@agentlang/agentmanager 0.0.3

package/apps/integrations/src/modules/credentials/encryption.service.ts

@@ -0,0 +1,71 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  randomBytes,
+} from 'node:crypto';
+import { AppConfiguration } from '../../config/configuration';
+
+export interface EncryptedPayload {
+  ciphertext: string;
+  iv: string;
+  authTag: string;
+}
+
+@Injectable()
+export class EncryptionService {
+  private readonly logger = new Logger(EncryptionService.name);
+  private readonly key: Buffer;
+
+  public constructor(configService: ConfigService<AppConfiguration>) {
+    const rawKey = configService.get<string>('encryptionKey', { infer: true });
+    if (!rawKey) {
+      this.logger.warn(
+        'ENCRYPTION_KEY not set — using default dev key. Do NOT use this in production!',
+      );
+    }
+    this.key = createHash('sha256')
+      .update(rawKey ?? 'default-dev-encryption-key-change-me')
+      .digest();
+  }
+
+  public encrypt(plaintext: string): EncryptedPayload {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', this.key, iv);
+
+    const encrypted = Buffer.concat([
+      cipher.update(plaintext, 'utf8'),
+      cipher.final(),
+    ]);
+
+    return {
+      ciphertext: encrypted.toString('base64'),
+      iv: iv.toString('base64'),
+      authTag: cipher.getAuthTag().toString('base64'),
+    };
+  }
+
+  public decrypt(ciphertext: string, iv: string, authTag: string): string {
+    try {
+      const decipher = createDecipheriv(
+        'aes-256-gcm',
+        this.key,
+        Buffer.from(iv, 'base64'),
+      );
+      decipher.setAuthTag(Buffer.from(authTag, 'base64'));
+
+      const decrypted = Buffer.concat([
+        decipher.update(Buffer.from(ciphertext, 'base64')),
+        decipher.final(),
+      ]);
+
+      return decrypted.toString('utf8');
+    } catch (error) {
+      throw new Error(
+        `Decryption failed — data may be corrupted or the encryption key may have changed: ${String(error)}`,
+      );
+    }
+  }
+}

package/apps/integrations/src/modules/credentials/token-store.service.ts

@@ -0,0 +1,82 @@
+import {
+  Injectable,
+  InternalServerErrorException,
+  Logger,
+  NotFoundException,
+} from '@nestjs/common';
+import { MetadataStoreService } from '../platform/metadata-store.service';
+import { CredentialData, TokenSet } from '../providers/provider.types';
+import { EncryptionService } from './encryption.service';
+
+@Injectable()
+export class TokenStoreService {
+  private readonly logger = new Logger(TokenStoreService.name);
+
+  public constructor(
+    private readonly metadataStore: MetadataStoreService,
+    private readonly encryption: EncryptionService,
+  ) {}
+
+  public async store(
+    connectionId: string,
+    tenantId: string,
+    providerId: string,
+    tokenSet: TokenSet,
+  ): Promise<void> {
+    this.logger.debug(
+      `Storing credentials for connection=${connectionId} provider=${providerId}`,
+    );
+    const plaintext = JSON.stringify(tokenSet);
+    const encrypted = this.encryption.encrypt(plaintext);
+    const now = new Date().toISOString();
+
+    const credential: CredentialData = {
+      id: connectionId,
+      connectionId,
+      tenantId,
+      providerId,
+      encryptedTokenSet: encrypted.ciphertext,
+      iv: encrypted.iv,
+      authTag: encrypted.authTag,
+      createdAt: now,
+      updatedAt: now,
+    };
+
+    await this.metadataStore.upsert('Credential', credential);
+  }
+
+  public async retrieve(connectionId: string): Promise<TokenSet> {
+    this.logger.debug(`Retrieving credentials for connection=${connectionId}`);
+    const record = await this.metadataStore.getById('Credential', connectionId);
+
+    if (!record) {
+      throw new NotFoundException(
+        `Credentials not found for connection ${connectionId}`,
+      );
+    }
+
+    const credential = record as unknown as CredentialData;
+
+    try {
+      const plaintext = this.encryption.decrypt(
+        credential.encryptedTokenSet,
+        credential.iv,
+        credential.authTag,
+      );
+
+      return JSON.parse(plaintext) as TokenSet;
+    } catch (error) {
+      this.logger.error(
+        `Failed to decrypt credentials for connection ${connectionId}: ${error}`,
+      );
+      throw new InternalServerErrorException(
+        `Failed to decrypt credentials for connection ${connectionId}`,
+      );
+    }
+  }
+
+  public async remove(connectionId: string): Promise<boolean> {
+    this.logger.debug(`Removing credentials for connection=${connectionId}`);
+    return this.metadataStore.remove('Credential', connectionId);
+  }
+}

package/apps/integrations/src/modules/discovery/discovery.module.ts

@@ -0,0 +1,8 @@
+import { Module } from '@nestjs/common';
+import { OidcDiscoveryService } from './oidc-discovery.service';
+
+@Module({
+  providers: [OidcDiscoveryService],
+  exports: [OidcDiscoveryService],
+})
+export class DiscoveryModule {}

package/apps/integrations/src/modules/discovery/oidc-discovery.service.ts

@@ -0,0 +1,114 @@
+import { Injectable, Logger, OnModuleDestroy } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { resilientFetch } from '../platform/resilient-fetch';
+import {
+  AuthStrategy,
+  ProviderDefinitionData,
+  ScopeDefinition,
+} from '../providers/provider.types';
+import { AppConfiguration } from '../../config/configuration';
+
+export interface OidcDiscoveryDocument {
+  issuer: string;
+  authorization_endpoint: string;
+  token_endpoint: string;
+  userinfo_endpoint?: string;
+  revocation_endpoint?: string;
+  jwks_uri?: string;
+  scopes_supported?: string[];
+  response_types_supported?: string[];
+  grant_types_supported?: string[];
+}
+
+interface CacheEntry {
+  document: OidcDiscoveryDocument;
+  fetchedAt: number;
+}
+
+@Injectable()
+export class OidcDiscoveryService implements OnModuleDestroy {
+  private readonly logger = new Logger(OidcDiscoveryService.name);
+  private readonly cache = new Map<string, CacheEntry>();
+  private readonly cacheTtlMs: number;
+
+  public constructor(
+    private readonly configService: ConfigService<AppConfiguration>,
+  ) {
+    this.cacheTtlMs =
+      this.configService.get<number>('oidcCacheTtlMs', { infer: true }) ??
+      3600000;
+  }
+
+  public onModuleDestroy() {
+    this.cache.clear();
+  }
+
+  public async discover(issuerUrl: string): Promise<OidcDiscoveryDocument> {
+    const cached = this.cache.get(issuerUrl);
+    if (cached && Date.now() - cached.fetchedAt < this.cacheTtlMs) {
+      return cached.document;
+    }
+
+    const wellKnownUrl =
+      issuerUrl.replace(/\/$/, '') + '/.well-known/openid-configuration';
+
+    this.logger.log(`Fetching OIDC discovery: ${wellKnownUrl}`);
+
+    const fetchOptions = {
+      timeoutMs:
+        this.configService.get<number>('httpTimeoutMs', { infer: true }) ??
+        30000,
+      maxRetries:
+        this.configService.get<number>('httpMaxRetries', { infer: true }) ?? 3,
+    };
+
+    const response = await resilientFetch(
+      wellKnownUrl,
+      undefined,
+      fetchOptions,
+    );
+
+    if (!response.ok) {
+      throw new Error(
+        `OIDC discovery failed for ${issuerUrl}: ${response.status} ${response.statusText}`,
+      );
+    }
+
+    let document: OidcDiscoveryDocument;
+    try {
+      document = (await response.json()) as OidcDiscoveryDocument;
+    } catch {
+      throw new Error(`OIDC discovery returned invalid JSON for ${issuerUrl}`);
+    }
+
+    this.cache.set(issuerUrl, { document, fetchedAt: Date.now() });
+
+    return document;
+  }
+
+  public async buildProviderDefinition(
+    issuerUrl: string,
+  ): Promise<Partial<ProviderDefinitionData>> {
+    const doc = await this.discover(issuerUrl);
+
+    const defaultScopes: ScopeDefinition[] = (doc.scopes_supported ?? []).map(
+      (scope) => ({
+        name: scope,
+        required: scope === 'openid',
+      }),
+    );
+
+    return {
+      authStrategy: AuthStrategy.OIDC,
+      oidc: { issuerUrl },
+      oauth2: {
+        authorizeUrl: doc.authorization_endpoint,
+        tokenUrl: doc.token_endpoint,
+        revokeUrl: doc.revocation_endpoint,
+        userinfoUrl: doc.userinfo_endpoint,
+        usePkce: true,
+      },
+      defaultScopes,
+    };
+  }
+}

package/apps/integrations/src/modules/platform/metadata-store.service.ts

@@ -0,0 +1,337 @@
+import { Injectable, Logger, OnModuleDestroy } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { PrismaPg } from '@prisma/adapter-pg';
+import { PrismaBetterSqlite3 } from '@prisma/adapter-better-sqlite3';
+import type { Prisma as PgPrisma } from '../../generated/prisma-postgres/client';
+import { PrismaClient as PostgresPrismaClient } from '../../generated/prisma-postgres/client';
+import type { Prisma as SqlitePrisma } from '../../generated/prisma-sqlite/client';
+import { PrismaClient as SqlitePrismaClient } from '../../generated/prisma-sqlite/client';
+import { AppConfiguration } from '../../config/configuration';
+import { ListEntitiesOptions, StoredEntity } from './platform.types';
+
+@Injectable()
+export class MetadataStoreService implements OnModuleDestroy {
+  private readonly logger = new Logger(MetadataStoreService.name);
+  private readonly storeType: 'sqlite' | 'postgres';
+  private readonly sqlitePath: string;
+  private readonly defaultListLimit: number;
+
+  private readonly postgresPrisma: PostgresPrismaClient | null;
+  private readonly sqlitePrisma: SqlitePrismaClient | null;
+
+  public constructor(
+    private readonly configService: ConfigService<AppConfiguration>,
+  ) {
+    const storeType = this.configService.get<'sqlite' | 'postgres'>(
+      'storeType',
+      {
+        infer: true,
+      },
+    );
+
+    this.storeType = storeType === 'postgres' ? 'postgres' : 'sqlite';
+    this.defaultListLimit =
+      this.configService.get<number>('defaultListLimit', { infer: true }) ??
+      500;
+
+    if (this.storeType === 'postgres') {
+      this.sqlitePath = '';
+      const adapter = new PrismaPg({
+        connectionString: this.buildPostgresUrl(),
+      });
+      this.postgresPrisma = new PostgresPrismaClient({ adapter });
+      this.sqlitePrisma = null;
+      return;
+    }
+
+    const sqlitePath = this.configService.get<string>('sqlitePath', {
+      infer: true,
+    });
+    this.sqlitePath = sqlitePath ?? './.integrations/integrations.sqlite';
+    mkdirSync(dirname(this.sqlitePath), { recursive: true });
+
+    const adapter = new PrismaBetterSqlite3({
+      url: this.buildSqliteUrl(this.sqlitePath),
+    });
+    this.sqlitePrisma = new SqlitePrismaClient({ adapter });
+    this.postgresPrisma = null;
+  }
+
+  public async onModuleDestroy() {
+    if (this.postgresPrisma) {
+      await this.postgresPrisma.$disconnect();
+    }
+
+    if (this.sqlitePrisma) {
+      await this.sqlitePrisma.$disconnect();
+    }
+  }
+
+  public async health() {
+    if (this.postgresPrisma) {
+      await this.postgresPrisma.integrationEntity.count();
+      return { storeType: this.storeType, status: 'ok' };
+    }
+
+    await this.sqlitePrisma?.integrationEntity.count();
+    return { storeType: this.storeType, status: 'ok' };
+  }
+
+  public async getById(
+    entity: string,
+    id: string,
+  ): Promise<StoredEntity | null> {
+    this.logger.debug(`getById entity=${entity} id=${id}`);
+
+    if (this.postgresPrisma) {
+      const row = await this.postgresPrisma.integrationEntity.findUnique({
+        where: {
+          entity_id: {
+            entity,
+            id,
+          },
+        },
+      });
+
+      return row ? this.deserialize(row.data) : null;
+    }
+
+    const row = await this.sqlitePrisma?.integrationEntity.findUnique({
+      where: {
+        entity_id: {
+          entity,
+          id,
+        },
+      },
+    });
+
+    return row ? this.deserialize(row.data) : null;
+  }
+
+  public async list(
+    entity: string,
+    options: ListEntitiesOptions = {},
+  ): Promise<StoredEntity[]> {
+    this.logger.debug(
+      `list entity=${entity} filters=${JSON.stringify(options.filters ?? {})}`,
+    );
+    const where = this.buildWhere(entity, options.filters ?? {});
+    const hasUnknownFilter = Object.keys(options.filters ?? {}).some(
+      (key) => !this.isIndexedFilterKey(key),
+    );
+
+    if (hasUnknownFilter) {
+      this.logger.warn(
+        `In-memory filtering triggered for entity=${entity} — non-indexed filter keys: ${Object.keys(
+          options.filters ?? {},
+        )
+          .filter((k) => !this.isIndexedFilterKey(k))
+          .join(', ')}`,
+      );
+    }
+
+    const limit = options.limit ?? this.defaultListLimit;
+
+    const rows = this.postgresPrisma
+      ? await this.postgresPrisma.integrationEntity.findMany({
+          where,
+          orderBy: { updatedAt: 'desc' },
+          ...(hasUnknownFilter
+            ? {}
+            : {
+                skip: options.offset ?? 0,
+                take: limit,
+              }),
+        })
+      : await this.sqlitePrisma?.integrationEntity.findMany({
+          where,
+          orderBy: { updatedAt: 'desc' },
+          ...(hasUnknownFilter
+            ? {}
+            : {
+                skip: options.offset ?? 0,
+                take: limit,
+              }),
+        });
+
+    const decoded = (rows ?? []).map((row) => this.deserialize(row.data));
+    const filtered = hasUnknownFilter
+      ? this.filterInMemory(decoded, options.filters ?? {})
+      : decoded;
+
+    if (hasUnknownFilter) {
+      const offset = options.offset ?? 0;
+      const sliceLimit = options.limit ?? filtered.length;
+      return filtered.slice(offset, offset + sliceLimit);
+    }
+
+    return filtered;
+  }
+
+  public async upsert(
+    entity: string,
+    payload: StoredEntity,
+  ): Promise<StoredEntity> {
+    this.logger.debug(`upsert entity=${entity} id=${payload.id}`);
+    const indexed = this.extractIndexedFields(payload);
+
+    if (this.postgresPrisma) {
+      await this.postgresPrisma.integrationEntity.upsert({
+        where: {
+          entity_id: {
+            entity,
+            id: payload.id,
+          },
+        },
+        create: {
+          entity,
+          id: payload.id,
+          tenantId: indexed.tenantId,
+          providerId: indexed.providerId,
+          connectionId: indexed.connectionId,
+          status: indexed.status,
+          data: payload as unknown as PgPrisma.InputJsonValue,
+        },
+        update: {
+          tenantId: indexed.tenantId,
+          providerId: indexed.providerId,
+          connectionId: indexed.connectionId,
+          status: indexed.status,
+          data: payload as unknown as PgPrisma.InputJsonValue,
+        },
+      });
+
+      return payload;
+    }
+
+    await this.sqlitePrisma?.integrationEntity.upsert({
+      where: {
+        entity_id: {
+          entity,
+          id: payload.id,
+        },
+      },
+      create: {
+        entity,
+        id: payload.id,
+        tenantId: indexed.tenantId,
+        providerId: indexed.providerId,
+        connectionId: indexed.connectionId,
+        status: indexed.status,
+        data: payload as unknown as SqlitePrisma.InputJsonValue,
+      },
+      update: {
+        tenantId: indexed.tenantId,
+        providerId: indexed.providerId,
+        connectionId: indexed.connectionId,
+        status: indexed.status,
+        data: payload as unknown as SqlitePrisma.InputJsonValue,
+      },
+    });
+
+    return payload;
+  }
+
+  public async remove(entity: string, id: string): Promise<boolean> {
+    this.logger.debug(`remove entity=${entity} id=${id}`);
+
+    if (this.postgresPrisma) {
+      const deleted = await this.postgresPrisma.integrationEntity.deleteMany({
+        where: { entity, id },
+      });
+      return deleted.count > 0;
+    }
+
+    const deleted = await this.sqlitePrisma?.integrationEntity.deleteMany({
+      where: { entity, id },
+    });
+
+    return (deleted?.count ?? 0) > 0;
+  }
+
+  private buildWhere(entity: string, filters: Record<string, string>) {
+    return {
+      entity,
+      tenantId: filters.tenantId,
+      providerId: filters.providerId,
+      connectionId: filters.connectionId,
+      status: filters.status,
+    };
+  }
+
+  private filterInMemory(
+    rows: StoredEntity[],
+    filters: Record<string, string>,
+  ) {
+    return rows.filter((row) =>
+      Object.entries(filters).every(([key, expected]) => {
+        const value = row[key];
+
+        if (
+          typeof value === 'string' ||
+          typeof value === 'number' ||
+          typeof value === 'boolean'
+        ) {
+          return String(value) === expected;
+        }
+
+        return false;
+      }),
+    );
+  }
+
+  private isIndexedFilterKey(key: string) {
+    return (
+      key === 'tenantId' ||
+      key === 'providerId' ||
+      key === 'connectionId' ||
+      key === 'status'
+    );
+  }
+
+  private extractIndexedFields(payload: StoredEntity) {
+    return {
+      tenantId: this.readOptionalString(payload.tenantId),
+      providerId: this.readOptionalString(payload.providerId),
+      connectionId: this.readOptionalString(payload.connectionId),
+      status: this.readOptionalString(payload.status),
+    };
+  }
+
+  private deserialize(value: unknown) {
+    return value as StoredEntity;
+  }
+
+  private readOptionalString(value: unknown) {
+    return typeof value === 'string' ? value : null;
+  }
+
+  private buildPostgresUrl() {
+    const explicit = process.env.POSTGRES_URL;
+    if (explicit) {
+      process.env.INTEGRATIONS_DATABASE_URL_POSTGRES = explicit;
+      return explicit;
+    }
+
+    const user = process.env.POSTGRES_USER ?? 'postgres';
+    const password = process.env.POSTGRES_PASSWORD ?? '';
+    const host = process.env.POSTGRES_HOST ?? 'localhost';
+    const port = process.env.POSTGRES_PORT ?? '5432';
+    const database = process.env.POSTGRES_DATABASE ?? 'integrations';
+
+    const auth = password
+      ? `${encodeURIComponent(user)}:${encodeURIComponent(password)}`
+      : encodeURIComponent(user);
+    const url = `postgresql://${auth}@${host}:${port}/${database}`;
+    process.env.INTEGRATIONS_DATABASE_URL_POSTGRES = url;
+    return url;
+  }
+
+  private buildSqliteUrl(path: string) {
+    const url = path.startsWith('file:') ? path : `file:${path}`;
+    process.env.INTEGRATIONS_DATABASE_URL_SQLITE = url;
+    return url;
+  }
+}

package/apps/integrations/src/modules/platform/platform.module.ts

@@ -0,0 +1,8 @@
+import { Module } from '@nestjs/common';
+import { MetadataStoreService } from './metadata-store.service';
+
+@Module({
+  providers: [MetadataStoreService],
+  exports: [MetadataStoreService],
+})
+export class PlatformModule {}

package/apps/integrations/src/modules/platform/platform.types.ts

@@ -0,0 +1,10 @@
+export interface StoredEntity {
+  id: string;
+  [key: string]: unknown;
+}
+
+export interface ListEntitiesOptions {
+  filters?: Record<string, string>;
+  limit?: number;
+  offset?: number;
+}

package/apps/integrations/src/modules/platform/resilient-fetch.ts

@@ -0,0 +1,53 @@
+export interface ResilientFetchOptions {
+  timeoutMs?: number;
+  maxRetries?: number;
+  retryableStatuses?: number[];
+}
+
+const DEFAULT_TIMEOUT_MS = 30000;
+const DEFAULT_MAX_RETRIES = 3;
+const DEFAULT_RETRYABLE_STATUSES = [429, 500, 502, 503, 504];
+const MAX_BACKOFF_MS = 10000;
+
+export async function resilientFetch(
+  url: string,
+  init?: RequestInit,
+  options?: ResilientFetchOptions,
+): Promise<Response> {
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const maxRetries = options?.maxRetries ?? DEFAULT_MAX_RETRIES;
+  const retryableStatuses =
+    options?.retryableStatuses ?? DEFAULT_RETRYABLE_STATUSES;
+
+  let lastError: Error | undefined;
+
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+    try {
+      const response = await fetch(url, {
+        ...init,
+        signal: controller.signal,
+      });
+
+      clearTimeout(timer);
+
+      if (!retryableStatuses.includes(response.status)) {
+        return response;
+      }
+
+      lastError = new Error(`HTTP ${response.status} from ${url}`);
+    } catch (error) {
+      clearTimeout(timer);
+      lastError = error instanceof Error ? error : new Error(String(error));
+    }
+
+    if (attempt < maxRetries) {
+      const backoff = Math.min(1000 * 2 ** attempt, MAX_BACKOFF_MS);
+      await new Promise((resolve) => setTimeout(resolve, backoff));
+    }
+  }
+
+  throw lastError ?? new Error(`resilientFetch failed for ${url}`);
+}