@almadar/integrations 2.38.0 → 2.40.0

package/dist/runtime/index.d.ts

@@ -1,5 +1,5 @@
 import { g as IntegrationParams, I as IntegrationCallContext, d as IntegrationFactory } from '../BaseIntegration-CWdas-N_.js';
-import { o as IntegrationName, m as IntegrationActionName, n as IntegrationContracts, e as CredentialStore } from '../store-RNvxZO-q.js';
+import { o as IntegrationName, m as IntegrationActionName, n as IntegrationContracts, e as CredentialStore } from '../store-DG5OGiuQ.js';
 import '@almadar/core';
 
 /**
@@ -50,7 +50,15 @@ declare class RuntimeIntegrationManager {
     private credentialStore;
     private storeEnvBase;
     private storeFirst;
-    constructor();
+    private readonly tenant;
+    /**
+     * `tenant`: one tenant of a multi-tenant host. Its services are configured from its credential
+     * store alone (never the host's env), and it installs nothing process-wide; resolve its
+     * references inside `runWithCredentialScope`.
+     */
+    constructor(options?: {
+        tenant?: boolean;
+    });
     /**
      * W4: configure with the tenant credential store layered over the env —
      * store → env → unconfigured. Installs the store as the process-wide

package/dist/runtime/index.js

@@ -1,6 +1,7 @@
 import { createLogger } from '@almadar/logger';
 import { integratorsRegistry } from '@almadar/core/patterns';
 import { createHmac, createHash } from 'crypto';
+import { AsyncLocalStorage } from 'async_hooks';
 import { mkdtempSync, writeFileSync, rmSync, promises } from 'fs';
 import { join } from 'path';
 import Stripe2 from 'stripe';
@@ -133,8 +134,8 @@ var serviceCredentials = {
     { envVar: "REDIS_URL", required: true, description: "Redis connection URL" }
   ],
   oauth: [
-    { envVar: "OAUTH_CLIENT_ID", required: true, description: "OIDC client ID" },
-    { envVar: "OAUTH_CLIENT_SECRET", required: true, description: "OIDC client secret" },
+    { envVar: "OAUTH_CLIENT_ID", required: true, description: "OAuth/OIDC client ID" },
+    { envVar: "OAUTH_CLIENT_SECRET", required: true, description: "OAuth/OIDC client secret" },
     { envVar: "OAUTH_REDIRECT_URI", required: false, description: "OIDC redirect URI (default per-call param)" },
     { envVar: "OIDC_ISSUER_URL", required: false, description: "OIDC issuer URL (default https://accounts.google.com)" }
   ],
@@ -400,8 +401,7 @@ function getIntegration(name) {
 function getRegisteredIntegrations() {
   return Object.keys(INTEGRATION_REGISTRY);
 }
-
-// src/factory.ts
+var callLog = createLogger("almadar:integrations:calls");
 function instanceKey(name, principal) {
   return principal ? `${name}\0${principal}` : name;
 }
@@ -446,8 +446,16 @@ var IntegrationFactory = class {
    * Execute an action on an integration
    */
   async execute(integration, action, params, context) {
-    const instance = this.get(integration, context?.principal);
-    return await instance.execute(action, params, context);
+    const start = performance.now();
+    const record = (ok, error) => callLog.call({ kind: "external", service: integration, op: action, durationMs: performance.now() - start, ok, ...error !== void 0 ? { error } : {} });
+    try {
+      const result = await this.get(integration, context?.principal).execute(action, params, context);
+      record(result.success, result.success ? void 0 : result.error?.message);
+      return result;
+    } catch (err) {
+      record(false, err instanceof Error ? err.message : String(err));
+      throw err;
+    }
   }
   /**
    * Check if integration is configured
@@ -491,9 +499,8 @@ var IntegrationFactory = class {
     this.configs.clear();
   }
 };
-
-// src/credentials/resolver.ts
 var installedStore = null;
+var tenantScope = new AsyncLocalStorage();
 var activeFactory = null;
 function installActiveFactory(factory) {
   activeFactory = factory;
@@ -508,6 +515,8 @@ function getInstalledCredentialStore() {
   return installedStore;
 }
 function resolveCredentialRef(ref, env = process.env) {
+  const tenant = tenantScope.getStore();
+  if (tenant) return tenant.resolve(ref);
   return installedStore?.resolve(ref) ?? env[ref];
 }
 join(".almadar", "dev-credentials.json");
@@ -3547,6 +3556,31 @@ var PROVIDER_AUTH_URLS = {
 var PROVIDER_ISSUERS = {
   google: "https://accounts.google.com"
 };
+var PROVIDER_SERVER_METADATA = {
+  github: {
+    issuer: "https://github.com",
+    authorization_endpoint: "https://github.com/login/oauth/authorize",
+    token_endpoint: "https://github.com/login/oauth/access_token"
+  }
+};
+var OAuthGrantNotFoundError = class extends Error {
+  constructor(state) {
+    super(`Invalid or expired state token: ${state}`);
+    this.name = "OAuthGrantNotFoundError";
+  }
+};
+var OAuthSubjectMismatchError = class extends Error {
+  constructor() {
+    super("OAuth completion refused: the completing subject is not the one that started the authorization");
+    this.name = "OAuthSubjectMismatchError";
+  }
+};
+function assertSubject(bound, completer) {
+  if (bound !== completer) throw new OAuthSubjectMismatchError();
+}
+function grantedScopes(scope) {
+  return (scope ?? "").split(/[\s,]+/).filter((s) => s.length > 0);
+}
 var PENDING_GRANT_TTL_MS = 10 * 60 * 1e3;
 var InMemoryPendingGrantStore = class {
   constructor() {
@@ -3571,7 +3605,7 @@ var InMemoryPendingGrantStore = class {
 var OAuthIntegration = class extends BaseIntegration {
   constructor(config) {
     super(config);
-    /** Maps state token -> provider for pending MOCK authorization flows */
+    /** Maps state token -> pending MOCK authorization */
     this.states = /* @__PURE__ */ new Map();
     /** Maps access token -> token set (mock backend) */
     this.tokens = /* @__PURE__ */ new Map();
@@ -3600,12 +3634,25 @@ var OAuthIntegration = class extends BaseIntegration {
     try {
       let data;
       switch (action) {
-        case "authorize":
-          data = await this.executeWithRetry(() => this.real ? this.oidcAuthorize(params) : this.authorize(params));
+        case "authorize": {
+          const input = {
+            provider: params.provider,
+            scopes: params.scopes,
+            redirectUri: params.redirectUri,
+            ...params.subject === void 0 ? {} : { subject: params.subject }
+          };
+          data = await this.executeWithRetry(() => this.startAuthorization(input));
           break;
-        case "token":
-          data = await this.executeWithRetry(() => this.real ? this.oidcToken(params) : this.token(params));
+        }
+        case "token": {
+          const input = {
+            code: params.code,
+            state: params.state,
+            ...params.subject === void 0 ? {} : { subject: params.subject }
+          };
+          data = await this.executeWithRetry(() => this.completeAuthorization(input));
           break;
+        }
         case "refresh":
           data = await this.executeWithRetry(() => this.real ? this.oidcRefresh(params) : this.refresh(params));
           break;
@@ -3627,6 +3674,14 @@ var OAuthIntegration = class extends BaseIntegration {
       return this.handleError(action, error);
     }
   }
+  /** Build the provider authorization URL and hold the pending grant (PKCE verifier, subject) under `state`. */
+  async startAuthorization(input) {
+    return this.real ? this.oidcAuthorize(input) : this.authorize(input);
+  }
+  /** Consume the pending grant once and exchange the code; throws on an unknown, replayed or expired `state`. */
+  async completeAuthorization(input) {
+    return this.real ? this.oidcToken(input) : this.token(input);
+  }
   // ---------------------------------------------------------------------------
   // OIDC backend (openid-client)
   // ---------------------------------------------------------------------------
@@ -3642,6 +3697,19 @@ var OAuthIntegration = class extends BaseIntegration {
     return issuer;
   }
   async configurationFor(provider) {
+    const metadata = PROVIDER_SERVER_METADATA[provider];
+    if (metadata && !this.config.env.OIDC_ISSUER_URL) {
+      const cached2 = this.discovered.get(metadata.issuer);
+      if (cached2) return cached2;
+      const configuration2 = new oidc.Configuration(
+        metadata,
+        this.config.env.OAUTH_CLIENT_ID,
+        this.config.env.OAUTH_CLIENT_SECRET,
+        oidc.ClientSecretPost(this.config.env.OAUTH_CLIENT_SECRET)
+      );
+      this.discovered.set(metadata.issuer, configuration2);
+      return configuration2;
+    }
     const issuer = this.issuerFor(provider);
     const cached = this.discovered.get(issuer);
     if (cached) return cached;
@@ -3653,10 +3721,9 @@ var OAuthIntegration = class extends BaseIntegration {
     this.discovered.set(issuer, configuration);
     return configuration;
   }
-  async oidcAuthorize(params) {
-    const provider = params.provider;
-    const scopes = params.scopes;
-    const redirectUri = params.redirectUri || this.config.env.OAUTH_REDIRECT_URI;
+  async oidcAuthorize(input) {
+    const { provider, scopes, subject } = input;
+    const redirectUri = input.redirectUri || this.config.env.OAUTH_REDIRECT_URI;
     const configuration = await this.configurationFor(provider);
     const state = oidc.randomState();
     const pkceVerifier = oidc.randomPKCECodeVerifier();
@@ -3673,17 +3740,21 @@ var OAuthIntegration = class extends BaseIntegration {
       parameters.prompt = "consent";
     }
     const authUrl = oidc.buildAuthorizationUrl(configuration, parameters);
-    await this.pendingStore().put(state, { provider, redirectUri, pkceVerifier }, PENDING_GRANT_TTL_MS);
+    await this.pendingStore().put(
+      state,
+      { provider, redirectUri, pkceVerifier, ...subject === void 0 ? {} : { subject } },
+      PENDING_GRANT_TTL_MS
+    );
     void this.pendingStore().sweep();
     return { authUrl: authUrl.toString(), state };
   }
-  async oidcToken(params) {
-    const code = params.code;
-    const state = params.state;
+  async oidcToken(input) {
+    const { code, state } = input;
     const pendingAuth = await this.pendingStore().take(state);
     if (!pendingAuth) {
-      throw new Error(`Invalid or expired state token: ${state}`);
+      throw new OAuthGrantNotFoundError(state);
     }
+    assertSubject(pendingAuth.subject, input.subject);
     const configuration = await this.configurationFor(pendingAuth.provider);
     const callbackUrl = new URL(pendingAuth.redirectUri);
     callbackUrl.searchParams.set("code", code);
@@ -3700,7 +3771,9 @@ var OAuthIntegration = class extends BaseIntegration {
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token ?? "",
       expiresIn: tokens.expires_in ?? 3600,
-      tokenType: "bearer"
+      tokenType: "bearer",
+      scope: grantedScopes(tokens.scope),
+      ...pendingAuth.subject === void 0 ? {} : { subject: pendingAuth.subject }
     };
   }
   async oidcRefresh(params) {
@@ -3763,13 +3836,11 @@ var OAuthIntegration = class extends BaseIntegration {
   // ---------------------------------------------------------------------------
   // Mock backend actions
   // ---------------------------------------------------------------------------
-  async authorize(params) {
-    const provider = params.provider;
-    const scopes = params.scopes;
-    const redirectUri = params.redirectUri;
+  async authorize(input) {
+    const { provider, scopes, redirectUri, subject } = input;
     this.logger.debug("OAuth AUTHORIZE", { provider, scopes: scopes.join(", "), redirectUri });
     const state = this.generateToken(16);
-    this.states.set(state, provider);
+    this.states.set(state, { provider, scopes, ...subject === void 0 ? {} : { subject } });
     const baseUrl = PROVIDER_AUTH_URLS[provider];
     const queryParams = new URLSearchParams({
       response_type: "code",
@@ -3781,17 +3852,15 @@ var OAuthIntegration = class extends BaseIntegration {
     const authUrl = `${baseUrl}?${queryParams.toString()}`;
     return { authUrl, state };
   }
-  async token(params) {
-    const code = params.code;
-    const state = params.state;
+  async token(input) {
+    const { code, state } = input;
     this.logger.debug("OAuth TOKEN", { code, state });
-    const provider = this.states.get(state);
-    if (!provider) {
-      throw new Error(
-        `Invalid or expired state token: ${state}`
-      );
+    const pending = this.states.get(state);
+    if (!pending) {
+      throw new OAuthGrantNotFoundError(state);
     }
     this.states.delete(state);
+    assertSubject(pending.subject, input.subject);
     const accessToken = this.generateToken(32);
     const refreshToken = this.generateToken(32);
     const expiresIn = 3600;
@@ -3803,8 +3872,15 @@ var OAuthIntegration = class extends BaseIntegration {
     this.tokens.set(accessToken, tokenSet);
     this.refreshIndex.set(refreshToken, accessToken);
     const sub = this.generateToken(8);
-    this.sessions.set(accessToken, this.generateMockUser(provider, sub));
-    return { accessToken, refreshToken, expiresIn, tokenType: "bearer" };
+    this.sessions.set(accessToken, this.generateMockUser(pending.provider, sub));
+    return {
+      accessToken,
+      refreshToken,
+      expiresIn,
+      tokenType: "bearer",
+      scope: pending.scopes,
+      ...pending.subject === void 0 ? {} : { subject: pending.subject }
+    };
   }
   async refresh(params) {
     const refreshToken = params.refreshToken;
@@ -5370,12 +5446,18 @@ function generateMockFromShape(shape) {
   return data;
 }
 var RuntimeIntegrationManager = class {
-  constructor() {
+  /**
+   * `tenant`: one tenant of a multi-tenant host. Its services are configured from its credential
+   * store alone (never the host's env), and it installs nothing process-wide; resolve its
+   * references inside `runWithCredentialScope`.
+   */
+  constructor(options = {}) {
     this.credentialStore = null;
     this.storeEnvBase = null;
     this.storeFirst = false;
     this.factory = new IntegrationFactory();
-    installActiveFactory(this.factory);
+    this.tenant = options.tenant === true;
+    if (!this.tenant) installActiveFactory(this.factory);
   }
   /**
    * W4: configure with the tenant credential store layered over the env —
@@ -5387,7 +5469,13 @@ var RuntimeIntegrationManager = class {
    */
   async configureFromStore(store, envOverride) {
     this.credentialStore = store;
-    this.storeEnvBase = envOverride ?? process.env;
+    this.storeEnvBase = this.tenant ? {} : envOverride ?? process.env;
+    if (this.tenant) {
+      await store.warm();
+      store.subscribe(() => this.refreshFromStore());
+      this.refreshFromStore();
+      return;
+    }
     this.storeFirst = this.storeEnvBase.ALMADAR_CREDENTIALS_SOURCE === "store";
     installCredentialStore(store);
     await store.warm();