@elevasis/core 0.1.0

package/src/integrations/credentials/__tests__/schemas.test.ts

@@ -0,0 +1,82 @@
+import { describe, it, expect } from 'vitest'
+import { CREDENTIAL_SCHEMAS, getCredentialSchema, listCredentialSchemas, getCredentialTypes } from '../schemas'
+
+describe('Credential Schema Registry', () => {
+  describe('CREDENTIAL_SCHEMAS', () => {
+    it('should have OAuth schemas', () => {
+      expect(CREDENTIAL_SCHEMAS['google-sheets']).toBeDefined()
+      expect(CREDENTIAL_SCHEMAS['google-sheets'].type).toBe('oauth')
+      expect(CREDENTIAL_SCHEMAS['google-sheets'].oauthProvider).toBe('google-sheets')
+
+      expect(CREDENTIAL_SCHEMAS.dropbox).toBeDefined()
+      expect(CREDENTIAL_SCHEMAS.dropbox.type).toBe('oauth')
+      expect(CREDENTIAL_SCHEMAS.dropbox.oauthProvider).toBe('dropbox')
+    })
+
+    it('should have api-key single-field schema', () => {
+      expect(CREDENTIAL_SCHEMAS['api-key']).toBeDefined()
+      expect(CREDENTIAL_SCHEMAS['api-key'].type).toBe('single_field')
+      expect(CREDENTIAL_SCHEMAS['api-key'].fields).toHaveLength(1)
+      expect(CREDENTIAL_SCHEMAS['api-key'].fields?.[0].key).toBe('apiKey')
+    })
+  })
+
+  describe('getCredentialSchema', () => {
+    it('should return schema for valid type', () => {
+      const schema = getCredentialSchema('google-sheets')
+      expect(schema).toStrictEqual(CREDENTIAL_SCHEMAS['google-sheets'])
+    })
+
+    it('should return api-key schema for unknown type', () => {
+      const schema = getCredentialSchema('unknown')
+      expect(schema).toStrictEqual(CREDENTIAL_SCHEMAS['api-key'])
+    })
+
+    it('should validate schema with Zod', () => {
+      // Should not throw - schemas are valid
+      expect(() => getCredentialSchema('google-sheets')).not.toThrow()
+      expect(() => getCredentialSchema('api-key')).not.toThrow()
+    })
+
+    it('should return OAuth schemas correctly', () => {
+      const googleSheetsSchema = getCredentialSchema('google-sheets')
+      expect(googleSheetsSchema.type).toBe('oauth')
+      expect(googleSheetsSchema.oauthProvider).toBe('google-sheets')
+      expect(googleSheetsSchema.fields).toBeUndefined()
+    })
+  })
+
+  describe('listCredentialSchemas', () => {
+    it('should return all schemas as array', () => {
+      const schemas = listCredentialSchemas()
+      expect(schemas.length).toBeGreaterThan(0)
+      expect(schemas).toContainEqual(CREDENTIAL_SCHEMAS['google-sheets'])
+      expect(schemas).toContainEqual(CREDENTIAL_SCHEMAS['api-key'])
+    })
+
+    it('should return array with correct schema structure', () => {
+      const schemas = listCredentialSchemas()
+      schemas.forEach((schema) => {
+        expect(schema).toHaveProperty('type')
+        expect(schema).toHaveProperty('label')
+        expect(schema).toHaveProperty('description')
+        expect(schema).toHaveProperty('nameSuggestions')
+      })
+    })
+  })
+
+  describe('getCredentialTypes', () => {
+    it('should return all type keys', () => {
+      const types = getCredentialTypes()
+      expect(types).toContain('dropbox')
+      expect(types).toContain('google-sheets')
+      expect(types).toContain('api-key')
+    })
+
+    it('should return unique types', () => {
+      const types = getCredentialTypes()
+      const uniqueTypes = [...new Set(types)]
+      expect(types).toEqual(uniqueTypes)
+    })
+  })
+})

package/src/integrations/credentials/__tests__/utils.test.ts

@@ -0,0 +1,144 @@
+import { describe, it, expect } from 'vitest'
+import { buildCredentialValue, extractFormValues } from '../utils'
+
+describe('Credential Utilities', () => {
+  describe('buildCredentialValue', () => {
+    it('should build single-field credential value', () => {
+      const result = buildCredentialValue('api-key', {
+        apiKey: 'test-key-123'
+      })
+      expect(result).toEqual({ apiKey: 'test-key-123' })
+    })
+
+    it('should trim whitespace from values', () => {
+      const result = buildCredentialValue('api-key', {
+        apiKey: '  test-key  '
+      })
+      expect(result).toEqual({ apiKey: 'test-key' })
+    })
+
+    it('should throw error for OAuth types', () => {
+      expect(() => buildCredentialValue('dropbox', { apiKey: 'test' })).toThrow(
+        'buildCredentialValue should not be used for OAuth type: dropbox'
+      )
+
+      expect(() => buildCredentialValue('google-sheets', { apiKey: 'test' })).toThrow(
+        'buildCredentialValue should not be used for OAuth type: google-sheets'
+      )
+    })
+
+    it('should ignore undefined and null values', () => {
+      const result = buildCredentialValue('api-key', {
+        apiKey: 'valid-key',
+        extra: undefined as unknown,
+        another: null as unknown
+      })
+      // Only includes defined fields from schema
+      expect(result).toEqual({
+        apiKey: 'valid-key'
+      })
+    })
+
+    it('should only include fields defined in schema', () => {
+      const result = buildCredentialValue('api-key', {
+        apiKey: 'test-key',
+        extraField: 'should-not-be-included'
+      })
+      // Only apiKey is in api-key schema
+      expect(result).toEqual({ apiKey: 'test-key' })
+    })
+
+    it('should build webhook-secret credential with signingSecret field', () => {
+      const result = buildCredentialValue('webhook-secret', {
+        signingSecret: 'whsec_abc123'
+      })
+      // webhook-secret schema uses 'signingSecret' key (matches gateway.ts lookup)
+      expect(result).toEqual({ signingSecret: 'whsec_abc123' })
+    })
+
+    it('should trim whitespace from webhook-secret signingSecret', () => {
+      const result = buildCredentialValue('webhook-secret', {
+        signingSecret: '  whsec_abc123  '
+      })
+      expect(result).toEqual({ signingSecret: 'whsec_abc123' })
+    })
+  })
+
+  describe('extractFormValues', () => {
+    it('should extract string values from credential object', () => {
+      const credentialValue = {
+        apiKey: 'test-key',
+        token: 'test-token'
+      }
+      const result = extractFormValues(credentialValue)
+      expect(result).toEqual({
+        apiKey: 'test-key',
+        token: 'test-token'
+      })
+    })
+
+    it('should convert non-string values to strings', () => {
+      const credentialValue = {
+        apiKey: 'test-key',
+        count: 123,
+        enabled: true
+      }
+      const result = extractFormValues(credentialValue)
+      expect(result).toEqual({
+        apiKey: 'test-key',
+        count: '123',
+        enabled: 'true'
+      })
+    })
+
+    it('should skip null and undefined values', () => {
+      const credentialValue = {
+        apiKey: 'test-key',
+        nullField: null,
+        undefinedField: undefined
+      }
+      const result = extractFormValues(credentialValue)
+      expect(result).toEqual({
+        apiKey: 'test-key'
+      })
+    })
+
+    it('should handle empty objects', () => {
+      const result = extractFormValues({})
+      expect(result).toEqual({})
+    })
+
+    it('should handle nested objects by converting to string', () => {
+      const credentialValue = {
+        apiKey: 'test-key',
+        metadata: { nested: 'value' }
+      }
+      const result = extractFormValues(credentialValue)
+      expect(result.apiKey).toBe('test-key')
+      expect(result.metadata).toBe('[object Object]')
+    })
+  })
+
+  describe('Integration: Round-trip conversion', () => {
+    it('should preserve single-field credentials through round-trip', () => {
+      const original = { apiKey: 'test-key-123' }
+      const formValues = extractFormValues(original)
+      const rebuilt = buildCredentialValue('api-key', formValues)
+      expect(rebuilt).toEqual(original)
+    })
+
+    it('should handle whitespace during round-trip', () => {
+      const original = { apiKey: 'test-key' }
+      const formValuesWithSpace = { apiKey: '  test-key  ' }
+      const rebuilt = buildCredentialValue('api-key', formValuesWithSpace)
+      expect(rebuilt).toEqual(original)
+    })
+
+    it('should preserve webhook-secret credentials through round-trip', () => {
+      const original = { signingSecret: 'whsec_abc123' }
+      const formValues = extractFormValues(original)
+      const rebuilt = buildCredentialValue('webhook-secret', formValues)
+      expect(rebuilt).toEqual(original)
+    })
+  })
+})

package/src/integrations/credentials/api-schemas.ts

@@ -0,0 +1,143 @@
+import { z } from 'zod'
+import { UuidSchema, CredentialNameSchema } from '../../platform/utils/validation'
+
+/**
+ * Credential API Validation Schemas
+ *
+ * Separate from credential configuration schemas (schemas.ts).
+ * - schemas.ts: Credential field definitions and type registry
+ * - api-schemas.ts: HTTP request/response validation
+ *
+ * Design: Input Validation Standardization
+ * @see apps/docs/content/docs/in-progress/active-development/security/active/credentials-integrations-validation-implementation.mdx
+ */
+
+/**
+ * Credential type validation
+ * These are the actual `type` values stored in the database:
+ * - 'oauth': All OAuth providers (notion, google-sheets) store this type
+ * - 'api-key': Generic single-field API key credentials
+ * - 'webhook-secret': Webhook signing secrets for signature validation
+ *
+ * Note: Provider-specific identifiers (notion, google-sheets) are CREDENTIAL_SCHEMAS
+ * keys used for UI lookup, NOT stored type values. OAuth credentials store type='oauth'.
+ */
+export const CredentialTypeSchema = z.enum(['oauth', 'api-key', 'webhook-secret', 'api-key-secret'])
+
+/**
+ * Credential value validation
+ * - Must be a non-empty object
+ * - Keys are strings, values can be any JSON type
+ * - Max 50 keys (prevents DoS)
+ * - Individual string values max 10KB (prevents DoS)
+ *
+ * SECURITY:
+ * - Prevents DoS via massive credential payloads
+ * - Enforces reasonable limits for credential storage
+ */
+const CredentialValueSchema = z
+  .record(z.string(), z.unknown())
+  .refine((val) => Object.keys(val).length > 0, { message: 'Credential value must not be empty' })
+  .refine((val) => Object.keys(val).length <= 50, { message: 'Credential value has too many keys (max 50)' })
+  .refine(
+    (val) => {
+      // Check individual string values for size
+      for (const v of Object.values(val)) {
+        if (typeof v === 'string' && v.length > 10240) {
+          return false
+        }
+      }
+      return true
+    },
+    { message: 'Individual credential values too large (max 10KB per string)' }
+  )
+
+/**
+ * POST /api/credentials - Create credential
+ */
+export const CreateCredentialRequestSchema = z
+  .object({
+    name: CredentialNameSchema,
+    type: CredentialTypeSchema,
+    value: CredentialValueSchema,
+    provider: z.string().optional() // OAuth provider ID ('dropbox', 'notion', 'google-sheets')
+  })
+  .strict() // Reject unknown fields (prevents mass assignment)
+
+/**
+ * Response for credential creation
+ */
+export const CreateCredentialResponseSchema = z.object({
+  id: UuidSchema,
+  name: z.string()
+})
+
+/**
+ * GET /api/credentials - List credentials
+ */
+export const ListCredentialsResponseSchema = z.object({
+  credentials: z.array(
+    z.object({
+      id: UuidSchema,
+      name: z.string(),
+      type: z.string(),
+      provider: z.string().nullable(), // OAuth provider or null for non-OAuth
+      createdAt: z.string().datetime()
+    })
+  )
+})
+
+/** API response type for a single credential list item */
+export type CredentialListItem = z.infer<typeof ListCredentialsResponseSchema>['credentials'][number]
+
+/**
+ * PATCH /api/credentials/:credentialId - Update credential
+ */
+export const UpdateCredentialParamsSchema = z.object({
+  credentialId: UuidSchema
+})
+
+export const UpdateCredentialRequestSchema = z
+  .object({
+    value: CredentialValueSchema.optional(),
+    name: CredentialNameSchema.optional()
+  })
+  .strict()
+  .refine((data) => data.value !== undefined || data.name !== undefined, {
+    message: 'At least one field (value or name) must be provided'
+  })
+
+/**
+ * DELETE /api/credentials/:credentialId - Delete credential
+ */
+export const DeleteCredentialParamsSchema = z.object({
+  credentialId: UuidSchema
+})
+
+/**
+ * GET /api/credentials/:credentialName/decrypt - CRITICAL ENDPOINT
+ * Decrypt credential value for agent/tool use
+ *
+ * SECURITY: credentialName validated with strict regex to prevent path traversal
+ */
+export const DecryptCredentialParamsSchema = z.object({
+  credentialName: CredentialNameSchema
+})
+
+export const DecryptCredentialResponseSchema = z.object({
+  value: z.record(z.string(), z.unknown())
+})
+
+/**
+ * Export all schemas for use in routes
+ */
+export const CredentialSchemas = {
+  CreateRequest: CreateCredentialRequestSchema,
+  CreateResponse: CreateCredentialResponseSchema,
+  ListResponse: ListCredentialsResponseSchema,
+  UpdateParams: UpdateCredentialParamsSchema,
+  UpdateRequest: UpdateCredentialRequestSchema,
+  DeleteParams: DeleteCredentialParamsSchema,
+  DecryptParams: DecryptCredentialParamsSchema,
+  DecryptResponse: DecryptCredentialResponseSchema
+}

package/src/integrations/credentials/index.ts

@@ -0,0 +1,32 @@
+/**
+ * Credential Type System
+ *
+ * Dynamic credential form system with type-based field rendering.
+ *
+ * Usage:
+ * - Add new integration → Update CREDENTIAL_SCHEMAS registry
+ * - No modal changes needed
+ *
+ * @example
+ * ```typescript
+ * import { getCredentialSchema, buildCredentialValue } from '@repo/core'
+ *
+ * const schema = getCredentialSchema('attio')
+ * const value = buildCredentialValue('api-key', { apiKey: '...' })
+ * ```
+ */
+
+export {
+  CREDENTIAL_SCHEMAS,
+  getCredentialSchema,
+  listCredentialSchemas,
+  getCredentialTypes,
+} from './schemas'
+
+export type { CredentialSchema, CredentialField } from './schemas'
+
+export { buildCredentialValue, extractFormValues } from './utils'
+
+// API validation schemas
+export * from './api-schemas'
+export { CredentialSchemas } from './api-schemas'

package/src/integrations/credentials/schemas.ts

@@ -0,0 +1,164 @@
+import { z } from 'zod'
+
+/**
+ * Credential field definition
+ */
+export interface CredentialField {
+  key: string
+  label: string
+  type: 'password' | 'text'
+  required: boolean
+  placeholder?: string
+  description?: string
+}
+
+/**
+ * Credential schema definition
+ */
+export interface CredentialSchema {
+  type: string
+  label: string
+  description: string
+  fields?: CredentialField[]
+  docsUrl?: string
+  nameSuggestions: string[]
+  oauthProvider?: string // For OAuth types
+}
+
+/**
+ * Zod schemas for runtime validation
+ */
+const CredentialFieldSchema = z.object({
+  key: z.string(),
+  label: z.string(),
+  type: z.enum(['password', 'text']),
+  required: z.boolean(),
+  placeholder: z.string().optional(),
+  description: z.string().optional()
+})
+
+const CredentialSchemaZod = z.object({
+  type: z.string(),
+  label: z.string(),
+  description: z.string(),
+  fields: z.array(CredentialFieldSchema).optional(),
+  docsUrl: z.string().url().optional(),
+  nameSuggestions: z.array(z.string()),
+  oauthProvider: z.string().optional()
+})
+
+/**
+ * Credential Schema Registry
+ *
+ * Add new integration = add schema object here (no modal changes needed)
+ *
+ * Schema types:
+ * - oauth: OAuth-based authentication (handled via OAuth flow)
+ * - single_field: Single API key field (generic)
+ */
+export const CREDENTIAL_SCHEMAS: Record<string, CredentialSchema> = {
+  'google-sheets': {
+    type: 'oauth',
+    label: 'Google Sheets',
+    description: 'Google Sheets OAuth integration',
+    oauthProvider: 'google-sheets',
+    nameSuggestions: ['google-sheets-prod', 'google-sheets-dev', 'sheets-workspace']
+  },
+
+  dropbox: {
+    type: 'oauth',
+    label: 'Dropbox',
+    description: 'Dropbox OAuth integration',
+    oauthProvider: 'dropbox',
+    nameSuggestions: ['dropbox-prod', 'dropbox-dev', 'elevasis-dropbox']
+  },
+
+  oauth: {
+    type: 'oauth',
+    label: 'OAuth',
+    description: 'Generic OAuth credential',
+    nameSuggestions: []
+  },
+
+  'api-key': {
+    type: 'single_field',
+    label: 'API Key',
+    description: 'Single-field API key credential',
+    fields: [
+      {
+        key: 'apiKey',
+        label: 'API Key',
+        type: 'password',
+        required: true,
+        placeholder: 'Enter your API key',
+        description: 'API key for the service'
+      }
+    ],
+    nameSuggestions: ['service-prod', 'service-dev', 'api-key']
+  },
+
+  'webhook-secret': {
+    type: 'single_field',
+    label: 'Webhook Secret',
+    description: 'Webhook signing secret for signature validation',
+    fields: [
+      {
+        key: 'signingSecret',
+        label: 'Signing Secret',
+        type: 'password',
+        required: true,
+        placeholder: 'whsec_...',
+        description: 'Webhook signing secret from provider dashboard'
+      }
+    ],
+    nameSuggestions: ['my-org-cal-com-webhook', 'my-org-stripe-webhook', 'my-org-signature-api-webhook']
+  },
+
+  'api-key-secret': {
+    type: 'api-key-secret',
+    label: 'API Key + Secret',
+    description: 'API key and secret pair authentication',
+    fields: [
+      {
+        key: 'apiKey',
+        label: 'API Key',
+        type: 'password',
+        required: true
+      },
+      {
+        key: 'apiSecret',
+        label: 'API Secret',
+        type: 'password',
+        required: true
+      }
+    ],
+    nameSuggestions: []
+  }
+}
+
+/**
+ * Get credential schema by type
+ * @param type - Credential type identifier
+ * @returns Validated credential schema
+ * @throws ZodError if schema is malformed
+ */
+export function getCredentialSchema(type: string): CredentialSchema {
+  const schema = CREDENTIAL_SCHEMAS[type] || CREDENTIAL_SCHEMAS['api-key']
+  return CredentialSchemaZod.parse(schema)
+}
+
+/**
+ * List all available credential types (for frontend dropdown)
+ * @returns Array of credential schemas
+ */
+export function listCredentialSchemas(): CredentialSchema[] {
+  return Object.values(CREDENTIAL_SCHEMAS)
+}
+
+/**
+ * Get all credential type identifiers
+ * @returns Array of type strings
+ */
+export function getCredentialTypes(): string[] {
+  return Object.keys(CREDENTIAL_SCHEMAS)
+}

package/src/integrations/credentials/utils.ts

@@ -0,0 +1,59 @@
+import { getCredentialSchema } from './schemas'
+
+/**
+ * Build credential value object from form values
+ *
+ * Constructs the credential value object based on the schema's field definitions:
+ * - Single field: { apiKey: "..." }
+ * - Multi field: { apiKey: "...", token: "..." }
+ * - OAuth: Not used (OAuth flow handles this)
+ *
+ * @param type - Credential type identifier
+ * @param formValues - Form field values (key-value pairs)
+ * @returns Credential value object ready for API submission
+ */
+export function buildCredentialValue(type: string, formValues: Record<string, string>): Record<string, unknown> {
+  const schema = getCredentialSchema(type)
+
+  // OAuth types shouldn't use this function (handled via OAuth flow)
+  if (schema.type === 'oauth') {
+    throw new Error(`buildCredentialValue should not be used for OAuth type: ${type}`)
+  }
+
+  // Build value object from schema fields
+  const value: Record<string, unknown> = {}
+
+  if (schema.fields) {
+    for (const field of schema.fields) {
+      const fieldValue = formValues[field.key]
+      if (fieldValue !== undefined && fieldValue !== null) {
+        value[field.key] = fieldValue.trim()
+      }
+    }
+  }
+
+  return value
+}
+
+/**
+ * Extract form field values from credential value object
+ *
+ * Inverse of buildCredentialValue - used in Edit modal to populate form fields
+ *
+ * @param credentialValue - Credential value object from database
+ * @returns Form field values (key-value pairs)
+ */
+export function extractFormValues(credentialValue: Record<string, unknown>): Record<string, string> {
+  const formValues: Record<string, string> = {}
+
+  for (const [key, value] of Object.entries(credentialValue)) {
+    if (typeof value === 'string') {
+      formValues[key] = value
+    } else if (value !== null && value !== undefined) {
+      // Convert non-string values to strings for form inputs
+      formValues[key] = String(value)
+    }
+  }
+
+  return formValues
+}

package/src/integrations/oauth/__tests__/provider-registry.test.ts

@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'vitest'
+import { OAUTH_PROVIDERS, getProviderConfig, listProviders } from '../provider-registry'
+
+describe('OAuth Provider Registry', () => {
+  describe('OAUTH_PROVIDERS', () => {
+    it('should have Google Sheets configured', () => {
+      expect(OAUTH_PROVIDERS['google-sheets']).toBeDefined()
+      expect(OAUTH_PROVIDERS['google-sheets'].id).toBe('google-sheets')
+      expect(OAUTH_PROVIDERS['google-sheets'].name).toBe('Google Sheets')
+      expect(OAUTH_PROVIDERS['google-sheets'].authUrl).toBe('https://accounts.google.com/o/oauth2/v2/auth')
+      expect(OAUTH_PROVIDERS['google-sheets'].tokenUrl).toBe('https://oauth2.googleapis.com/token')
+      expect(OAUTH_PROVIDERS['google-sheets'].tokenExchange).toBe('form-encoded')
+      expect(OAUTH_PROVIDERS['google-sheets'].authParams).toEqual({
+        access_type: 'offline',
+        prompt: 'consent'
+      })
+      expect(OAUTH_PROVIDERS['google-sheets'].scopes).toContain('https://www.googleapis.com/auth/spreadsheets')
+    })
+
+    it('should use correct token exchange methods', () => {
+      // Verify Google Sheets uses form-encoded (standard OAuth 2.0)
+      expect(OAUTH_PROVIDERS['google-sheets'].tokenExchange).toBe('form-encoded')
+
+      // Verify Dropbox uses form-encoded
+      expect(OAUTH_PROVIDERS.dropbox.tokenExchange).toBe('form-encoded')
+    })
+  })
+
+  describe('getProviderConfig', () => {
+    it('should return config for valid provider', () => {
+      const config = getProviderConfig('google-sheets')
+      expect(config).toBe(OAUTH_PROVIDERS['google-sheets'])
+    })
+
+    it('should throw for unknown provider', () => {
+      expect(() => getProviderConfig('unknown')).toThrow('Unknown OAuth provider: unknown')
+    })
+  })
+
+  describe('listProviders', () => {
+    it('should return all providers as array', () => {
+      const providers = listProviders()
+      expect(providers).toHaveLength(2)
+      expect(providers).toContainEqual(OAUTH_PROVIDERS['google-sheets'])
+      expect(providers).toContainEqual(OAUTH_PROVIDERS.dropbox)
+    })
+
+    it('should return array with correct provider structure', () => {
+      const providers = listProviders()
+      providers.forEach((provider) => {
+        expect(provider).toHaveProperty('id')
+        expect(provider).toHaveProperty('name')
+        expect(provider).toHaveProperty('authUrl')
+        expect(provider).toHaveProperty('tokenUrl')
+        expect(provider).toHaveProperty('tokenExchange')
+      })
+    })
+  })
+})