@cat-factory/integrations 0.124.0 → 0.125.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/modules/notificationWebhook/NotificationWebhookService.d.ts.map +1 -1
- package/dist/modules/notificationWebhook/NotificationWebhookService.js +18 -2
- package/dist/modules/notificationWebhook/NotificationWebhookService.js.map +1 -1
- package/dist/modules/notificationWebhook/webhookUrl.d.ts +3 -1
- package/dist/modules/notificationWebhook/webhookUrl.d.ts.map +1 -1
- package/dist/modules/notificationWebhook/webhookUrl.js +3 -1
- package/dist/modules/notificationWebhook/webhookUrl.js.map +1 -1
- package/package.json +4 -4
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"NotificationWebhookService.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/NotificationWebhookService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAC9F,OAAO,KAAK,EACV,KAAK,EAEL,6BAA6B,EAC7B,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;
|
|
1
|
+
{"version":3,"file":"NotificationWebhookService.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/NotificationWebhookService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAC9F,OAAO,KAAK,EACV,KAAK,EAEL,6BAA6B,EAC7B,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAmB5B,MAAM,WAAW,sCAAsC;IACrD,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;CAClC;AAED,qBAAa,0BAA0B;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,sCAAsC,EAAI;IAE7E,sFAAsF;IAChF,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAGlE;IAED,kDAAkD;IAC5C,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6C/F;IAED,kDAAkD;IAC5C,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;CACF"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { ValidationError } from '@cat-factory/kernel';
|
|
1
2
|
import { assertSafeNotificationWebhookUrl } from './webhookUrl.js';
|
|
2
3
|
export class NotificationWebhookService {
|
|
3
4
|
deps;
|
|
@@ -15,11 +16,26 @@ export class NotificationWebhookService {
|
|
|
15
16
|
// than leaving it to fail per-delivery later. The wire schema's `https://` prefix check is the
|
|
16
17
|
// friendly first pass; this is the guard that actually holds (and the same one the delivery
|
|
17
18
|
// path re-runs on every redirect hop).
|
|
18
|
-
|
|
19
|
+
//
|
|
20
|
+
// Guarded on the SUPPLIED url only, and before the read, so a bad endpoint is refused without
|
|
21
|
+
// touching the store. A url the body omits is not input entering the system, it is a value
|
|
22
|
+
// this service already vouched for; re-running the guard over it would let a later NARROWING
|
|
23
|
+
// of the deployment's allow-list block the unrelated edits (unsubscribing, disabling) an
|
|
24
|
+
// operator makes to react to exactly that. Deliveries to a now-forbidden endpoint stop
|
|
25
|
+
// regardless, because the delivery path re-applies the guard per hop.
|
|
26
|
+
if (input.url !== undefined) {
|
|
27
|
+
assertSafeNotificationWebhookUrl(input.url, this.deps.urlSafetyPolicy);
|
|
28
|
+
}
|
|
19
29
|
const existing = await this.deps.notificationWebhookRepository.get(workspaceId);
|
|
30
|
+
// Keep-on-omit needs something to keep. Refusing here is what keeps the rule uniform across
|
|
31
|
+
// every field without letting a body that names no endpoint store a half-registered row.
|
|
32
|
+
const url = input.url ?? existing?.url;
|
|
33
|
+
if (url === undefined) {
|
|
34
|
+
throw new ValidationError('No webhook is registered for this workspace, so `url` is required to register one', { reason: 'webhook_url_required' });
|
|
35
|
+
}
|
|
20
36
|
const record = {
|
|
21
37
|
workspaceId,
|
|
22
|
-
url
|
|
38
|
+
url,
|
|
23
39
|
types: input.types ?? existing?.types ?? [],
|
|
24
40
|
// Omitted `runEvents` KEEPS the current subscription, like every other field here. The
|
|
25
41
|
// default for a brand-new endpoint is NONE: an operator registering a receiver for parked
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"NotificationWebhookService.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/NotificationWebhookService.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gCAAgC,EAAE,MAAM,iBAAiB,CAAA;
|
|
1
|
+
{"version":3,"file":"NotificationWebhookService.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/NotificationWebhookService.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,gCAAgC,EAAE,MAAM,iBAAiB,CAAA;AA8BlE,MAAM,OAAO,0BAA0B;IACR,IAAI;IAAjC,YAA6B,IAA4C;oBAA5C,IAAI;IAA2C,CAAC;IAE7E,sFAAsF;IACtF,KAAK,CAAC,GAAG,CAAC,WAAmB;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC7E,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvC,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,KAAkC;QAC/D,6FAA6F;QAC7F,+FAA+F;QAC/F,4FAA4F;QAC5F,uCAAuC;QACvC,EAAE;QACF,8FAA8F;QAC9F,2FAA2F;QAC3F,6FAA6F;QAC7F,yFAAyF;QACzF,uFAAuF;QACvF,sEAAsE;QACtE,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,gCAAgC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACxE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/E,4FAA4F;QAC5F,yFAAyF;QACzF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,QAAQ,EAAE,GAAG,CAAA;QACtC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,eAAe,CACvB,mFAAmF,EACnF,EAAE,MAAM,EAAE,sBAAsB,EAAE,CACnC,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAA8B;YACxC,WAAW;YACX,GAAG;YACH,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC3C,uFAAuF;YACvF,0FAA0F;YAC1F,uEAAuE;YACvE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,QAAQ,EAAE,SAAS,IAAI,EAAE;YACvD,yFAAyF;YACzF,2EAA2E;YAC3E,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW,IAAI,EAAE;YAC7D,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,IAAI,IAAI;YACnD,oEAAoE;YACpE,YAAY,EAAE,KAAK,CAAC,MAAM;gBACxB,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;gBACpD,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACjC,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACzD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACnE,CAAC;CACF;AAED,8FAA8F;AAC9F,SAAS,MAAM,CAAC,MAAiC;IAC/C,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACtC,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAA;AACH,CAAC"}
|
|
@@ -3,7 +3,9 @@ import type { UrlSafetyPolicy } from '@cat-factory/kernel';
|
|
|
3
3
|
* Validate a notification-webhook endpoint. Strict by default — `https` only, no private/internal
|
|
4
4
|
* or cloud-metadata host — widened only by the deployment's own
|
|
5
5
|
* `NOTIFICATION_WEBHOOK_ALLOW_URL_HOSTS` / `_ALLOW_HTTP_URLS` slice, which a developer running a
|
|
6
|
-
* receiver on `localhost` genuinely needs. Throws `ValidationError
|
|
6
|
+
* receiver on `localhost` genuinely needs. Throws `ValidationError`, which `handleError` maps to a
|
|
7
|
+
* 422. That is deliberately NOT the 400 a plaintext `http://` endpoint gets: the wire schema
|
|
8
|
+
* refuses that one before any handler runs, so the two layers stay distinguishable on the wire.
|
|
7
9
|
*/
|
|
8
10
|
export declare function assertSafeNotificationWebhookUrl(url: string, policy?: UrlSafetyPolicy): void;
|
|
9
11
|
//# sourceMappingURL=webhookUrl.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"webhookUrl.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/webhookUrl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAe1D
|
|
1
|
+
{"version":3,"file":"webhookUrl.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/webhookUrl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAe1D;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAM5F"}
|
|
@@ -14,7 +14,9 @@ import { assertSafePublicUrl } from '../shared/url-guard.js';
|
|
|
14
14
|
* Validate a notification-webhook endpoint. Strict by default — `https` only, no private/internal
|
|
15
15
|
* or cloud-metadata host — widened only by the deployment's own
|
|
16
16
|
* `NOTIFICATION_WEBHOOK_ALLOW_URL_HOSTS` / `_ALLOW_HTTP_URLS` slice, which a developer running a
|
|
17
|
-
* receiver on `localhost` genuinely needs. Throws `ValidationError
|
|
17
|
+
* receiver on `localhost` genuinely needs. Throws `ValidationError`, which `handleError` maps to a
|
|
18
|
+
* 422. That is deliberately NOT the 400 a plaintext `http://` endpoint gets: the wire schema
|
|
19
|
+
* refuses that one before any handler runs, so the two layers stay distinguishable on the wire.
|
|
18
20
|
*/
|
|
19
21
|
export function assertSafeNotificationWebhookUrl(url, policy) {
|
|
20
22
|
assertSafePublicUrl(url, {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"webhookUrl.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/webhookUrl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAE5D,iGAAiG;AACjG,kCAAkC;AAClC,EAAE;AACF,8FAA8F;AAC9F,uFAAuF;AACvF,kGAAkG;AAClG,4FAA4F;AAC5F,yEAAyE;AACzE,EAAE;AACF,+FAA+F;AAC/F,0DAA0D;AAE1D
|
|
1
|
+
{"version":3,"file":"webhookUrl.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/webhookUrl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAE5D,iGAAiG;AACjG,kCAAkC;AAClC,EAAE;AACF,8FAA8F;AAC9F,uFAAuF;AACvF,kGAAkG;AAClG,4FAA4F;AAC5F,yEAAyE;AACzE,EAAE;AACF,+FAA+F;AAC/F,0DAA0D;AAE1D;;;;;;;GAOG;AACH,MAAM,UAAU,gCAAgC,CAAC,GAAW,EAAE,MAAwB;IACpF,mBAAmB,CAAC,GAAG,EAAE;QACvB,OAAO,EAAE,sBAAsB;QAC/B,KAAK,EAAE,UAAU;QACjB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAA;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cat-factory/integrations",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.125.0",
|
|
4
4
|
"description": "External-system integration domain logic for the Agent Architecture Board (GitHub, documents, tasks, environments, runners).",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -27,15 +27,15 @@
|
|
|
27
27
|
"ai": "^7.0.47",
|
|
28
28
|
"p-map": "^7.0.6",
|
|
29
29
|
"yaml": "^2.9.0",
|
|
30
|
-
"@cat-factory/contracts": "0.
|
|
31
|
-
"@cat-factory/kernel": "0.234.
|
|
30
|
+
"@cat-factory/contracts": "0.234.0",
|
|
31
|
+
"@cat-factory/kernel": "0.234.2"
|
|
32
32
|
},
|
|
33
33
|
"devDependencies": {
|
|
34
34
|
"typescript": "7.0.2",
|
|
35
35
|
"undici": "^8.9.0",
|
|
36
36
|
"valibot": "^1.4.2",
|
|
37
37
|
"vitest": "^4.1.10",
|
|
38
|
-
"@cat-factory/caching": "0.14.
|
|
38
|
+
"@cat-factory/caching": "0.14.13"
|
|
39
39
|
},
|
|
40
40
|
"scripts": {
|
|
41
41
|
"build": "tsc -b tsconfig.build.json",
|