@agentlang/agentmanager 0.0.3

package/apps/integrations/src/generated/prisma-sqlite/models.ts

@@ -0,0 +1,12 @@
+
+/* !!! This is code generated by Prisma. Do not edit directly. !!! */
+/* eslint-disable */
+// biome-ignore-all lint: generated file
+// @ts-nocheck 
+/*
+ * This is a barrel export file for all models and their related types.
+ *
+ * 🟢 You can import this file directly.
+ */
+export type * from './models/IntegrationEntity'
+export type * from './commonInputTypes'

package/apps/integrations/src/integrations-core.module.ts

@@ -0,0 +1,52 @@
+import { Module, DynamicModule } from '@nestjs/common';
+import { RouterModule } from '@nestjs/core';
+import { AuthFlowModule } from './modules/auth-flow/auth-flow.module';
+import { ConnectionsModule } from './modules/connections/connections.module';
+import { CredentialsModule } from './modules/credentials/credentials.module';
+import { DiscoveryModule } from './modules/discovery/discovery.module';
+import { PlatformModule } from './modules/platform/platform.module';
+import { ProvidersModule } from './modules/providers/providers.module';
+import { TenantConfigModule } from './modules/tenant-config/tenant-config.module';
+
+const INTEGRATIONS_FEATURE_MODULES = [
+  PlatformModule,
+  CredentialsModule,
+  DiscoveryModule,
+  ProvidersModule,
+  TenantConfigModule,
+  ConnectionsModule,
+  AuthFlowModule,
+];
+
+@Module({})
+export class IntegrationsCoreModule {
+  static forRoot(routePrefix?: string): DynamicModule {
+    const imports: any[] = [...INTEGRATIONS_FEATURE_MODULES];
+    if (routePrefix) {
+      imports.unshift(
+        RouterModule.register([
+          {
+            path: routePrefix,
+            children: INTEGRATIONS_FEATURE_MODULES.map((module) => ({
+              path: '',
+              module,
+            })),
+          },
+        ]),
+      );
+    }
+
+    return {
+      module: IntegrationsCoreModule,
+      imports,
+      exports: [
+        PlatformModule,
+        DiscoveryModule,
+        ProvidersModule,
+        TenantConfigModule,
+        ConnectionsModule,
+        AuthFlowModule,
+      ],
+    };
+  }
+}

package/apps/integrations/src/main.ts

@@ -0,0 +1,63 @@
+import { Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { NestFactory } from '@nestjs/core';
+import {
+  FastifyAdapter,
+  NestFastifyApplication,
+} from '@nestjs/platform-fastify';
+import { SwaggerModule, DocumentBuilder } from '@nestjs/swagger';
+import { ZodValidationPipe } from 'nestjs-zod';
+import helmet from '@fastify/helmet';
+import { AppModule } from './app.module';
+
+async function bootstrap() {
+  const app = await NestFactory.create<NestFastifyApplication>(
+    AppModule,
+    new FastifyAdapter({ bodyLimit: 1_048_576 }),
+  );
+
+  await app.register(helmet as Parameters<typeof app.register>[0], {
+    contentSecurityPolicy: false,
+  });
+
+  app.enableCors({ origin: true });
+  app.enableShutdownHooks();
+  app.useGlobalPipes(new ZodValidationPipe());
+
+  const config = app.get(ConfigService);
+  const port = config.get<number>('port', 3006);
+  const shutdownTimeoutMs = config.get<number>('shutdownTimeoutMs', 5000);
+
+  const swaggerConfig = new DocumentBuilder()
+    .setTitle('Integrations Service')
+    .setVersion('1.0')
+    .addBearerAuth()
+    .build();
+  const document = SwaggerModule.createDocument(app, swaggerConfig);
+  SwaggerModule.setup('docs', app, document);
+
+  const logger = new Logger('Bootstrap');
+
+  const shutdown = async (signal: string) => {
+    logger.log(`Received ${signal}, starting graceful shutdown...`);
+    const timer = setTimeout(() => {
+      logger.error('Graceful shutdown timed out, forcing exit');
+      process.exit(1);
+    }, shutdownTimeoutMs);
+
+    try {
+      await app.close();
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+
+  process.on('SIGTERM', () => void shutdown('SIGTERM'));
+  process.on('SIGINT', () => void shutdown('SIGINT'));
+
+  await app.listen(port, '0.0.0.0');
+
+  logger.log(`Integrations listening on port ${port}`);
+}
+
+void bootstrap();

package/apps/integrations/src/modules/auth-flow/auth-flow.module.ts

@@ -0,0 +1,21 @@
+import { Module } from '@nestjs/common';
+import { ConnectionsModule } from '../connections/connections.module';
+import { CredentialsModule } from '../credentials/credentials.module';
+import { PlatformModule } from '../platform/platform.module';
+import { ProvidersModule } from '../providers/providers.module';
+import { TenantConfigModule } from '../tenant-config/tenant-config.module';
+import { AuthFlowService } from './auth-flow.service';
+import { AuthStateSchedulerService } from './scheduler.service';
+
+@Module({
+  imports: [
+    PlatformModule,
+    ProvidersModule,
+    CredentialsModule,
+    TenantConfigModule,
+    ConnectionsModule,
+  ],
+  providers: [AuthFlowService, AuthStateSchedulerService],
+  exports: [AuthFlowService],
+})
+export class AuthFlowModule {}

package/apps/integrations/src/modules/auth-flow/auth-flow.service.ts

@@ -0,0 +1,275 @@
+import {
+  BadRequestException,
+  Injectable,
+  Logger,
+  NotFoundException,
+} from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { randomBytes } from 'node:crypto';
+import { EncryptionService } from '../credentials/encryption.service';
+import { TokenStoreService } from '../credentials/token-store.service';
+import { ConnectionsService } from '../connections/connections.service';
+import { MetadataStoreService } from '../platform/metadata-store.service';
+import { ProviderRegistry } from '../providers/provider.registry';
+import {
+  AuthStateData,
+  ConnectionStatus,
+  TokenSet,
+} from '../providers/provider.types';
+import { TenantConfigService } from '../tenant-config/tenant-config.service';
+import { AppConfiguration } from '../../config/configuration';
+
+export interface InitiateAuthInput {
+  providerId: string;
+  tenantId: string;
+  redirectUri: string;
+  scopes?: string[];
+  userId?: string;
+}
+
+export interface InitiateAuthResult {
+  authorizeUrl: string;
+  connectionId: string;
+  state: string;
+}
+
+export interface CompleteAuthInput {
+  state: string;
+  code: string;
+}
+
+export interface CompleteAuthResult {
+  connectionId: string;
+  providerId: string;
+  status: ConnectionStatus;
+}
+
+@Injectable()
+export class AuthFlowService {
+  private readonly logger = new Logger(AuthFlowService.name);
+  private readonly authStateTtlMs: number;
+  private readonly refreshInFlight = new Map<string, Promise<TokenSet>>();
+
+  public constructor(
+    private readonly providerRegistry: ProviderRegistry,
+    private readonly tenantConfig: TenantConfigService,
+    private readonly connections: ConnectionsService,
+    private readonly tokenStore: TokenStoreService,
+    private readonly encryption: EncryptionService,
+    private readonly metadataStore: MetadataStoreService,
+    private readonly configService: ConfigService<AppConfiguration>,
+  ) {
+    this.authStateTtlMs =
+      this.configService.get<number>('authStateTtlMs', { infer: true }) ??
+      600000;
+  }
+
+  public async initiateAuth(
+    input: InitiateAuthInput,
+  ): Promise<InitiateAuthResult> {
+    const provider = this.providerRegistry.get(input.providerId);
+    const config = await this.tenantConfig.getFullConfig(
+      input.tenantId,
+      input.providerId,
+    );
+
+    const clientSecret = this.tenantConfig.decryptClientSecret(config);
+    const scopes = this.tenantConfig.resolveScopes(
+      input.scopes,
+      config.scopes,
+      provider.metadata.defaultScopes,
+    );
+
+    const connection = await this.connections.create({
+      tenantId: input.tenantId,
+      providerId: input.providerId,
+      userId: input.userId,
+      status: ConnectionStatus.Pending,
+    });
+
+    const codeVerifier = randomBytes(32).toString('hex');
+
+    const result = await provider.initiateAuth({
+      providerId: input.providerId,
+      tenantId: input.tenantId,
+      connectionId: connection.id,
+      redirectUri: input.redirectUri,
+      scopes,
+      clientId: config.clientId,
+      clientSecret,
+      codeVerifier,
+    });
+
+    const encryptedSecret = this.encryption.encrypt(clientSecret);
+
+    const authState: AuthStateData = {
+      id: result.state,
+      connectionId: connection.id,
+      tenantId: input.tenantId,
+      providerId: input.providerId,
+      state: result.state,
+      codeVerifier: result.codeVerifier,
+      redirectUri: input.redirectUri,
+      clientId: config.clientId,
+      encryptedClientSecret: encryptedSecret.ciphertext,
+      clientSecretIv: encryptedSecret.iv,
+      clientSecretAuthTag: encryptedSecret.authTag,
+      scopes,
+      expiresAt: new Date(Date.now() + this.authStateTtlMs).toISOString(),
+      createdAt: new Date().toISOString(),
+    };
+
+    await this.metadataStore.upsert('AuthState', authState);
+
+    return {
+      authorizeUrl: result.authorizeUrl,
+      connectionId: connection.id,
+      state: result.state,
+    };
+  }
+
+  public async completeAuth(
+    input: CompleteAuthInput,
+  ): Promise<CompleteAuthResult> {
+    const stateRecord = await this.metadataStore.getById(
+      'AuthState',
+      input.state,
+    );
+    if (!stateRecord) {
+      throw new NotFoundException('Auth state not found or expired');
+    }
+
+    const authState = stateRecord as unknown as AuthStateData;
+
+    if (new Date(authState.expiresAt) < new Date()) {
+      await this.metadataStore.remove('AuthState', input.state);
+      throw new BadRequestException('Auth state has expired');
+    }
+
+    const provider = this.providerRegistry.get(authState.providerId);
+    const clientSecret = this.encryption.decrypt(
+      authState.encryptedClientSecret,
+      authState.clientSecretIv,
+      authState.clientSecretAuthTag,
+    );
+
+    const result = await provider.completeAuth({
+      providerId: authState.providerId,
+      tenantId: authState.tenantId,
+      connectionId: authState.connectionId,
+      redirectUri: authState.redirectUri,
+      code: input.code,
+      clientId: authState.clientId,
+      clientSecret,
+      codeVerifier: authState.codeVerifier,
+    });
+
+    await this.tokenStore.store(
+      authState.connectionId,
+      authState.tenantId,
+      authState.providerId,
+      result.tokenSet,
+    );
+
+    await this.connections.updateStatus(
+      authState.connectionId,
+      ConnectionStatus.Active,
+    );
+
+    await this.metadataStore.remove('AuthState', input.state);
+
+    return {
+      connectionId: authState.connectionId,
+      providerId: authState.providerId,
+      status: ConnectionStatus.Active,
+    };
+  }
+
+  public async refreshCredentials(connectionId: string): Promise<TokenSet> {
+    const existing = this.refreshInFlight.get(connectionId);
+    if (existing) {
+      return existing;
+    }
+
+    const promise = this.doRefresh(connectionId).finally(() => {
+      this.refreshInFlight.delete(connectionId);
+    });
+    this.refreshInFlight.set(connectionId, promise);
+    return promise;
+  }
+
+  private async doRefresh(connectionId: string): Promise<TokenSet> {
+    const connection = await this.connections.getById(connectionId);
+    const tokenSet = await this.tokenStore.retrieve(connectionId);
+
+    if (!tokenSet.refreshToken) {
+      throw new BadRequestException('No refresh token available');
+    }
+
+    const provider = this.providerRegistry.get(connection.providerId);
+    const config = await this.tenantConfig.getFullConfig(
+      connection.tenantId,
+      connection.providerId,
+    );
+    const clientSecret = this.tenantConfig.decryptClientSecret(config);
+
+    const newTokenSet = await provider.refreshToken(
+      tokenSet.refreshToken,
+      config.clientId,
+      clientSecret,
+    );
+
+    await this.tokenStore.store(
+      connectionId,
+      connection.tenantId,
+      connection.providerId,
+      newTokenSet,
+    );
+
+    await this.connections.updateStatus(connectionId, ConnectionStatus.Active);
+
+    return newTokenSet;
+  }
+
+  public async revokeCredentials(connectionId: string): Promise<void> {
+    const connection = await this.connections.getById(connectionId);
+
+    try {
+      const tokenSet = await this.tokenStore.retrieve(connectionId);
+      const provider = this.providerRegistry.get(connection.providerId);
+      const config = await this.tenantConfig.getFullConfig(
+        connection.tenantId,
+        connection.providerId,
+      );
+      const clientSecret = this.tenantConfig.decryptClientSecret(config);
+
+      await provider.revokeToken(
+        tokenSet.accessToken,
+        config.clientId,
+        clientSecret,
+      );
+    } catch (error) {
+      this.logger.warn(
+        `Failed to revoke token for connection ${connectionId}: ${error}`,
+      );
+    }
+
+    await this.tokenStore.remove(connectionId);
+    await this.connections.updateStatus(connectionId, ConnectionStatus.Revoked);
+  }
+
+  public async validateCredentials(
+    connectionId: string,
+  ): Promise<{ valid: boolean; expiresAt?: number }> {
+    const tokenSet = await this.tokenStore.retrieve(connectionId);
+
+    if (!tokenSet.expiresAt) {
+      return { valid: true };
+    }
+
+    const now = Math.floor(Date.now() / 1000);
+    const valid = tokenSet.expiresAt > now;
+
+    return { valid, expiresAt: tokenSet.expiresAt };
+  }
+}

package/apps/integrations/src/modules/auth-flow/dto/auth-flow.dto.ts

@@ -0,0 +1,36 @@
+import { createZodDto } from 'nestjs-zod';
+import { z } from 'zod';
+
+export const InitiateAuthSchema = z.object({
+  providerId: z.string().min(1),
+  tenantId: z.string().min(1),
+  redirectUri: z.string().url(),
+  scopes: z.array(z.string()).optional(),
+  userId: z.string().optional(),
+});
+
+export const CompleteAuthSchema = z.object({
+  state: z.string().min(1),
+  code: z.string().min(1),
+});
+
+export const RefreshAuthSchema = z.object({
+  connectionId: z.string().min(1),
+});
+
+export const RevokeAuthSchema = z.object({
+  connectionId: z.string().min(1),
+});
+
+export const ValidateAuthSchema = z.object({
+  connectionId: z.string().min(1),
+});
+
+export class InitiateAuthDto extends createZodDto(InitiateAuthSchema) {}
+export class CompleteAuthDto extends createZodDto(CompleteAuthSchema) {}
+export class RefreshAuthDto extends createZodDto(RefreshAuthSchema) {}
+export class RevokeAuthDto extends createZodDto(RevokeAuthSchema) {}
+export class ValidateAuthDto extends createZodDto(ValidateAuthSchema) {}
+
+export type InitiateAuthInput = z.infer<typeof InitiateAuthSchema>;
+export type CompleteAuthInput = z.infer<typeof CompleteAuthSchema>;

package/apps/integrations/src/modules/auth-flow/scheduler.service.ts

@@ -0,0 +1,73 @@
+import {
+  Injectable,
+  Logger,
+  OnModuleDestroy,
+  OnModuleInit,
+} from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { MetadataStoreService } from '../platform/metadata-store.service';
+import { AuthStateData } from '../providers/provider.types';
+import { AppConfiguration } from '../../config/configuration';
+
+@Injectable()
+export class AuthStateSchedulerService
+  implements OnModuleInit, OnModuleDestroy
+{
+  private readonly logger = new Logger(AuthStateSchedulerService.name);
+  private intervalHandle: ReturnType<typeof setInterval> | null = null;
+
+  public constructor(
+    private readonly configService: ConfigService<AppConfiguration>,
+    private readonly metadataStore: MetadataStoreService,
+  ) {}
+
+  public onModuleInit() {
+    const enabled =
+      this.configService.get<boolean>('schedulerEnabled', { infer: true }) ??
+      true;
+
+    if (!enabled) {
+      this.logger.log('Auth state cleanup scheduler is disabled');
+      return;
+    }
+
+    const intervalMs =
+      this.configService.get<number>('schedulerIntervalMs', { infer: true }) ??
+      300000;
+
+    this.logger.log(
+      `Starting auth state cleanup scheduler (interval=${intervalMs}ms)`,
+    );
+
+    this.intervalHandle = setInterval(() => {
+      void this.cleanExpiredAuthStates();
+    }, intervalMs);
+  }
+
+  public onModuleDestroy() {
+    if (this.intervalHandle) {
+      clearInterval(this.intervalHandle);
+      this.intervalHandle = null;
+    }
+  }
+
+  public async cleanExpiredAuthStates(): Promise<number> {
+    const states = await this.metadataStore.list('AuthState');
+    const now = new Date();
+    let cleaned = 0;
+
+    for (const state of states) {
+      const authState = state as unknown as AuthStateData;
+      if (authState.expiresAt && new Date(authState.expiresAt) < now) {
+        await this.metadataStore.remove('AuthState', authState.id);
+        cleaned++;
+      }
+    }
+
+    if (cleaned > 0) {
+      this.logger.log(`Cleaned ${cleaned} expired auth state(s)`);
+    }
+
+    return cleaned;
+  }
+}

package/apps/integrations/src/modules/connections/connections.module.ts

@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+import { CredentialsModule } from '../credentials/credentials.module';
+import { PlatformModule } from '../platform/platform.module';
+import { ConnectionsService } from './connections.service';
+
+@Module({
+  imports: [PlatformModule, CredentialsModule],
+  providers: [ConnectionsService],
+  exports: [ConnectionsService],
+})
+export class ConnectionsModule {}

package/apps/integrations/src/modules/connections/connections.service.ts

@@ -0,0 +1,109 @@
+import { Injectable, Logger, NotFoundException } from '@nestjs/common';
+import { randomUUID } from 'node:crypto';
+import { TokenStoreService } from '../credentials/token-store.service';
+import { MetadataStoreService } from '../platform/metadata-store.service';
+import { ConnectionData, ConnectionStatus } from '../providers/provider.types';
+
+export interface CreateConnectionInput {
+  tenantId: string;
+  providerId: string;
+  userId?: string;
+  status?: ConnectionStatus;
+  metadata?: Record<string, unknown>;
+}
+
+export interface ListConnectionsFilters {
+  tenantId?: string;
+  providerId?: string;
+  status?: string;
+  limit?: number;
+  offset?: number;
+}
+
+@Injectable()
+export class ConnectionsService {
+  private readonly logger = new Logger(ConnectionsService.name);
+
+  public constructor(
+    private readonly metadataStore: MetadataStoreService,
+    private readonly tokenStore: TokenStoreService,
+  ) {}
+
+  public async create(input: CreateConnectionInput): Promise<ConnectionData> {
+    const now = new Date().toISOString();
+
+    const connection: ConnectionData = {
+      id: randomUUID(),
+      tenantId: input.tenantId,
+      providerId: input.providerId,
+      userId: input.userId,
+      status: input.status ?? ConnectionStatus.Pending,
+      metadata: input.metadata,
+      createdAt: now,
+      updatedAt: now,
+    };
+
+    await this.metadataStore.upsert('Connection', connection);
+    return connection;
+  }
+
+  public async getById(id: string): Promise<ConnectionData> {
+    const record = await this.metadataStore.getById('Connection', id);
+    if (!record) {
+      throw new NotFoundException(`Connection/${id} not found`);
+    }
+
+    return record as unknown as ConnectionData;
+  }
+
+  public async list(
+    filters: ListConnectionsFilters,
+  ): Promise<ConnectionData[]> {
+    const queryFilters: Record<string, string> = {};
+
+    if (filters.tenantId) {
+      queryFilters.tenantId = filters.tenantId;
+    }
+    if (filters.providerId) {
+      queryFilters.providerId = filters.providerId;
+    }
+    if (filters.status) {
+      queryFilters.status = filters.status;
+    }
+
+    const records = await this.metadataStore.list('Connection', {
+      filters: Object.keys(queryFilters).length > 0 ? queryFilters : undefined,
+      limit: filters.limit,
+      offset: filters.offset,
+    });
+
+    return records as unknown as ConnectionData[];
+  }
+
+  public async updateStatus(
+    id: string,
+    status: ConnectionStatus,
+  ): Promise<ConnectionData> {
+    const connection = await this.getById(id);
+
+    const updated: ConnectionData = {
+      ...connection,
+      status,
+      updatedAt: new Date().toISOString(),
+    };
+
+    await this.metadataStore.upsert('Connection', updated);
+    return updated;
+  }
+
+  public async remove(id: string): Promise<{ success: boolean; id: string }> {
+    await this.tokenStore.remove(id).catch((err) => {
+      this.logger.warn(
+        `Failed to remove credentials for connection ${id}: ${String(err)}`,
+      );
+    });
+    const deleted = await this.metadataStore.remove('Connection', id);
+
+    return { success: deleted, id };
+  }
+}

package/apps/integrations/src/modules/credentials/credentials.module.ts

@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+import { PlatformModule } from '../platform/platform.module';
+import { EncryptionService } from './encryption.service';
+import { TokenStoreService } from './token-store.service';
+
+@Module({
+  imports: [PlatformModule],
+  providers: [EncryptionService, TokenStoreService],
+  exports: [EncryptionService, TokenStoreService],
+})
+export class CredentialsModule {}