@crowdin/app-project-module 3.1.0 → 3.2.0

package/out/middlewares/crowdin-client.d.ts

@@ -1,13 +1,15 @@
-import Crowdin from '@crowdin/crowdin-api-client';
+import type Crowdin from '@crowdin/crowdin-api-client';
 import { Response } from 'express';
 import { Config, CrowdinClientRequest, CrowdinContextInfo, SubscriptionInfo } from '../types';
 import { LogErrorFunction, LogFunction } from '../util/logger';
-export declare function prepareCrowdinRequest({ jwtToken, config, optional, checkSubscriptionExpiration, moduleKey, }: {
+export declare function prepareCrowdinRequest({ jwtToken, config, optional, checkSubscriptionExpiration, moduleKey, crowdinToken, projectId, }: {
     jwtToken: string;
     config: Config;
     optional: boolean;
     checkSubscriptionExpiration: boolean;
     moduleKey: string[] | string | undefined;
+    crowdinToken?: string;
+    projectId?: number;
 }): Promise<{
     context: CrowdinContextInfo;
     logInfo: LogFunction;

package/out/middlewares/crowdin-client.js

@@ -20,8 +20,17 @@ const logger_1 = require("../util/logger");
 const subscription_1 = require("../util/subscription");
 const integration_access_denied_1 = require("./integration-access-denied");
 const token_1 = require("../util/app-functions/token");
+function assertModuleKey(moduleKey, jwtModule) {
+    if (!moduleKey || !jwtModule) {
+        return;
+    }
+    const matches = typeof moduleKey === 'string' ? moduleKey === jwtModule : moduleKey.includes(jwtModule);
+    if (!matches) {
+        throw new Error("Module key doesn't match");
+    }
+}
 function prepareCrowdinRequest(_a) {
-    return __awaiter(this, arguments, void 0, function* ({ jwtToken, config, optional = false, checkSubscriptionExpiration = true, moduleKey, }) {
+    return __awaiter(this, arguments, void 0, function* ({ jwtToken, config, optional = false, checkSubscriptionExpiration = true, moduleKey, crowdinToken, projectId, }) {
         (0, logger_1.log)('Validating jwt token from incoming request');
         const jwtPayload = yield (0, token_1.validateJwtToken)(jwtToken, config.clientSecret, config.jwtValidationOptions);
         const context = {
@@ -32,6 +41,29 @@ function prepareCrowdinRequest(_a) {
         };
         const logInfo = (0, logger_1.withContext)(context);
         const logError = (0, logger_1.withContextError)(context);
+        if (crowdinToken) {
+            logInfo('Using caller-supplied Crowdin token');
+            assertModuleKey(moduleKey, jwtPayload.module);
+            const client = yield (0, connection_1.buildCrowdinClientFromPat)({
+                config,
+                token: crowdinToken,
+                // For enterprise the org-specific URL implicitly restricts the token to this org.
+                // For Crowdin.com (no domain) we fall back to project-level access validation below.
+                organization: jwtPayload.domain || undefined,
+            });
+            try {
+                yield client.usersApi.getAuthenticatedUser();
+                // For non-enterprise (no domain) there is no org-scoped URL, so validate by
+                // checking that the PAT has access to the project named in the JWT / request.
+                if (!jwtPayload.domain && projectId) {
+                    yield client.projectsGroupsApi.getProject(projectId);
+                }
+            }
+            catch (_b) {
+                throw new util_1.CodeError('Supplied crowdinToken is invalid or does not belong to this organization', 403);
+            }
+            return { context, client, logInfo, logError };
+        }
         logInfo('Loading crowdin credentials');
         const credentials = yield (0, storage_1.getStorage)().getCrowdinCredentials(context.crowdinId);
         if (!credentials) {
@@ -40,14 +72,7 @@ function prepareCrowdinRequest(_a) {
             }
             throw new Error("Can't find organization by id");
         }
-        if (!!moduleKey && !!jwtPayload.module) {
-            if (typeof moduleKey === 'string' && moduleKey !== jwtPayload.module) {
-                throw new Error("Module key doesn't match");
-            }
-            if (Array.isArray(moduleKey) && !moduleKey.includes(jwtPayload.module)) {
-                throw new Error("Module key doesn't match");
-            }
-        }
+        assertModuleKey(moduleKey, jwtPayload.module);
         logInfo('Building crowdin client instance');
         const { client, token } = yield (0, connection_1.prepareCrowdinClient)({ config, credentials, autoRenew: true, context });
         let subscriptionInfo;
@@ -67,22 +92,25 @@ function prepareCrowdinRequest(_a) {
 }
 function handle({ config, optional = false, checkSubscriptionExpiration = true, moduleKey, isIntegration = false, isLogout = false, }) {
     return (0, util_1.runAsyncWrapper)((req, res, next) => __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
         const jwtToken = getToken(req);
         if (!jwtToken) {
             (0, logger_1.temporaryErrorDebug)('Access denied: crowdin-client', req);
             return res.status(403).send({ error: 'Access denied' });
         }
         try {
+            const isAgentCall = req.isApiCall && !!((_a = req.body) === null || _a === void 0 ? void 0 : _a.crowdinToken);
             const data = yield prepareCrowdinRequest({
                 jwtToken,
                 config,
                 optional,
                 checkSubscriptionExpiration,
                 moduleKey,
+                crowdinToken: isAgentCall ? req.body.crowdinToken : undefined,
+                projectId: isAgentCall ? (_b = req.body) === null || _b === void 0 ? void 0 : _b.projectId : undefined,
             });
-            if ((_a = config.api) === null || _a === void 0 ? void 0 : _a.default) {
-                if (req.isApiCall && !((_b = req.body) === null || _b === void 0 ? void 0 : _b.projectId)) {
+            if ((_c = config.api) === null || _c === void 0 ? void 0 : _c.default) {
+                if (req.isApiCall && !((_d = req.body) === null || _d === void 0 ? void 0 : _d.projectId)) {
                     return res.status(400).json({
                         error: {
                             message: 'Missing required parameter: projectId',
@@ -91,7 +119,10 @@ function handle({ config, optional = false, checkSubscriptionExpiration = true,
                 }
                 data.context = (0, api_1.updateCrowdinContext)(req, data.context);
             }
-            if (isIntegration && data.client) {
+            // Skip integration access check when the caller supplies their own credentials —
+            // integration-credentials middleware handles those via the injected path.
+            const hasInjectedIntegrationCreds = req.isApiCall && !!((_e = req.body) === null || _e === void 0 ? void 0 : _e.integrationCredentials);
+            if (isIntegration && data.client && !hasInjectedIntegrationCreds) {
                 const result = yield (0, connection_1.resolveIntegrationAccess)(data.context.clientId);
                 if (!result.integrationCredentials && !isLogout) {
                     const owners = yield (0, integration_access_denied_1.getIntegrationManagedBy)({
@@ -121,12 +152,18 @@ function handle({ config, optional = false, checkSubscriptionExpiration = true,
             req.subscriptionInfo = data.subscriptionInfo;
             req.logInfo = data.logInfo;
             req.logError = data.logError;
+            // Strip secrets from req.body so no downstream handler ever sees raw tokens.
+            // crowdinToken has been consumed; move integrationCredentials to a typed slot
+            // so the integration-credentials middleware can still pick it up.
+            req.injectedIntegrationCredentials = (_f = req.body) === null || _f === void 0 ? void 0 : _f.integrationCredentials;
+            (_g = req.body) === null || _g === void 0 ? true : delete _g.crowdinToken;
+            (_h = req.body) === null || _h === void 0 ? true : delete _h.integrationCredentials;
             next();
         }
         catch (e) {
             const errorMessage = (0, logger_1.getErrorMessage)(e);
             if (e instanceof util_1.CodeError) {
-                return res.status(402).send({ message: errorMessage || 'Error', code: e.code });
+                return res.status((_j = e.code) !== null && _j !== void 0 ? _j : 402).send({ message: errorMessage || 'Error', code: e.code });
             }
             (0, logger_1.logError)(e);
             return res.status(403).send({ error: errorMessage || 'Error' });

package/out/middlewares/integration-credentials.js

@@ -15,9 +15,42 @@ const storage_1 = require("../storage");
 const util_1 = require("../util");
 const connection_1 = require("../util/connection");
 const integration_access_denied_1 = require("./integration-access-denied");
+function loadIntegrationSettings(clientId, integration, req) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const integrationConfig = yield (0, storage_1.getStorage)().getIntegrationConfig(clientId);
+        let settings = (integrationConfig === null || integrationConfig === void 0 ? void 0 : integrationConfig.config) ? JSON.parse(integrationConfig.config) || {} : {};
+        if (integration.normalizeSettings) {
+            settings = yield integration.normalizeSettings({
+                settings,
+                credentials: req.integrationCredentials,
+                client: req.crowdinApiClient,
+            });
+        }
+        return settings;
+    });
+}
 function handle({ config, integration, optional = false, isLogout = false, }) {
     return (0, util_1.runAsyncWrapper)((req, res, next) => __awaiter(this, void 0, void 0, function* () {
         const isApiCall = req === null || req === void 0 ? void 0 : req.isApiCall;
+        // crowdin-client middleware moves integrationCredentials out of req.body before next(),
+        // so secrets are never visible to handlers. Read from the typed slot it left behind.
+        const rawInjected = req.injectedIntegrationCredentials;
+        if (isApiCall && rawInjected) {
+            delete req.injectedIntegrationCredentials;
+            req.logInfo('Using caller-supplied integration credentials');
+            req.integrationCredentials = typeof rawInjected === 'string' ? { accessToken: rawInjected } : rawInjected;
+            if (integration.checkConnection) {
+                try {
+                    yield integration.checkConnection(req.integrationCredentials);
+                }
+                catch (e) {
+                    return res.status(401).json({ error: { message: 'Supplied integrationCredentials are invalid' } });
+                }
+            }
+            const clientId = req.crowdinContext.clientId;
+            req.integrationSettings = yield loadIntegrationSettings(clientId, integration, req);
+            return next();
+        }
         req.logInfo(`Loading integration credentials for client ${req.crowdinContext.clientId}`);
         const { integrationCredentials: resolvedIntegrationCredentials, projectIntegrationCredentials, projectId, clientId: resolvedClientId, ownerIds, } = yield (0, connection_1.resolveIntegrationAccess)(req.crowdinContext.clientId);
         let integrationCredentials = resolvedIntegrationCredentials;
@@ -79,18 +112,7 @@ function handle({ config, integration, optional = false, isLogout = false, }) {
                 throw new util_1.CodeError(message, 401);
             }
         }
-        const integrationConfig = yield (0, storage_1.getStorage)().getIntegrationConfig(clientId);
-        if (integrationConfig === null || integrationConfig === void 0 ? void 0 : integrationConfig.config) {
-            let integrationSettings = JSON.parse(integrationConfig.config) || {};
-            if (integration.normalizeSettings) {
-                integrationSettings = yield integration.normalizeSettings({
-                    settings: integrationSettings,
-                    credentials: req.integrationCredentials,
-                    client: req.crowdinApiClient,
-                });
-            }
-            req.integrationSettings = integrationSettings;
-        }
+        req.integrationSettings = yield loadIntegrationSettings(clientId, integration, req);
         next();
     }));
 }

package/out/modules/integration/handlers/crowdin-files.js

@@ -13,11 +13,24 @@ exports.default = handle;
 const util_1 = require("../../../util");
 const defaults_1 = require("../util/defaults");
 const logger_1 = require("../../../util/logger");
+const types_1 = require("../types");
 const files_1 = require("../util/files");
+const storage_1 = require("../../../storage");
 function handle(config, integration) {
     return (0, util_1.runAsyncWrapper)((req, res) => __awaiter(this, void 0, void 0, function* () {
-        var _a;
+        var _a, _b;
         const mode = (_a = req.query) === null || _a === void 0 ? void 0 : _a.mode;
+        const externalId = (_b = req.query) === null || _b === void 0 ? void 0 : _b.externalId;
+        // Reverse lookup: given an integration file ID, return the mapped Crowdin file entry.
+        if (externalId) {
+            const syncedData = yield (0, storage_1.getStorage)().getSyncedData(req.crowdinContext.clientId, req.crowdinContext.crowdinId, types_1.Provider.INTEGRATION);
+            const syncedFiles = (syncedData === null || syncedData === void 0 ? void 0 : syncedData.files) ? JSON.parse(syncedData.files) : [];
+            const entry = syncedFiles.find((f) => f.id === externalId);
+            if (!(entry === null || entry === void 0 ? void 0 : entry.crowdinFileId)) {
+                return res.status(404).json({ error: { message: 'No Crowdin file mapped to this external ID' } });
+            }
+            return res.json({ id: String(entry.crowdinFileId), externalFileId: externalId });
+        }
         req.logInfo(`Loading crowdin files${mode ? ` (mode: ${mode})` : ''}`);
         if (integration.getCrowdinFiles) {
             const rootFolder = yield (0, defaults_1.getRootFolder)(config, integration, req.crowdinApiClient, req.crowdinContext.jwtPayload.context.project_id);
@@ -41,6 +54,26 @@ function handle(config, integration) {
                         files,
                     });
                 }
+                // Path B: populate externalFileId from stored integrationFileId→crowdinFileId mapping
+                // for files where the app developer hasn't supplied it directly (Path A).
+                // A leaf is either a typed file or explicitly flagged with nodeType '1';
+                // folders (nodeType '0') and branches (nodeType '2') without a type are skipped.
+                const isFileLeaf = (f) => f.type !== undefined || f.nodeType === '1';
+                const needsMapping = files.some((f) => isFileLeaf(f) && !f.externalFileId);
+                if (needsMapping) {
+                    const syncedData = yield (0, storage_1.getStorage)().getSyncedData(req.crowdinContext.clientId, req.crowdinContext.crowdinId, types_1.Provider.INTEGRATION);
+                    if (syncedData === null || syncedData === void 0 ? void 0 : syncedData.files) {
+                        const syncedFiles = JSON.parse(syncedData.files);
+                        const byCrowdinFileId = new Map(syncedFiles
+                            .filter((e) => e.crowdinFileId !== null && e.crowdinFileId !== undefined)
+                            .map((e) => [String(e.crowdinFileId), e.id]));
+                        if (byCrowdinFileId.size > 0) {
+                            files = files.map((f) => !isFileLeaf(f) || f.externalFileId || !byCrowdinFileId.has(f.id)
+                                ? f
+                                : Object.assign(Object.assign({}, f), { externalFileId: byCrowdinFileId.get(f.id) }));
+                        }
+                    }
+                }
                 req.logInfo(`Returning ${files.length} items`);
                 res.send(files);
             }

package/out/modules/integration/types.d.ts

@@ -451,6 +451,7 @@ export interface BaseTreeItem {
     path?: string;
     type?: string;
     syncedAt?: string;
+    externalFileId?: string;
 }
 export interface File extends BaseTreeItem {
     type: SourceFilesModel.FileType;

package/out/types.d.ts

@@ -408,6 +408,7 @@ export interface CrowdinClientRequest extends Request {
     logInfo: LogFunction;
     logError: LogErrorFunction;
     isApiCall?: boolean;
+    injectedIntegrationCredentials?: any;
 }
 export interface CrowdinCredentials {
     id: string;

package/out/util/connection.d.ts

@@ -17,5 +17,10 @@ export interface IntegrationAccessResult {
     clientId: string;
     ownerIds: number[];
 }
+export declare function buildCrowdinClientFromPat({ config, token, organization, }: {
+    config: Config;
+    token: string;
+    organization?: string;
+}): Promise<Crowdin>;
 export declare function resolveIntegrationAccess(clientId: string): Promise<IntegrationAccessResult>;
 export declare function prepareIntegrationCredentials(config: Config, integration: IntegrationLogic, integrationCredentials: IntegrationCredentials): Promise<any>;

package/out/util/connection.js

@@ -46,6 +46,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.prepareCrowdinClient = prepareCrowdinClient;
+exports.buildCrowdinClientFromPat = buildCrowdinClientFromPat;
 exports.resolveIntegrationAccess = resolveIntegrationAccess;
 exports.prepareIntegrationCredentials = prepareIntegrationCredentials;
 const crowdin_api_client_1 = __importDefault(require("@crowdin/crowdin-api-client"));
@@ -256,6 +257,12 @@ function prepareCrowdinClient(_a) {
         };
     });
 }
+function buildCrowdinClientFromPat(_a) {
+    return __awaiter(this, arguments, void 0, function* ({ config, token, organization, }) {
+        var _b;
+        return new crowdin_api_client_1.default({ token, organization, apiDomain: (_b = config.crowdinUrls) === null || _b === void 0 ? void 0 : _b.apiDomain });
+    });
+}
 function resolveIntegrationAccess(clientId) {
     return __awaiter(this, void 0, void 0, function* () {
         const { organization, projectId, userId } = (0, token_1.parseCrowdinId)(clientId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crowdin/app-project-module",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "Module that generates for you all common endpoints for serving standalone Crowdin App",
   "main": "out/index.js",
   "types": "out/index.d.ts",