@elevasis/core 0.7.1 → 0.8.0

package/src/integrations/credentials/__tests__/utils.test.ts

@@ -1,144 +1,144 @@
-import { describe, it, expect } from 'vitest'
-import { buildCredentialValue, extractFormValues } from '../utils'
-
-describe('Credential Utilities', () => {
-  describe('buildCredentialValue', () => {
-    it('should build single-field credential value', () => {
-      const result = buildCredentialValue('api-key', {
-        apiKey: 'test-key-123'
-      })
-      expect(result).toEqual({ apiKey: 'test-key-123' })
-    })
-
-    it('should trim whitespace from values', () => {
-      const result = buildCredentialValue('api-key', {
-        apiKey: '  test-key  '
-      })
-      expect(result).toEqual({ apiKey: 'test-key' })
-    })
-
-    it('should throw error for OAuth types', () => {
-      expect(() => buildCredentialValue('dropbox', { apiKey: 'test' })).toThrow(
-        'buildCredentialValue should not be used for OAuth type: dropbox'
-      )
-
-      expect(() => buildCredentialValue('google-sheets', { apiKey: 'test' })).toThrow(
-        'buildCredentialValue should not be used for OAuth type: google-sheets'
-      )
-    })
-
-    it('should ignore undefined and null values', () => {
-      const result = buildCredentialValue('api-key', {
-        apiKey: 'valid-key',
-        extra: undefined as unknown,
-        another: null as unknown
-      })
-      // Only includes defined fields from schema
-      expect(result).toEqual({
-        apiKey: 'valid-key'
-      })
-    })
-
-    it('should only include fields defined in schema', () => {
-      const result = buildCredentialValue('api-key', {
-        apiKey: 'test-key',
-        extraField: 'should-not-be-included'
-      })
-      // Only apiKey is in api-key schema
-      expect(result).toEqual({ apiKey: 'test-key' })
-    })
-
-    it('should build webhook-secret credential with signingSecret field', () => {
-      const result = buildCredentialValue('webhook-secret', {
-        signingSecret: 'whsec_abc123'
-      })
-      // webhook-secret schema uses 'signingSecret' key (matches gateway.ts lookup)
-      expect(result).toEqual({ signingSecret: 'whsec_abc123' })
-    })
-
-    it('should trim whitespace from webhook-secret signingSecret', () => {
-      const result = buildCredentialValue('webhook-secret', {
-        signingSecret: '  whsec_abc123  '
-      })
-      expect(result).toEqual({ signingSecret: 'whsec_abc123' })
-    })
-  })
-
-  describe('extractFormValues', () => {
-    it('should extract string values from credential object', () => {
-      const credentialValue = {
-        apiKey: 'test-key',
-        token: 'test-token'
-      }
-      const result = extractFormValues(credentialValue)
-      expect(result).toEqual({
-        apiKey: 'test-key',
-        token: 'test-token'
-      })
-    })
-
-    it('should convert non-string values to strings', () => {
-      const credentialValue = {
-        apiKey: 'test-key',
-        count: 123,
-        enabled: true
-      }
-      const result = extractFormValues(credentialValue)
-      expect(result).toEqual({
-        apiKey: 'test-key',
-        count: '123',
-        enabled: 'true'
-      })
-    })
-
-    it('should skip null and undefined values', () => {
-      const credentialValue = {
-        apiKey: 'test-key',
-        nullField: null,
-        undefinedField: undefined
-      }
-      const result = extractFormValues(credentialValue)
-      expect(result).toEqual({
-        apiKey: 'test-key'
-      })
-    })
-
-    it('should handle empty objects', () => {
-      const result = extractFormValues({})
-      expect(result).toEqual({})
-    })
-
-    it('should handle nested objects by converting to string', () => {
-      const credentialValue = {
-        apiKey: 'test-key',
-        metadata: { nested: 'value' }
-      }
-      const result = extractFormValues(credentialValue)
-      expect(result.apiKey).toBe('test-key')
-      expect(result.metadata).toBe('[object Object]')
-    })
-  })
-
-  describe('Integration: Round-trip conversion', () => {
-    it('should preserve single-field credentials through round-trip', () => {
-      const original = { apiKey: 'test-key-123' }
-      const formValues = extractFormValues(original)
-      const rebuilt = buildCredentialValue('api-key', formValues)
-      expect(rebuilt).toEqual(original)
-    })
-
-    it('should handle whitespace during round-trip', () => {
-      const original = { apiKey: 'test-key' }
-      const formValuesWithSpace = { apiKey: '  test-key  ' }
-      const rebuilt = buildCredentialValue('api-key', formValuesWithSpace)
-      expect(rebuilt).toEqual(original)
-    })
-
-    it('should preserve webhook-secret credentials through round-trip', () => {
-      const original = { signingSecret: 'whsec_abc123' }
-      const formValues = extractFormValues(original)
-      const rebuilt = buildCredentialValue('webhook-secret', formValues)
-      expect(rebuilt).toEqual(original)
-    })
-  })
-})
+import { describe, it, expect } from 'vitest'
+import { buildCredentialValue, extractFormValues } from '../utils'
+
+describe('Credential Utilities', () => {
+  describe('buildCredentialValue', () => {
+    it('should build single-field credential value', () => {
+      const result = buildCredentialValue('api-key', {
+        apiKey: 'test-key-123'
+      })
+      expect(result).toEqual({ apiKey: 'test-key-123' })
+    })
+
+    it('should trim whitespace from values', () => {
+      const result = buildCredentialValue('api-key', {
+        apiKey: '  test-key  '
+      })
+      expect(result).toEqual({ apiKey: 'test-key' })
+    })
+
+    it('should throw error for OAuth types', () => {
+      expect(() => buildCredentialValue('dropbox', { apiKey: 'test' })).toThrow(
+        'buildCredentialValue should not be used for OAuth type: dropbox'
+      )
+
+      expect(() => buildCredentialValue('google-sheets', { apiKey: 'test' })).toThrow(
+        'buildCredentialValue should not be used for OAuth type: google-sheets'
+      )
+    })
+
+    it('should ignore undefined and null values', () => {
+      const result = buildCredentialValue('api-key', {
+        apiKey: 'valid-key',
+        extra: undefined as unknown,
+        another: null as unknown
+      })
+      // Only includes defined fields from schema
+      expect(result).toEqual({
+        apiKey: 'valid-key'
+      })
+    })
+
+    it('should only include fields defined in schema', () => {
+      const result = buildCredentialValue('api-key', {
+        apiKey: 'test-key',
+        extraField: 'should-not-be-included'
+      })
+      // Only apiKey is in api-key schema
+      expect(result).toEqual({ apiKey: 'test-key' })
+    })
+
+    it('should build webhook-secret credential with signingSecret field', () => {
+      const result = buildCredentialValue('webhook-secret', {
+        signingSecret: 'whsec_abc123'
+      })
+      // webhook-secret schema uses 'signingSecret' key (matches gateway.ts lookup)
+      expect(result).toEqual({ signingSecret: 'whsec_abc123' })
+    })
+
+    it('should trim whitespace from webhook-secret signingSecret', () => {
+      const result = buildCredentialValue('webhook-secret', {
+        signingSecret: '  whsec_abc123  '
+      })
+      expect(result).toEqual({ signingSecret: 'whsec_abc123' })
+    })
+  })
+
+  describe('extractFormValues', () => {
+    it('should extract string values from credential object', () => {
+      const credentialValue = {
+        apiKey: 'test-key',
+        token: 'test-token'
+      }
+      const result = extractFormValues(credentialValue)
+      expect(result).toEqual({
+        apiKey: 'test-key',
+        token: 'test-token'
+      })
+    })
+
+    it('should convert non-string values to strings', () => {
+      const credentialValue = {
+        apiKey: 'test-key',
+        count: 123,
+        enabled: true
+      }
+      const result = extractFormValues(credentialValue)
+      expect(result).toEqual({
+        apiKey: 'test-key',
+        count: '123',
+        enabled: 'true'
+      })
+    })
+
+    it('should skip null and undefined values', () => {
+      const credentialValue = {
+        apiKey: 'test-key',
+        nullField: null,
+        undefinedField: undefined
+      }
+      const result = extractFormValues(credentialValue)
+      expect(result).toEqual({
+        apiKey: 'test-key'
+      })
+    })
+
+    it('should handle empty objects', () => {
+      const result = extractFormValues({})
+      expect(result).toEqual({})
+    })
+
+    it('should handle nested objects by converting to string', () => {
+      const credentialValue = {
+        apiKey: 'test-key',
+        metadata: { nested: 'value' }
+      }
+      const result = extractFormValues(credentialValue)
+      expect(result.apiKey).toBe('test-key')
+      expect(result.metadata).toBe('[object Object]')
+    })
+  })
+
+  describe('Integration: Round-trip conversion', () => {
+    it('should preserve single-field credentials through round-trip', () => {
+      const original = { apiKey: 'test-key-123' }
+      const formValues = extractFormValues(original)
+      const rebuilt = buildCredentialValue('api-key', formValues)
+      expect(rebuilt).toEqual(original)
+    })
+
+    it('should handle whitespace during round-trip', () => {
+      const original = { apiKey: 'test-key' }
+      const formValuesWithSpace = { apiKey: '  test-key  ' }
+      const rebuilt = buildCredentialValue('api-key', formValuesWithSpace)
+      expect(rebuilt).toEqual(original)
+    })
+
+    it('should preserve webhook-secret credentials through round-trip', () => {
+      const original = { signingSecret: 'whsec_abc123' }
+      const formValues = extractFormValues(original)
+      const rebuilt = buildCredentialValue('webhook-secret', formValues)
+      expect(rebuilt).toEqual(original)
+    })
+  })
+})

package/src/integrations/credentials/api-schemas.ts

@@ -1,143 +1,143 @@
-import { z } from 'zod'
-import { UuidSchema, CredentialNameSchema } from '../../platform/utils/validation'
-
-/**
- * Credential API Validation Schemas
- *
- * Separate from credential configuration schemas (schemas.ts).
- * - schemas.ts: Credential field definitions and type registry
- * - api-schemas.ts: HTTP request/response validation
- *
- * Design: Input Validation Standardization
- * @see apps/docs/content/docs/in-progress/active-development/security/active/credentials-integrations-validation-implementation.mdx
- */
-
-/**
- * Credential type validation
- * These are the actual `type` values stored in the database:
- * - 'oauth': All OAuth providers (notion, google-sheets) store this type
- * - 'api-key': Generic single-field API key credentials
- * - 'webhook-secret': Webhook signing secrets for signature validation
- *
- * Note: Provider-specific identifiers (notion, google-sheets) are CREDENTIAL_SCHEMAS
- * keys used for UI lookup, NOT stored type values. OAuth credentials store type='oauth'.
- */
-export const CredentialTypeSchema = z.enum(['oauth', 'api-key', 'webhook-secret', 'api-key-secret'])
-
-/**
- * Credential value validation
- * - Must be a non-empty object
- * - Keys are strings, values can be any JSON type
- * - Max 50 keys (prevents DoS)
- * - Individual string values max 10KB (prevents DoS)
- *
- * SECURITY:
- * - Prevents DoS via massive credential payloads
- * - Enforces reasonable limits for credential storage
- */
-const CredentialValueSchema = z
-  .record(z.string(), z.unknown())
-  .refine((val) => Object.keys(val).length > 0, { message: 'Credential value must not be empty' })
-  .refine((val) => Object.keys(val).length <= 50, { message: 'Credential value has too many keys (max 50)' })
-  .refine(
-    (val) => {
-      // Check individual string values for size
-      for (const v of Object.values(val)) {
-        if (typeof v === 'string' && v.length > 10240) {
-          return false
-        }
-      }
-      return true
-    },
-    { message: 'Individual credential values too large (max 10KB per string)' }
-  )
-
-/**
- * POST /api/credentials - Create credential
- */
-export const CreateCredentialRequestSchema = z
-  .object({
-    name: CredentialNameSchema,
-    type: CredentialTypeSchema,
-    value: CredentialValueSchema,
-    provider: z.string().optional() // OAuth provider ID ('dropbox', 'notion', 'google-sheets')
-  })
-  .strict() // Reject unknown fields (prevents mass assignment)
-
-/**
- * Response for credential creation
- */
-export const CreateCredentialResponseSchema = z.object({
-  id: UuidSchema,
-  name: z.string()
-})
-
-/**
- * GET /api/credentials - List credentials
- */
-export const ListCredentialsResponseSchema = z.object({
-  credentials: z.array(
-    z.object({
-      id: UuidSchema,
-      name: z.string(),
-      type: z.string(),
-      provider: z.string().nullable(), // OAuth provider or null for non-OAuth
-      createdAt: z.string().datetime()
-    })
-  )
-})
-
-/** API response type for a single credential list item */
-export type CredentialListItem = z.infer<typeof ListCredentialsResponseSchema>['credentials'][number]
-
-/**
- * PATCH /api/credentials/:credentialId - Update credential
- */
-export const UpdateCredentialParamsSchema = z.object({
-  credentialId: UuidSchema
-})
-
-export const UpdateCredentialRequestSchema = z
-  .object({
-    value: CredentialValueSchema.optional(),
-    name: CredentialNameSchema.optional()
-  })
-  .strict()
-  .refine((data) => data.value !== undefined || data.name !== undefined, {
-    message: 'At least one field (value or name) must be provided'
-  })
-
-/**
- * DELETE /api/credentials/:credentialId - Delete credential
- */
-export const DeleteCredentialParamsSchema = z.object({
-  credentialId: UuidSchema
-})
-
-/**
- * GET /api/credentials/:credentialName/decrypt - CRITICAL ENDPOINT
- * Decrypt credential value for agent/tool use
- *
- * SECURITY: credentialName validated with strict regex to prevent path traversal
- */
-export const DecryptCredentialParamsSchema = z.object({
-  credentialName: CredentialNameSchema
-})
-
-export const DecryptCredentialResponseSchema = z.object({
-  value: z.record(z.string(), z.unknown())
-})
-
-/**
- * Export all schemas for use in routes
- */
-export const CredentialSchemas = {
-  CreateRequest: CreateCredentialRequestSchema,
-  CreateResponse: CreateCredentialResponseSchema,
-  ListResponse: ListCredentialsResponseSchema,
-  UpdateParams: UpdateCredentialParamsSchema,
-  UpdateRequest: UpdateCredentialRequestSchema,
-  DeleteParams: DeleteCredentialParamsSchema,
-  DecryptParams: DecryptCredentialParamsSchema,
-  DecryptResponse: DecryptCredentialResponseSchema
-}
+import { z } from 'zod'
+import { UuidSchema, CredentialNameSchema } from '../../platform/utils/validation'
+
+/**
+ * Credential API Validation Schemas
+ *
+ * Separate from credential configuration schemas (schemas.ts).
+ * - schemas.ts: Credential field definitions and type registry
+ * - api-schemas.ts: HTTP request/response validation
+ *
+ * Design: Input Validation Standardization
+ * @see apps/docs/content/docs/in-progress/active-development/security/active/credentials-integrations-validation-implementation.mdx
+ */
+
+/**
+ * Credential type validation
+ * These are the actual `type` values stored in the database:
+ * - 'oauth': All OAuth providers (notion, google-sheets) store this type
+ * - 'api-key': Generic single-field API key credentials
+ * - 'webhook-secret': Webhook signing secrets for signature validation
+ *
+ * Note: Provider-specific identifiers (notion, google-sheets) are CREDENTIAL_SCHEMAS
+ * keys used for UI lookup, NOT stored type values. OAuth credentials store type='oauth'.
+ */
+export const CredentialTypeSchema = z.enum(['oauth', 'api-key', 'webhook-secret', 'api-key-secret'])
+
+/**
+ * Credential value validation
+ * - Must be a non-empty object
+ * - Keys are strings, values can be any JSON type
+ * - Max 50 keys (prevents DoS)
+ * - Individual string values max 10KB (prevents DoS)
+ *
+ * SECURITY:
+ * - Prevents DoS via massive credential payloads
+ * - Enforces reasonable limits for credential storage
+ */
+const CredentialValueSchema = z
+  .record(z.string(), z.unknown())
+  .refine((val) => Object.keys(val).length > 0, { message: 'Credential value must not be empty' })
+  .refine((val) => Object.keys(val).length <= 50, { message: 'Credential value has too many keys (max 50)' })
+  .refine(
+    (val) => {
+      // Check individual string values for size
+      for (const v of Object.values(val)) {
+        if (typeof v === 'string' && v.length > 10240) {
+          return false
+        }
+      }
+      return true
+    },
+    { message: 'Individual credential values too large (max 10KB per string)' }
+  )
+
+/**
+ * POST /api/credentials - Create credential
+ */
+export const CreateCredentialRequestSchema = z
+  .object({
+    name: CredentialNameSchema,
+    type: CredentialTypeSchema,
+    value: CredentialValueSchema,
+    provider: z.string().optional() // OAuth provider ID ('dropbox', 'notion', 'google-sheets')
+  })
+  .strict() // Reject unknown fields (prevents mass assignment)
+
+/**
+ * Response for credential creation
+ */
+export const CreateCredentialResponseSchema = z.object({
+  id: UuidSchema,
+  name: z.string()
+})
+
+/**
+ * GET /api/credentials - List credentials
+ */
+export const ListCredentialsResponseSchema = z.object({
+  credentials: z.array(
+    z.object({
+      id: UuidSchema,
+      name: z.string(),
+      type: z.string(),
+      provider: z.string().nullable(), // OAuth provider or null for non-OAuth
+      createdAt: z.string().datetime()
+    })
+  )
+})
+
+/** API response type for a single credential list item */
+export type CredentialListItem = z.infer<typeof ListCredentialsResponseSchema>['credentials'][number]
+
+/**
+ * PATCH /api/credentials/:credentialId - Update credential
+ */
+export const UpdateCredentialParamsSchema = z.object({
+  credentialId: UuidSchema
+})
+
+export const UpdateCredentialRequestSchema = z
+  .object({
+    value: CredentialValueSchema.optional(),
+    name: CredentialNameSchema.optional()
+  })
+  .strict()
+  .refine((data) => data.value !== undefined || data.name !== undefined, {
+    message: 'At least one field (value or name) must be provided'
+  })
+
+/**
+ * DELETE /api/credentials/:credentialId - Delete credential
+ */
+export const DeleteCredentialParamsSchema = z.object({
+  credentialId: UuidSchema
+})
+
+/**
+ * GET /api/credentials/:credentialName/decrypt - CRITICAL ENDPOINT
+ * Decrypt credential value for agent/tool use
+ *
+ * SECURITY: credentialName validated with strict regex to prevent path traversal
+ */
+export const DecryptCredentialParamsSchema = z.object({
+  credentialName: CredentialNameSchema
+})
+
+export const DecryptCredentialResponseSchema = z.object({
+  value: z.record(z.string(), z.unknown())
+})
+
+/**
+ * Export all schemas for use in routes
+ */
+export const CredentialSchemas = {
+  CreateRequest: CreateCredentialRequestSchema,
+  CreateResponse: CreateCredentialResponseSchema,
+  ListResponse: ListCredentialsResponseSchema,
+  UpdateParams: UpdateCredentialParamsSchema,
+  UpdateRequest: UpdateCredentialRequestSchema,
+  DeleteParams: DeleteCredentialParamsSchema,
+  DecryptParams: DecryptCredentialParamsSchema,
+  DecryptResponse: DecryptCredentialResponseSchema
+}

package/src/integrations/credentials/index.ts

@@ -1,32 +1,32 @@
-/**
- * Credential Type System
- *
- * Dynamic credential form system with type-based field rendering.
- *
- * Usage:
- * - Add new integration → Update CREDENTIAL_SCHEMAS registry
- * - No modal changes needed
- *
- * @example
- * ```typescript
- * import { getCredentialSchema, buildCredentialValue } from '@repo/core'
- *
- * const schema = getCredentialSchema('attio')
- * const value = buildCredentialValue('api-key', { apiKey: '...' })
- * ```
- */
-
-export {
-  CREDENTIAL_SCHEMAS,
-  getCredentialSchema,
-  listCredentialSchemas,
-  getCredentialTypes,
-} from './schemas'
-
-export type { CredentialSchema, CredentialField } from './schemas'
-
-export { buildCredentialValue, extractFormValues } from './utils'
-
-// API validation schemas
-export * from './api-schemas'
-export { CredentialSchemas } from './api-schemas'
+/**
+ * Credential Type System
+ *
+ * Dynamic credential form system with type-based field rendering.
+ *
+ * Usage:
+ * - Add new integration → Update CREDENTIAL_SCHEMAS registry
+ * - No modal changes needed
+ *
+ * @example
+ * ```typescript
+ * import { getCredentialSchema, buildCredentialValue } from '@repo/core'
+ *
+ * const schema = getCredentialSchema('attio')
+ * const value = buildCredentialValue('api-key', { apiKey: '...' })
+ * ```
+ */
+
+export {
+  CREDENTIAL_SCHEMAS,
+  getCredentialSchema,
+  listCredentialSchemas,
+  getCredentialTypes,
+} from './schemas'
+
+export type { CredentialSchema, CredentialField } from './schemas'
+
+export { buildCredentialValue, extractFormValues } from './utils'
+
+// API validation schemas
+export * from './api-schemas'
+export { CredentialSchemas } from './api-schemas'