":["../../src/server/workspace-provider-oauth.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAEZ,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,2BAA2B,CAAC;AAWnC,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAG3B,MAAM,MAAM,6BAA6B,GACrC,OAAO,GACP,cAAc,GACd,QAAQ,GACR,SAAS,GACT,MAAM,GACN,QAAQ,GACR,QAAQ,CAAC;AAeb,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,6BAA6B,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,6BAA6B,EACvC,KAAK,EAAE,OAAO,GAAG,UAAU,GAC1B,MAAM,CAER;AAED,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,6BAA6B,EACvC,KAAK,EAAE,OAAO,GAAG,UAAU,qHAU5B;AAED,wBAAsB,iCAAiC,CACrD,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,6BAA6B,GACxC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgG7C;AAED,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,6BAA6B,GACxC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA2I7C;AAED,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,QAAQ,EAAE,2BAA2B,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CA6BT;AAED,wBAAsB,kCAAkC,CAAC,KAAK,EAAE;IAC9D,UAAU,EAAE,6BAA6B,CAAC;IAC1C,QAAQ,EAAE,2BAA2B,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoJnC;AAED,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,6BAA6B,EACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAWpC;AAED,wBAAsB,kCAAkC,CACtD,UAAU,EAAE,6BAA6B,EACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAwDtC;AAED,KAAK,yBAAyB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AA4JF,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,IAAI,EAAE,0BAA0B,CAAC;IACjC,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,6BAA6B,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAYV;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO,CAET;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,6BAA6B,EACvC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,MAAM,CAQR;AA0ED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,EAAE,CAEV"}

package/dist/server/workspace-provider-oauth.js

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import { deleteCookie, defineEventHandler, getCookie, getMethod, getQuery, setCookie, setResponseStatus, } from "h3";
 import { getWorkspaceConnectionProvider, } from "../connections/catalog.js";
 import { saveOAuthTokens, setOAuthDisplayName } from "../oauth-tokens/store.js";
+import { getOrgContext } from "../org/context.js";
 import { decryptSecretValue, encryptSecretValue } from "../secrets/crypto.js";
 import { listWorkspaceConnections, upsertWorkspaceConnection, upsertWorkspaceConnectionGrant, } from "../workspace-connections/store.js";
 import { getSession, safeReturnPath } from "./auth.js";
@@ -11,6 +12,10 @@ import { runWithRequestContext } from "./request-context.js";
 const SUPPORTED_PROVIDERS = new Set([
     "figma",
     "google_drive",
+    "github",
+    "hubspot",
+    "jira",
+    "sentry",
     "notion",
 ]);
 const FLOW_TTL_SECONDS = 10 * 60;
@@ -33,6 +38,19 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
     const session = await getSession(event).catch(() => null);
     if (!session?.email)
         return unauthorized(event);
+    const orgContext = await requireWorkspaceProviderOAuthAdmin(event);
+    if (!orgContext) {
+        return {
+            error: "Only organization owners and admins can connect shared OAuth accounts.",
+        };
+    }
+    const orgId = orgContext.orgId;
+    if (!orgId) {
+        setResponseStatus(event, 403);
+        return {
+            error: "Only organization owners and admins can connect shared OAuth accounts.",
+        };
+    }
     const provider = requiredProvider(providerId);
     const query = getQuery(event);
     const appId = normalizeAppId(text(query.appId) ??
@@ -44,11 +62,8 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
         setResponseStatus(event, 400);
         return { error: "Invalid OAuth redirect URI." };
     }
-    return runWithRequestContext({ userEmail: session.email, orgId: session.orgId }, async () => {
-        const [clientId, clientSecret] = await Promise.all([
-            resolveSecret(clientCredentialKey(providerId, "id")),
-            resolveSecret(clientCredentialKey(providerId, "secret")),
-        ]);
+    return runWithRequestContext({ userEmail: session.email, orgId }, async () => {
+        const [clientId, clientSecret] = await resolveProviderClientCredentials(providerId);
         if (!clientId || !clientSecret) {
             setResponseStatus(event, 503);
             return {
@@ -68,7 +83,7 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
         const state = encodeOAuthState({
             redirectUri,
             owner: session.email,
-            orgId: session.orgId,
+            orgId,
             app: appId,
             returnUrl,
             flowId,
@@ -79,7 +94,7 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
             verifier,
             redirectUri,
             owner: session.email,
-            ...(session.orgId ? { orgId: session.orgId } : {}),
+            orgId,
             appId,
             expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
         };
@@ -106,6 +121,19 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
     const session = await getSession(event).catch(() => null);
     if (!session?.email)
         return unauthorized(event);
+    const orgContext = await requireWorkspaceProviderOAuthAdmin(event);
+    if (!orgContext) {
+        return {
+            error: "Only organization owners and admins can connect shared OAuth accounts.",
+        };
+    }
+    const orgId = orgContext.orgId;
+    if (!orgId) {
+        setResponseStatus(event, 403);
+        return {
+            error: "Only organization owners and admins can connect shared OAuth accounts.",
+        };
+    }
     const query = getQuery(event);
     const code = text(query.code);
     const stateParam = text(query.state);
@@ -127,17 +155,14 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
             state,
             provider: providerId,
             sessionEmail: session.email,
-            sessionOrgId: session.orgId,
+            sessionOrgId: orgId,
         })) {
         setResponseStatus(event, 400);
         return { error: "OAuth state is invalid or expired." };
     }
     const provider = requiredProvider(providerId);
-    return runWithRequestContext({ userEmail: session.email, orgId: session.orgId }, async () => {
-        const [clientId, clientSecret] = await Promise.all([
-            resolveSecret(clientCredentialKey(providerId, "id")),
-            resolveSecret(clientCredentialKey(providerId, "secret")),
-        ]);
+    return runWithRequestContext({ userEmail: session.email, orgId }, async () => {
+        const [clientId, clientSecret] = await resolveProviderClientCredentials(providerId);
         if (!clientId || !clientSecret) {
             setResponseStatus(event, 503);
             return {
@@ -153,34 +178,48 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
             verifier: flow.verifier,
             redirectUri: flow.redirectUri,
         });
-        const identity = await resolveWorkspaceProviderIdentity(providerId, tokens);
-        await saveOAuthTokens(provider.oauth.provider, identity.accountId, tokens, session.email);
-        await setOAuthDisplayName(provider.oauth.provider, identity.accountId, identity.label);
-        const existing = (await listWorkspaceConnections({
+        const identities = await resolveWorkspaceProviderIdentities(providerId, tokens);
+        if (!identities.length) {
+            throw new Error(`${provider.label} OAuth did not return an accessible account.`);
+        }
+        const existingConnections = await listWorkspaceConnections({
             provider: providerId,
             includeDisabled: true,
-        })).find((connection) => connection.accountId === identity.accountId);
-        const scopes = mergeWorkspaceOAuthValues(existing?.scopes ?? [], tokenScopes(tokens, provider.oauth.scopes));
-        const connection = await upsertWorkspaceConnection({
-            ...(existing ? { id: existing.id } : {}),
-            provider: providerId,
-            label: `${provider.label}: ${identity.label}`,
-            accountId: identity.accountId,
-            accountLabel: identity.label,
-            status: "connected",
-            scopes,
-            allowedApps: existing?.allowedApps ?? [],
-            config: { credentialMode: "oauth" },
-            lastCheckedAt: new Date(),
-            lastError: null,
-        });
-        await upsertWorkspaceConnectionGrant({
-            connectionId: connection.id,
-            appId: flow.appId,
-            provider: providerId,
-            scopes,
-            config: { credentialMode: "oauth" },
         });
+        for (const identity of identities) {
+            const accountId = scopedOAuthAccountId(providerId, session.email, identity.accountId);
+            await saveOAuthTokens(provider.oauth.provider, accountId, tokens, session.email);
+            await setOAuthDisplayName(provider.oauth.provider, accountId, identity.label);
+            const existing = existingConnections.find((connection) => connection.accountId === accountId);
+            const scopes = mergeWorkspaceOAuthValues(existing?.scopes ?? [], identity.scopes ?? tokenScopes(tokens, provider.oauth.scopes));
+            const connectionConfig = {
+                credentialMode: "oauth",
+                ...(providerId === "hubspot" || providerId === "jira"
+                    ? { externalAccountId: identity.accountId }
+                    : {}),
+                ...(identity.config ?? {}),
+            };
+            const connection = await upsertWorkspaceConnection({
+                ...(existing ? { id: existing.id } : {}),
+                provider: providerId,
+                label: `${provider.label}: ${identity.label}`,
+                accountId,
+                accountLabel: identity.label,
+                status: "connected",
+                scopes,
+                allowedApps: existing?.allowedApps ?? [],
+                config: connectionConfig,
+                lastCheckedAt: new Date(),
+                lastError: null,
+            });
+            await upsertWorkspaceConnectionGrant({
+                connectionId: connection.id,
+                appId: flow.appId,
+                provider: providerId,
+                scopes,
+                config: connectionConfig,
+            });
+        }
         const returnPath = state.returnUrl ??
             `/settings/connections?connected=${encodeURIComponent(providerId)}`;
         return Response.redirect(getAppUrl(event, returnPath), 302);
@@ -194,10 +233,17 @@ export function buildWorkspaceProviderAuthorizationUrl(input) {
     url.searchParams.set("redirect_uri", input.redirectUri);
     url.searchParams.set("response_type", "code");
     url.searchParams.set("state", input.state);
-    if (input.provider.id === "figma") {
+    if (input.provider.id === "figma" || input.provider.id === "sentry") {
         url.searchParams.set("code_challenge", input.challenge);
         url.searchParams.set("code_challenge_method", "S256");
     }
+    if (input.provider.id === "github") {
+        url.searchParams.set("allow_signup", "true");
+    }
+    if (input.provider.id === "jira") {
+        url.searchParams.set("audience", "api.atlassian.com");
+        url.searchParams.set("prompt", "consent");
+    }
     if (input.provider.id === "google_drive") {
         url.searchParams.set("access_type", "offline");
         url.searchParams.set("include_granted_scopes", "true");
@@ -215,11 +261,91 @@ export async function exchangeWorkspaceProviderOAuthCode(input) {
     if (!tokenUrl)
         throw new Error("Provider does not support OAuth.");
     const authorization = `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString("base64")}`;
+    if (input.providerId === "github") {
+        const { response, body } = await fetchBoundedProviderJson(tokenUrl, {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                client_id: input.clientId,
+                client_secret: input.clientSecret,
+                code: input.code,
+                redirect_uri: input.redirectUri,
+            }),
+        }, input.provider.label);
+        const accessToken = text(body.access_token);
+        if (!response.ok || !accessToken) {
+            throw new Error(`${input.provider.label} OAuth token exchange failed (${response.status}).`);
+        }
+        return {
+            ...body,
+            ...(Number.isFinite(Number(body.expires_in)) &&
+                Number(body.expires_in) > 0
+                ? { expiry_date: Date.now() + Number(body.expires_in) * 1_000 }
+                : {}),
+        };
+    }
+    if (input.providerId === "hubspot") {
+        const { response, body } = await fetchBoundedProviderJson(tokenUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "authorization_code",
+                client_id: input.clientId,
+                client_secret: input.clientSecret,
+                code: input.code,
+                redirect_uri: input.redirectUri,
+            }),
+        }, input.provider.label);
+        const accessToken = text(body.access_token);
+        if (!response.ok || !accessToken) {
+            throw new Error(`${input.provider.label} OAuth token exchange failed (${response.status}).`);
+        }
+        return {
+            ...body,
+            ...(Number.isFinite(Number(body.expires_in)) &&
+                Number(body.expires_in) > 0
+                ? { expiry_date: Date.now() + Number(body.expires_in) * 1_000 }
+                : {}),
+        };
+    }
+    if (input.providerId === "jira") {
+        const { response, body } = await fetchBoundedProviderJsonValue(tokenUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                grant_type: "authorization_code",
+                client_id: input.clientId,
+                client_secret: input.clientSecret,
+                code: input.code,
+                redirect_uri: input.redirectUri,
+            }),
+        }, input.provider.label);
+        const tokenBody = record(body) ?? {};
+        const accessToken = text(tokenBody.access_token);
+        if (!response.ok || !accessToken) {
+            throw new Error(`${input.provider.label} OAuth token exchange failed (${response.status}).`);
+        }
+        const expiresIn = Number(tokenBody.expires_in);
+        return {
+            ...tokenBody,
+            ...(Number.isFinite(expiresIn) && expiresIn > 0
+                ? { expiry_date: Date.now() + expiresIn * 1_000 }
+                : {}),
+        };
+    }
     const fields = {
         grant_type: "authorization_code",
         code: input.code,
         redirect_uri: input.redirectUri,
-        ...(input.providerId === "figma" ? { code_verifier: input.verifier } : {}),
+        ...(input.providerId === "figma" || input.providerId === "sentry"
+            ? { code_verifier: input.verifier }
+            : {}),
+        ...(input.providerId === "sentry"
+            ? { client_id: input.clientId, client_secret: input.clientSecret }
+            : {}),
         ...(input.providerId === "google_drive"
             ? { client_id: input.clientId, client_secret: input.clientSecret }
             : {}),
@@ -255,6 +381,64 @@ export async function exchangeWorkspaceProviderOAuthCode(input) {
     };
 }
 export async function resolveWorkspaceProviderIdentity(providerId, tokens) {
+    const [identity] = await resolveWorkspaceProviderIdentities(providerId, tokens);
+    if (!identity) {
+        throw new Error(`${providerId} OAuth response did not identify an account.`);
+    }
+    return identity;
+}
+export async function resolveWorkspaceProviderIdentities(providerId, tokens) {
+    if (providerId === "jira") {
+        const accessToken = text(tokens.access_token);
+        if (!accessToken) {
+            throw new Error("Jira OAuth response did not include an access token.");
+        }
+        const { response, body } = await fetchBoundedProviderJsonValue("https://api.atlassian.com/oauth/token/accessible-resources", {
+            headers: {
+                Accept: "application/json",
+                Authorization: `Bearer ${accessToken}`,
+            },
+        }, "Jira");
+        if (!response.ok || !Array.isArray(body)) {
+            throw new Error("Jira OAuth response did not identify accessible sites.");
+        }
+        return body.flatMap((resource) => {
+            const entry = record(resource);
+            const cloudId = text(entry?.id);
+            const siteUrl = text(entry?.url);
+            if (!cloudId || !siteUrl)
+                return [];
+            let parsedUrl;
+            try {
+                parsedUrl = new URL(siteUrl);
+            }
+            catch {
+                return [];
+            }
+            if (parsedUrl.protocol !== "https:" ||
+                !parsedUrl.hostname.endsWith(".atlassian.net")) {
+                return [];
+            }
+            const scopes = Array.isArray(entry?.scopes)
+                ? entry.scopes.filter((scope) => typeof scope === "string")
+                : undefined;
+            return [
+                {
+                    accountId: cloudId,
+                    label: text(entry?.name) ?? parsedUrl.hostname,
+                    ...(scopes?.length ? { scopes } : {}),
+                    config: {
+                        atlassianCloudId: cloudId,
+                        atlassianApiBaseUrl: `https://api.atlassian.com/ex/jira/${encodeURIComponent(cloudId)}`,
+                        siteUrl: parsedUrl.origin,
+                    },
+                },
+            ];
+        });
+    }
+    return [await resolveWorkspaceProviderIdentitySingle(providerId, tokens)];
+}
+async function resolveWorkspaceProviderIdentitySingle(providerId, tokens) {
     if (providerId === "notion") {
         const owner = record(tokens.owner);
         const user = record(owner?.user);
@@ -272,6 +456,53 @@ export async function resolveWorkspaceProviderIdentity(providerId, tokens) {
                 "Notion workspace",
         };
     }
+    if (providerId === "github") {
+        const accessToken = text(tokens.access_token);
+        const { response, body: user } = await fetchBoundedProviderJson("https://api.github.com/user", {
+            headers: {
+                Accept: "application/vnd.github+json",
+                Authorization: `Bearer ${accessToken}`,
+                "X-GitHub-Api-Version": "2022-11-28",
+            },
+        }, "GitHub");
+        const accountId = text(user.login) ?? text(user.id);
+        if (!response.ok || !accountId) {
+            throw new Error("GitHub OAuth response did not identify the connected user.");
+        }
+        return {
+            accountId,
+            label: text(user.name) ?? text(user.login) ?? "GitHub account",
+        };
+    }
+    if (providerId === "hubspot") {
+        const accessToken = text(tokens.access_token);
+        const { response, body } = await fetchBoundedProviderJson(`https://api.hubapi.com/oauth/v1/access-tokens/${encodeURIComponent(accessToken)}`, { headers: { Accept: "application/json" } }, "HubSpot");
+        const accountId = scalarText(body.hub_id) ?? scalarText(body.user_id);
+        if (!response.ok || !accountId) {
+            throw new Error("HubSpot OAuth response did not identify the connected portal.");
+        }
+        return {
+            accountId,
+            label: text(body.hub_domain) ?? `HubSpot portal ${accountId}`,
+        };
+    }
+    if (providerId === "sentry") {
+        const accessToken = text(tokens.access_token);
+        const { response, body: user } = await fetchBoundedProviderJson("https://sentry.io/api/0/users/me/", {
+            headers: {
+                Accept: "application/json",
+                Authorization: `Bearer ${accessToken}`,
+            },
+        }, "Sentry");
+        const accountId = text(user.id);
+        if (!response.ok || !accountId) {
+            throw new Error("Sentry OAuth response did not identify the connected account.");
+        }
+        return {
+            accountId,
+            label: text(user?.email) ?? text(user?.name) ?? "Sentry account",
+        };
+    }
     if (providerId === "google_drive") {
         const accessToken = text(tokens.access_token);
         const { response, body } = await fetchBoundedProviderJson("https://www.googleapis.com/drive/v3/about?fields=user(displayName,emailAddress,permissionId)", { headers: { Authorization: `Bearer ${accessToken}` } }, "Google Drive");
@@ -326,7 +557,24 @@ export function isWorkspaceProviderOAuthFlowValid(input) {
         input.sessionOrgId === input.flow.orgId &&
         input.state.app === input.flow.appId);
 }
+export function canConnectWorkspaceProviderOAuth(orgId, role) {
+    return Boolean(orgId) && (role === "owner" || role === "admin");
+}
+export function scopedOAuthAccountId(provider, owner, accountId) {
+    if (provider !== "hubspot" && provider !== "jira")
+        return accountId;
+    const ownerKey = crypto
+        .createHash("sha256")
+        .update(`${provider}:${owner.trim().toLowerCase()}`)
+        .digest("hex")
+        .slice(0, 24);
+    return `${accountId}::${ownerKey}`;
+}
 async function fetchBoundedProviderJson(url, init, providerLabel) {
+    const { response, body } = await fetchBoundedProviderJsonValue(url, init, providerLabel);
+    return { response, body: record(body) ?? {} };
+}
+async function fetchBoundedProviderJsonValue(url, init, providerLabel) {
     let response;
     try {
         response = await fetch(url, {
@@ -369,7 +617,7 @@ async function fetchBoundedProviderJson(url, init, providerLabel) {
     try {
         const json = Buffer.concat(chunks).toString("utf8");
         const body = JSON.parse(json);
-        return { response, body: record(body) ?? {} };
+        return { response, body };
     }
     catch {
         return { response, body: {} };
@@ -382,9 +630,29 @@ function tokenScopes(tokens, fallback) {
 export function mergeWorkspaceOAuthValues(existing, incoming) {
     return [...new Set([...existing, ...incoming])];
 }
-function clientCredentialKey(provider, field) {
+function clientCredentialKeys(provider, field) {
     const prefix = provider === "google_drive" ? "GOOGLE" : provider.toUpperCase();
-    return `${prefix}_CLIENT_${field === "id" ? "ID" : "SECRET"}`;
+    const suffix = field === "id" ? "ID" : "SECRET";
+    if (provider === "github") {
+        const integrationPrefix = `GITHUB_INTEGRATION_CLIENT_${suffix}`;
+        return [integrationPrefix, `GITHUB_CLIENT_${suffix}`];
+    }
+    if (provider === "hubspot") {
+        const integrationPrefix = `HUBSPOT_INTEGRATION_CLIENT_${suffix}`;
+        return [integrationPrefix, `HUBSPOT_CLIENT_${suffix}`];
+    }
+    return [`${prefix}_CLIENT_${suffix}`];
+}
+async function resolveProviderClientCredentials(provider) {
+    const [clientId, clientSecret] = await Promise.all(["id", "secret"].map(async (field) => {
+        for (const key of clientCredentialKeys(provider, field)) {
+            const value = await resolveSecret(key);
+            if (value)
+                return value;
+        }
+        return null;
+    }));
+    return [clientId, clientSecret];
 }
 function flowCookieName(provider) {
     return `an_workspace_oauth_${provider}`;
@@ -399,6 +667,11 @@ function normalizeAppId(value) {
 function text(value) {
     return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
+function scalarText(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return String(value);
+    return text(value);
+}
 function record(value) {
     return value && typeof value === "object" && !Array.isArray(value)
         ? value
@@ -412,4 +685,13 @@ function unauthorized(event) {
     setResponseStatus(event, 401);
     return { error: "Authentication required" };
 }
+async function requireWorkspaceProviderOAuthAdmin(event) {
+    const context = await getOrgContext(event).catch(() => null);
+    if (!context ||
+        !canConnectWorkspaceProviderOAuth(context.orgId, context.role)) {
+        setResponseStatus(event, 403);
+        return null;
+    }
+    return context;
+}
 //# sourceMappingURL=workspace-provider-oauth.js.map