@checkstack/integration-teams-backend 0.0.35 → 0.1.0

package/CHANGELOG.md

@@ -1,5 +1,204 @@
 # @checkstack/integration-teams-backend
 
+## 0.1.0
+
+### Minor Changes
+
+- e2d6f25: feat(automation): connection picker for integration actions + restore Integrations menu
+
+  Connection-backed automation actions (Jira, Teams, Webex) now render a
+  working connection picker plus cascading provider dropdowns in the
+  visual editor, and the Integrations entry is back in the user menu.
+
+  **Contract.** `ActionDefinition` gained an optional
+  `connectionProviderId` (and it is surfaced on `ActionInfoSchema` and
+  mapped in the `listActions` router). It carries the integration
+  provider's fully-qualified id, derived from the provider plugin's own
+  `pluginMetadata.pluginId` (never a hardcoded string), so the editor
+  knows which provider backs an action's dropdowns and it matches the
+  `qualifiedId` the integration provider registry assigns.
+
+  **Providers.** Jira, Teams and Webex each export
+  `*_PROVIDER_LOCAL_ID` / `*_PROVIDER_QUALIFIED_ID`, register their
+  provider with the local id, and add a `CONNECTION_OPTIONS`
+  (`"connectionOptions"`) resolver name. Their `post_message` /
+  issue actions set `connectionProviderId` and expose `connectionId`
+  as an `x-options-resolver` dropdown instead of a hidden field.
+
+  **Frontend bridge.** A new `useConnectionOptionResolvers` hook
+  (`@checkstack/automation-frontend`, which now depends on
+  `@checkstack/integration-common`) turns an action's
+  `x-options-resolver` schema fields into live data: the
+  `connectionOptions` resolver lists the provider's connections via
+  `listConnections`, and every other resolver name is forwarded to
+  `getConnectionOptions` for the selected `connectionId`, passing the
+  live form values as `context` for dependent fields. `ProviderActionBody`
+  now passes this map to `DynamicForm` (it was previously missing
+  entirely, so connection-backed actions had no working dropdowns).
+
+  **frontend-api.** `usePluginClient` procedures now also expose a typed
+  imperative `.call(input)` alongside `.useQuery` / `.useMutation`, for
+  async callbacks that cannot host a hook (such as a `DynamicForm`
+  options resolver). Additive, non-breaking.
+
+  **Integrations menu.** Re-added `IntegrationMenuItem` and a new
+  `IntegrationsLandingPage`, wired into `integration-frontend` as a list
+  route and a `UserMenuItemsSlot` entry under the "Configuration" group.
+
+  **Action card polish.** The action editor's secondary metadata (id,
+  description, failure behaviour) is now grouped into one quiet settings
+  panel with consistent small uppercase "eyebrow" labels, so the action's
+  own configuration stays the focal point. The raw failure checkbox was
+  replaced with the standard `Checkbox` control, and the provider action
+  picker / configuration sections gained consistent section headers and a
+  divider. The per-step "type" dropdown was removed: an action's kind is
+  fixed at creation, so changing it now means adding a new step and
+  deleting the old one (avoids the surprising full-config reset that
+  switching kinds used to trigger).
+
+  **Add-step picker.** Adding a step now opens a Home-Assistant-style
+  dialog where the operator decides the step type up front: an "Actions"
+  tab lists the registered provider actions grouped by category
+  (searchable; picking one presets the step's `action`), and a "Blocks"
+  tab lists the structural building blocks (choose / parallel / repeat /
+  etc.). Because the concrete action is chosen here, the in-card action
+  switcher was removed - a step's action is fixed once created. Composite
+  blocks now start with an empty child list (filled via the nested
+  add-step picker) instead of seeding an unconfigurable empty action.
+
+- 41c77f4: feat(automation): one-time migration of webhook subscriptions + remove legacy integration backend
+
+  **BREAKING CHANGES** (platform is in BETA — no major bump):
+
+  - `IntegrationProvider` no longer carries `config` (subscription
+    config) or `deliver`. The interface now models a connection provider
+    only: connection schema + `getConnectionOptions` + `testConnection`.
+  - The legacy subscription / delivery-log / event endpoints
+    (`listSubscriptions`, `createSubscription`, `getDeliveryLogs`,
+    `listEventTypes`, …) are removed from `integrationContract`.
+  - `delivery-coordinator`, `hook-subscriber`, `event-registry`, and the
+    `integrationEventExtensionPoint` are deleted. Plugins that
+    previously called `integrationEvents.registerEvent(...)` now
+    register their hooks as automation triggers via
+    `automationTriggerExtensionPoint.registerTrigger(...)`.
+  - Frontend pages `IntegrationsPage` and `DeliveryLogsPage` are gone;
+    the integration plugin's only remaining UI is connection
+    management. Subscription management lives under `/automation/...`.
+  - `webhook_subscriptions` and `delivery_logs` tables stay in the
+    database for one release as a safety net (no code reads or writes
+    them), and will be dropped in a follow-up migration.
+
+  **New**:
+
+  - `jira.create_issue`, `teams.post_message`, `webex.post_message`,
+    `webhook.send`, `integration-script.run_shell`, and
+    `integration-script.run_script` actions registered against the
+    Automation Platform with matching `*.message`, `*.delivery`,
+    `shell.result`, and `script.result` artifact types. The script
+    plugin exposes **two** actions — `run_shell` runs bash via the
+    shared `ShellScriptRunner` (Monaco `shell` editor), `run_script`
+    runs an ESM module in a Bun subprocess via `EsmScriptRunner`
+    (Monaco `typescript` editor + `defineIntegration` helper) — to
+    preserve the legacy provider split. `jira.create_issue` keeps the
+    dynamic field-mapping dropdown (driven by
+    `JIRA_RESOLVERS.FIELD_OPTIONS`).
+  - One-time data migration runs on boot in
+    `automation-backend.afterPluginsReady`. It reads
+    `webhook_subscriptions` via a new service RPC
+    `IntegrationApi.listLegacySubscriptions`, translates each row into
+    a single-trigger / single-action automation (marked with
+    `managed_by = "migrated-subscription:<id>"`), and is idempotent
+    across restarts.
+  - Failed translations are recorded in a new
+    `automation_migration_failures` table and surfaced via
+    `AutomationApi.listMigrationFailures` /
+    `acknowledgeMigrationFailure` so admins can review and re-create
+    failed entries by hand.
+
+- 41c77f4: fix(automation): qualify action `produces` / `consumes` with the owning plugin id
+
+  `context.artifacts` showed up untyped (no fields) in the script editor
+  because action `produces` / `consumes` were hand-written full strings
+  (`"jira.issue"`) that did not match the artifact-type registry's
+  qualified id. The registry derives `${pluginId}.${id}`, and the plugin's
+  id is the package name `integration-jira`, so the artifact type actually
+  registers as `integration-jira.issue` — the editor's schema lookup
+  (`produces` vs registered `qualifiedId`) missed, leaving the artifact's
+  fields unknown. (Runtime store/consume happened to agree with each other
+  on the short string, so it "worked" but typed nothing.)
+
+  The action registry now qualifies `produces` with the owning plugin id,
+  exactly as it already qualifies the action's own `id` and as the
+  artifact-type registry qualifies the artifact type id — so the three can
+  never drift. Actions declare the **local** artifact id:
+
+  - `produces: "issue"` → registered as `integration-jira.issue`,
+  - `consumes: ["issue"]` → resolved against the owning plugin's namespace
+    at run time; `consumedArtifacts` is keyed by the local id, so an
+    action's `execute` reads `consumedArtifacts["issue"]`.
+
+  All five artifact-producing integration plugins (jira / teams / webex /
+  webhook / script) now declare local ids. With `produces` matching the
+  registered artifact type, the editor types `context.artifacts[...]` with
+  the real schema (e.g. `issueKey`, `projectKey`, `issueUrl`).
+
+  **BREAKING (beta):** the fully-qualified artifact type ids change from
+  the short form to the plugin-prefixed form, e.g. `jira.issue` →
+  `integration-jira.issue`. This affects how artifacts are referenced in
+  templates (`{{ artifact.integration-jira.issue.issueKey }}`), the TS
+  script `context.artifacts["integration-jira.issue"]`, and shell env names
+  (`$CHECKSTACK_ARTIFACT_INTEGRATION_JIRA_ISSUE_ISSUEKEY`). Artifacts are
+  per-run and ephemeral, so no stored-data migration is needed.
+
+  Note: this keeps the same-plugin produce→consume handoff (the current
+  pattern). Cross-plugin artifact consumption would need a follow-up to
+  allow a fully-qualified `consumes` ref.
+
+### Patch Changes
+
+- 41c77f4: fix(integration): resolve `connectionStoreRef` lazily inside action `execute`
+
+  The Phase 6/7/8 refactor wired every integration backend's
+  `registerInit` deps to include `connectionStore: connectionStoreRef`,
+  expecting `integration-backend` to register the service before the
+  sort. But `integration-backend` calls `env.registerService(connection
+StoreRef, ...)` from inside its own `init()`, not at `register()`
+  time — so at topological-sort time the `providedBy` map doesn't know
+  the service exists yet, and the sort can put a consumer (e.g.
+  `integration-teams`) ahead of `integration-backend`. The dev server
+  then fails at boot with:
+
+  > Service 'integration.connectionStore' not found for plugin
+  > 'integration-teams'
+
+  This change drops the init-time dep from every integration plugin and
+  resolves the connection store **lazily at action-execute time** via
+  `context.getService(connectionStoreRef)`. By the time any action's
+  `execute` runs, every plugin has finished init + afterPluginsReady,
+  so the service is always available. Tests updated to thread a mock
+  store through a typed `getService` stub in the action context.
+
+  No behaviour change at runtime — the actions hit the connection store
+  at the same moment they always did (just inside `execute` rather than
+  through a captured init-time closure).
+
+- Updated dependencies [e2d6f25]
+- Updated dependencies [41c77f4]
+- Updated dependencies [e1a2077]
+- Updated dependencies [41c77f4]
+- Updated dependencies [41c77f4]
+- Updated dependencies [41c77f4]
+- Updated dependencies [41c77f4]
+- Updated dependencies [41c77f4]
+- Updated dependencies [41c77f4]
+- Updated dependencies [6d52276]
+- Updated dependencies [6d52276]
+- Updated dependencies [35bc682]
+  - @checkstack/automation-backend@0.2.0
+  - @checkstack/integration-backend@0.2.0
+  - @checkstack/common@0.12.0
+  - @checkstack/backend-api@0.18.0
+
 ## 0.0.35
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/integration-teams-backend",
-  "version": "0.0.35",
+  "version": "0.1.0",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
@@ -11,18 +11,21 @@
     "typecheck": "tsgo -b",
     "lint": "bun run lint:code",
     "lint:code": "eslint . --max-warnings 0",
+    "test": "bun test",
     "pack": "bunx @checkstack/scripts plugin-pack"
   },
   "dependencies": {
-    "@checkstack/backend-api": "0.17.0",
-    "@checkstack/integration-backend": "0.1.29",
+    "@checkstack/backend-api": "0.17.1",
+    "@checkstack/integration-backend": "0.1.30",
+    "@checkstack/automation-backend": "0.1.0",
     "@checkstack/common": "0.11.0",
     "zod": "^4.2.1"
   },
   "devDependencies": {
     "@types/bun": "^1.0.0",
     "typescript": "^5.0.0",
-    "@checkstack/tsconfig": "0.0.7"
+    "@checkstack/tsconfig": "0.0.7",
+    "@checkstack/test-utils-backend": "0.1.30"
   },
   "description": "Checkstack integration-teams-backend plugin",
   "author": {

package/src/automations.test.ts

@@ -0,0 +1,289 @@
+/**
+ * Behaviour tests for the Teams automation action.
+ *
+ * The ConnectionStore is faked; fetch is stubbed in-process so we can
+ * drive `teams.post_message.execute` through:
+ *   1. OAuth client-credentials token fetch
+ *   2. Microsoft Graph POST to `/teams/.../channels/.../messages`
+ *
+ * The action wraps the operator-authored body in a minimal Adaptive
+ * Card before posting — we assert that wrapping here.
+ */
+import { describe, it, expect, beforeEach, mock } from "bun:test";
+import type { Logger } from "@checkstack/backend-api";
+import { createMockLogger } from "@checkstack/test-utils-backend";
+import {
+  connectionStoreRef,
+  type ConnectionStore,
+} from "@checkstack/integration-backend";
+import type { ServiceRef } from "@checkstack/backend-api";
+
+import {
+  createTeamsActions,
+  teamsMessageArtifactType,
+} from "./automations";
+
+const logger = createMockLogger() as Logger;
+
+interface CapturedFetchCall {
+  url: string;
+  init: RequestInit;
+}
+
+interface StagedResponse {
+  body?: unknown;
+  status?: number;
+  raw?: string;
+}
+
+function setupFetchSequence(responses: StagedResponse[]) {
+  const calls: CapturedFetchCall[] = [];
+  const originalFetch = globalThis.fetch;
+  let i = 0;
+  globalThis.fetch = (async (
+    input: string | URL | Request,
+    init?: RequestInit,
+  ) => {
+    calls.push({ url: String(input), init: init ?? {} });
+    const next = responses[i++] ?? { body: {}, status: 200 };
+    return new Response(
+      next.raw !== undefined ? next.raw : JSON.stringify(next.body ?? {}),
+      {
+        status: next.status ?? 200,
+        headers: { "Content-Type": "application/json" },
+      },
+    );
+  }) as typeof fetch;
+  return {
+    calls,
+    restore: () => {
+      globalThis.fetch = originalFetch;
+    },
+  };
+}
+
+function makeConnectionStore(): ConnectionStore {
+  return {
+    listConnections: mock(async () => []),
+    getConnection: mock(async () => undefined),
+    getConnectionWithCredentials: mock(async (id: string) =>
+      id === "conn-1"
+        ? {
+            id: "conn-1",
+            providerId: "teams",
+            name: "Tenant",
+            config: {
+              tenantId: "tenant-1",
+              clientId: "client-1",
+              clientSecret: "client-secret",
+            },
+            createdAt: new Date(),
+            updatedAt: new Date(),
+          }
+        : undefined,
+    ),
+    createConnection: mock(async () => {
+      throw new Error("not implemented in stub");
+    }),
+    updateConnection: mock(async () => {
+      throw new Error("not implemented in stub");
+    }),
+    deleteConnection: mock(async () => false),
+    findConnectionProvider: mock(async () => undefined),
+  } as unknown as ConnectionStore;
+}
+
+let fetchFixture: ReturnType<typeof setupFetchSequence> | undefined;
+
+beforeEach(() => {
+  fetchFixture?.restore();
+  fetchFixture = undefined;
+});
+
+function makeCtx(store: ConnectionStore) {
+  return {
+    runId: "run-1",
+    automationId: "auto-1",
+    contextKey: null,
+    logger,
+    getService: async <T,>(ref: ServiceRef<T>): Promise<T> => {
+      if (ref.id === connectionStoreRef.id) {
+        return store as unknown as T;
+      }
+      throw new Error(`Unstubbed service requested: ${ref.id}`);
+    },
+  };
+}
+
+const ctxBase = makeCtx(makeConnectionStore());
+
+describe("teamsMessageArtifactType", () => {
+  it("validates the canonical artifact shape", () => {
+    const ok = teamsMessageArtifactType.schema.safeParse({
+      messageId: "msg-1",
+      teamId: "team-1",
+      channelId: "ch-1",
+    });
+    expect(ok.success).toBe(true);
+  });
+
+  it("rejects when teamId is missing", () => {
+    const bad = teamsMessageArtifactType.schema.safeParse({
+      messageId: "msg-1",
+      channelId: "ch-1",
+    });
+    expect(bad.success).toBe(false);
+  });
+});
+
+describe("teams.post_message", () => {
+  it("posts an adaptive card and emits a teams.message artifact", async () => {
+    fetchFixture = setupFetchSequence([
+      { body: { access_token: "tok-1", expires_in: 3600 } },
+      { body: { id: "msg-42" } },
+    ]);
+    const actions = createTeamsActions();
+    const post = actions[0]!;
+    const result = await post.execute({
+      ...ctxBase,
+      consumedArtifacts: {},
+      config: {
+        connectionId: "conn-1",
+        teamId: "team-1",
+        channelId: "ch-1",
+        title: "Heads up",
+        body: "Something happened",
+      } as never,
+    });
+    expect(result.success).toBe(true);
+    if (!result.success) return;
+    expect(result.externalId).toBe("msg-42");
+    const artifact = result.artifact as {
+      messageId: string;
+      teamId: string;
+      channelId: string;
+    };
+    expect(artifact).toEqual({
+      messageId: "msg-42",
+      teamId: "team-1",
+      channelId: "ch-1",
+    });
+
+    // First call: token endpoint.
+    const tokenCall = fetchFixture.calls[0]!;
+    expect(tokenCall.url).toContain(
+      "https://login.microsoftonline.com/tenant-1/oauth2/v2.0/token",
+    );
+    expect(tokenCall.init.method).toBe("POST");
+
+    // Second call: Graph messages endpoint with the bearer token.
+    const graphCall = fetchFixture.calls[1]!;
+    expect(graphCall.url).toBe(
+      "https://graph.microsoft.com/v1.0/teams/team-1/channels/ch-1/messages",
+    );
+    const headers = graphCall.init.headers as Record<string, string>;
+    expect(headers.Authorization).toBe("Bearer tok-1");
+    const body = JSON.parse(graphCall.init.body as string) as {
+      attachments: Array<{ content: string }>;
+    };
+    const card = JSON.parse(body.attachments[0]!.content) as {
+      type: string;
+      body: Array<{ text: string }>;
+    };
+    expect(card.type).toBe("AdaptiveCard");
+    expect(card.body[0]!.text).toBe("Heads up");
+    expect(card.body[1]!.text).toBe("Something happened");
+  });
+
+  it("omits the title TextBlock when title is not provided", async () => {
+    fetchFixture = setupFetchSequence([
+      { body: { access_token: "tok-1", expires_in: 3600 } },
+      { body: { id: "msg-99" } },
+    ]);
+    const actions = createTeamsActions();
+    const post = actions[0]!;
+    const result = await post.execute({
+      ...ctxBase,
+      consumedArtifacts: {},
+      config: {
+        connectionId: "conn-1",
+        teamId: "team-1",
+        channelId: "ch-1",
+        body: "Just the body",
+      } as never,
+    });
+    expect(result.success).toBe(true);
+    const graphCall = fetchFixture.calls[1]!;
+    const body = JSON.parse(graphCall.init.body as string) as {
+      attachments: Array<{ content: string }>;
+    };
+    const card = JSON.parse(body.attachments[0]!.content) as {
+      body: Array<{ text: string }>;
+    };
+    expect(card.body).toHaveLength(1);
+    expect(card.body[0]!.text).toBe("Just the body");
+  });
+
+  it("returns failure when the connection is missing", async () => {
+    const actions = createTeamsActions();
+    const post = actions[0]!;
+    const result = await post.execute({
+      ...ctxBase,
+      consumedArtifacts: {},
+      config: {
+        connectionId: "missing",
+        teamId: "team-1",
+        channelId: "ch-1",
+        body: "x",
+      } as never,
+    });
+    expect(result.success).toBe(false);
+    if (result.success) return;
+    expect(result.error).toMatch(/connection not found/i);
+  });
+
+  it("returns failure when the token request fails", async () => {
+    fetchFixture = setupFetchSequence([
+      { status: 401, raw: "invalid_client" },
+    ]);
+    const actions = createTeamsActions();
+    const post = actions[0]!;
+    const result = await post.execute({
+      ...ctxBase,
+      consumedArtifacts: {},
+      config: {
+        connectionId: "conn-1",
+        teamId: "team-1",
+        channelId: "ch-1",
+        body: "x",
+      } as never,
+    });
+    expect(result.success).toBe(false);
+    if (result.success) return;
+    expect(result.error).toMatch(/Authentication failed/);
+    expect(result.error).toMatch(/Token request failed \(401\)/);
+  });
+
+  it("returns failure when the Graph POST responds non-OK", async () => {
+    fetchFixture = setupFetchSequence([
+      { body: { access_token: "tok-1", expires_in: 3600 } },
+      { status: 403, raw: "forbidden" },
+    ]);
+    const actions = createTeamsActions();
+    const post = actions[0]!;
+    const result = await post.execute({
+      ...ctxBase,
+      consumedArtifacts: {},
+      config: {
+        connectionId: "conn-1",
+        teamId: "team-1",
+        channelId: "ch-1",
+        body: "x",
+      } as never,
+    });
+    expect(result.success).toBe(false);
+    if (result.success) return;
+    expect(result.error).toMatch(/Graph API error \(403\)/);
+    expect(result.error).toMatch(/forbidden/);
+  });
+});