@cosmoops/connect-sdk 0.23.0 → 0.24.0

package/CHANGELOG.md

@@ -3,6 +3,43 @@
 `@cosmoops/connect-sdk` follows semver, with the 0.x convention that **minor
 versions may carry breaking changes** and patch versions never do.
 
+## 0.24.0
+
+### Fixed
+
+- **`connect.integrations.initiateConnect()` could never succeed.** Connect's
+  `POST /integrations/connect` requires a `userId` - it stores it as the
+  connection's `connectedByUserId` - and the SDK sent `workspaceId`,
+  `toolkitSlug` and `returnUrl` and nothing else. Every call 400'd, including
+  the one `createConnectHandler`'s own `POST /integrations/connect` route
+  makes, so **`<ConnectIntegrationsModal />`'s Connect button was broken too**:
+  the browser reached the bridge, the bridge reached Connect, and Connect
+  refused with `Invalid input: expected string, received undefined` - a Zod
+  message that names no field, which is most of why this survived.
+
+  The conformance suite pinned the *response* shape and not the request, so
+  nothing failed the build. It now pins the request body against the
+  use-case command, and `src/conformance.test.ts` fails to compile if the
+  route grows a fourth required field.
+
+### Changed
+
+- **`initiateConnect` takes an input object** - `initiateConnect(workspaceId,
+  { toolkitSlug, returnUrl, userId })`, replacing the three positional
+  strings. Breaking in name only: the old signature had no working call to
+  break. The object shape matches `execute()` on the same resource, and it is
+  what keeps `returnUrl` and `userId` from being silently transposable.
+
+  `userId` is the signed-in member starting the connection. Take it from your
+  own session, never from a form: the toolkit connection is shared by the
+  whole workspace, so this attribution is the only record of who turned it on.
+  The bridge already does this for you - it reads the session's user, and a
+  `userId` in the request body is ignored, the same way a crafted
+  `workspaceId` always was.
+
+- **`InitiateIntegrationConnectionInput` is exported** from
+  `@cosmoops/connect-sdk/server`, beside `ExecuteIntegrationActionInput`.
+
 ## 0.23.0
 
 ### Added

package/dist/cjs/server/client.js

@@ -161,4 +161,4 @@ class ConnectClient {
 }
 exports.ConnectClient = ConnectClient;
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-exports.SDK_VERSION = "0.23.0";
+exports.SDK_VERSION = "0.24.0";

package/dist/cjs/server/handler.js

@@ -605,8 +605,14 @@ function createConnectHandler(options) {
             const { workspaceId } = await requireWorkspace(request);
             return json({ toolkits: await client.integrations.list(workspaceId) });
         },
+        /*
+         * `userId` comes from the session alongside `workspaceId`, never from the
+         * body - it is stored as `connectedByUserId`, so letting the browser name
+         * it would let anyone sign a workspace-shared connection with someone
+         * else's name.
+         */
         "POST /integrations/connect": async (request) => {
-            const { workspaceId } = await requireWorkspace(request);
+            const { workspaceId, user } = await requireWorkspace(request);
             const body = (await request.json().catch(() => null));
             if (!body?.toolkitSlug || !body?.returnUrl) {
                 throw new errors_js_1.ConnectError({
@@ -616,7 +622,11 @@ function createConnectHandler(options) {
                     endpoint: "POST /integrations/connect",
                 });
             }
-            return json(await client.integrations.initiateConnect(workspaceId, body.toolkitSlug, body.returnUrl));
+            return json(await client.integrations.initiateConnect(workspaceId, {
+                toolkitSlug: body.toolkitSlug,
+                returnUrl: body.returnUrl,
+                userId: user.userId,
+            }));
         },
         "POST /integrations/disconnect": async (request) => {
             const { workspaceId } = await requireWorkspace(request);

package/dist/cjs/server/resources/integrations.js

@@ -35,15 +35,17 @@ class IntegrationsResource {
      * itself. Reconnecting a disconnected/failed toolkit calls this same
      * method - there is no separate reconnect.
      *
-     * Meant to be called on behalf of a signed-in workspace admin (this is what the
-     * bridge's fixed `POST /integrations/connect` route does), not as a bare
-     * background action with no admin present to complete the OAuth screen.
+     * Meant to be called on behalf of a signed-in workspace admin (this is what
+     * the bridge's fixed `POST /integrations/connect` route does), not as a bare
+     * background action with no admin present to complete the OAuth screen. That
+     * is why `userId` is part of the input rather than inferred - see
+     * `InitiateIntegrationConnectionInput`.
      */
-    async initiateConnect(workspaceId, toolkitSlug, returnUrl) {
+    async initiateConnect(workspaceId, input) {
         return (0, http_js_1.request)(this.transport, {
             method: "POST",
             path: "/integrations/connect",
-            json: { workspaceId, toolkitSlug, returnUrl },
+            json: { workspaceId, ...input },
         });
     }
     /** Idempotent - disconnecting a toolkit that was never connected, or is already disconnected, is a success. */

package/dist/esm/server/client.js

@@ -157,4 +157,4 @@ export class ConnectClient {
     }
 }
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-export const SDK_VERSION = "0.23.0";
+export const SDK_VERSION = "0.24.0";

package/dist/esm/server/handler.js

@@ -602,8 +602,14 @@ export function createConnectHandler(options) {
             const { workspaceId } = await requireWorkspace(request);
             return json({ toolkits: await client.integrations.list(workspaceId) });
         },
+        /*
+         * `userId` comes from the session alongside `workspaceId`, never from the
+         * body - it is stored as `connectedByUserId`, so letting the browser name
+         * it would let anyone sign a workspace-shared connection with someone
+         * else's name.
+         */
         "POST /integrations/connect": async (request) => {
-            const { workspaceId } = await requireWorkspace(request);
+            const { workspaceId, user } = await requireWorkspace(request);
             const body = (await request.json().catch(() => null));
             if (!body?.toolkitSlug || !body?.returnUrl) {
                 throw new ConnectError({
@@ -613,7 +619,11 @@ export function createConnectHandler(options) {
                     endpoint: "POST /integrations/connect",
                 });
             }
-            return json(await client.integrations.initiateConnect(workspaceId, body.toolkitSlug, body.returnUrl));
+            return json(await client.integrations.initiateConnect(workspaceId, {
+                toolkitSlug: body.toolkitSlug,
+                returnUrl: body.returnUrl,
+                userId: user.userId,
+            }));
         },
         "POST /integrations/disconnect": async (request) => {
             const { workspaceId } = await requireWorkspace(request);

package/dist/esm/server/resources/integrations.js

@@ -32,15 +32,17 @@ export class IntegrationsResource {
      * itself. Reconnecting a disconnected/failed toolkit calls this same
      * method - there is no separate reconnect.
      *
-     * Meant to be called on behalf of a signed-in workspace admin (this is what the
-     * bridge's fixed `POST /integrations/connect` route does), not as a bare
-     * background action with no admin present to complete the OAuth screen.
+     * Meant to be called on behalf of a signed-in workspace admin (this is what
+     * the bridge's fixed `POST /integrations/connect` route does), not as a bare
+     * background action with no admin present to complete the OAuth screen. That
+     * is why `userId` is part of the input rather than inferred - see
+     * `InitiateIntegrationConnectionInput`.
      */
-    async initiateConnect(workspaceId, toolkitSlug, returnUrl) {
+    async initiateConnect(workspaceId, input) {
         return request(this.transport, {
             method: "POST",
             path: "/integrations/connect",
-            json: { workspaceId, toolkitSlug, returnUrl },
+            json: { workspaceId, ...input },
         });
     }
     /** Idempotent - disconnecting a toolkit that was never connected, or is already disconnected, is a success. */

package/dist/types/server/client.d.ts

@@ -123,4 +123,4 @@ export declare class ConnectClient {
     constructor(options: ConnectClientOptions);
 }
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-export declare const SDK_VERSION = "0.23.0";
+export declare const SDK_VERSION = "0.24.0";

package/dist/types/server/index.d.ts

@@ -26,7 +26,7 @@ export type { OtpResource } from "./resources/otp.js";
 export type { LogsResource } from "./resources/logs.js";
 export type { AnalyticsResource } from "./resources/analytics.js";
 export type { SessionsResource } from "./resources/sessions.js";
-export type { ExecuteIntegrationActionInput, IntegrationsResource } from "./resources/integrations.js";
+export type { ExecuteIntegrationActionInput, InitiateIntegrationConnectionInput, IntegrationsResource, } from "./resources/integrations.js";
 export type { PlatformResource } from "./resources/platform.js";
 export type { SchedulingResource, FindSlotsInput, ListBookingsInput, CreateBookingInput, RescheduleBookingInput, } from "./resources/scheduling.js";
 export type { ContactsResource, LookupContactInput } from "./resources/contacts.js";

package/dist/types/server/resources/integrations.d.ts

@@ -1,5 +1,19 @@
 import { type TransportOptions } from "../http.js";
 import type { DisconnectIntegrationResponse, ExecuteIntegrationActionResponse, InitiateIntegrationConnectionResponse, IntegrationsListResponse } from "../../types.js";
+export interface InitiateIntegrationConnectionInput {
+    toolkitSlug: string;
+    returnUrl: string;
+    /**
+     * The signed-in member starting the connection, recorded by Connect as
+     * `connectedByUserId`.
+     *
+     * Required, and deliberately not defaulted: the connection is *shared by
+     * the whole workspace*, so "who turned this on" is the only attribution
+     * anyone gets - and a call that cannot name a person is one where nobody
+     * is present to finish the OAuth screen either.
+     */
+    userId: string;
+}
 export interface ExecuteIntegrationActionInput {
     toolkitSlug: string;
     actionSlug: string;
@@ -28,11 +42,13 @@ export declare class IntegrationsResource {
      * itself. Reconnecting a disconnected/failed toolkit calls this same
      * method - there is no separate reconnect.
      *
-     * Meant to be called on behalf of a signed-in workspace admin (this is what the
-     * bridge's fixed `POST /integrations/connect` route does), not as a bare
-     * background action with no admin present to complete the OAuth screen.
+     * Meant to be called on behalf of a signed-in workspace admin (this is what
+     * the bridge's fixed `POST /integrations/connect` route does), not as a bare
+     * background action with no admin present to complete the OAuth screen. That
+     * is why `userId` is part of the input rather than inferred - see
+     * `InitiateIntegrationConnectionInput`.
      */
-    initiateConnect(workspaceId: string, toolkitSlug: string, returnUrl: string): Promise<InitiateIntegrationConnectionResponse>;
+    initiateConnect(workspaceId: string, input: InitiateIntegrationConnectionInput): Promise<InitiateIntegrationConnectionResponse>;
     /** Idempotent - disconnecting a toolkit that was never connected, or is already disconnected, is a success. */
     disconnect(workspaceId: string, toolkitSlug: string): Promise<DisconnectIntegrationResponse>;
     /** Calls a Composio action against this workspace's connected account for the named toolkit. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmoops/connect-sdk",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Official server-side SDK for the CosmoOps Connect platform API - Login with Connect, entitlements, billing and metering.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",