@friggframework/core 2.0.0--canary.698.b1a2d30.0 → 2.0.0--canary.700.80ec1cc.0

package/integrations/{data-defined → definitions}/use-cases/definition-use-cases.js

@@ -1,5 +1,5 @@
 /**
- * Application layer for data-defined integrations (ADR-063): publishing definition versions, the catalogue the
+ * Application layer for integrations published as definitions (ADR-063): publishing definition versions, the catalogue the
  * runtime reads from, and per-installation upgrades. Business rules live here; the repositories only store rows.
  *
  *   createDefinitionCatalog()        what defineSharedIntegrationClass({ definitions }) reads: get(id, version), latest(id)

package/integrations/{data-defined → definitions}/versioning.js

@@ -1,5 +1,5 @@
 /**
- * Versioning for data-defined integrations.
+ * Versioning for integrations published as definitions.
  *
  * A published version is immutable and every installation pins one exact version, so a release never changes a
  * running customer until that installation is upgraded. Three questions are answered here:

package/integrations/integration-base.js

@@ -46,6 +46,26 @@ const constantsToBeMigrated = {
     },
 };
 
+/**
+ * The facts about a webhook request that signature checks need, small enough to travel in the queue message: the
+ * method, the public URL the vendor called, and the raw body (up to 96 KB; beyond that it is left out and a check that
+ * needs it fails closed, because SQS messages are capped at 256 KB and the parsed body travels too).
+ */
+const RAW_BODY_LIMIT = 96 * 1024;
+function webhookRequestFacts(req) {
+    const h = req.headers || {};
+    const proto = String(h['x-forwarded-proto'] || req.protocol || 'https').split(',')[0].trim();
+    const host = h['x-forwarded-host'] || h.host;
+    const url = host ? `${proto}://${host}${req.originalUrl || req.url || ''}` : undefined;
+    const raw = req.rawBody;
+    const rawBody = raw == null ? undefined : (Buffer.isBuffer(raw) ? raw.toString('utf8') : String(raw));
+    return {
+        method: req.method,
+        ...(url ? { url } : {}),
+        ...(rawBody !== undefined && Buffer.byteLength(rawBody) <= RAW_BODY_LIMIT ? { rawBody } : {}),
+    };
+}
+
 class IntegrationBase {
     // todo: maybe we can pass this as Dependency Injection in the sub-class constructor
     integrationRepository = createIntegrationRepository();
@@ -552,7 +572,7 @@ class IntegrationBase {
     /**
      * The recurring triggers declared for one installation (ADR-055): `Definition.triggers`, each with its `name`.
      * Static so the tick can read them from a record without hydrating the installation; a class whose triggers
-     * depend on the installation (data-defined integrations, `Definition.instanceTriggers`) overrides it.
+     * depend on the installation (integrations published as definitions, `Definition.instanceTriggers`) overrides it.
      * @param {{ config?: Object, record?: Object }} [installation]
      * @returns {Promise<Array<Object>>}
      */
@@ -699,6 +719,7 @@ class IntegrationBase {
             body,
             headers: req.headers,
             query: req.query,
+            ...webhookRequestFacts(req),
         });
 
         res.status(200).json({ received: true });
@@ -708,6 +729,15 @@ class IntegrationBase {
         // Default: no-op, integrations override this
     }
 
+    /**
+     * What a module's verifyWebhookSignature needs about a queued delivery (onWebhookReceived put it there): the
+     * headers, the parsed body, the raw body exactly as received, and the method and public URL some vendors sign
+     * (HubSpot v3). Call as `this.<module>.api.verifyWebhookSignature(this.webhookVerificationInput(data))`.
+     */
+    webhookVerificationInput(data = {}) {
+        return { headers: data.headers || {}, body: data.body, query: data.query || {}, rawBody: data.rawBody, method: data.method, url: data.url };
+    }
+
     /**
      * Queue a webhook for asynchronous worker dispatch.
      *

package/integrations/integration-router.js

@@ -210,7 +210,7 @@ function createIntegrationRouter() {
         getPossibleIntegrations,
     });
     // Integration versions, run history, sync progress and approvals (ADR-063): mounted when the app registers the integration runtime.
-    require('./data-defined/router').setDataDefinedRoutes(router, authenticateUser, {
+    require('./definitions/router').setIntegrationRuntimeRoutes(router, authenticateUser, {
         getIntegrationInstance,
         integrationClasses,
     });

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.698.b1a2d30.0",
+    "version": "2.0.0--canary.700.80ec1cc.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -47,9 +47,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.698.b1a2d30.0",
-        "@friggframework/prettier-config": "2.0.0--canary.698.b1a2d30.0",
-        "@friggframework/test": "2.0.0--canary.698.b1a2d30.0",
+        "@friggframework/eslint-config": "2.0.0--canary.700.80ec1cc.0",
+        "@friggframework/prettier-config": "2.0.0--canary.700.80ec1cc.0",
+        "@friggframework/test": "2.0.0--canary.700.80ec1cc.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -67,7 +67,7 @@
     "scripts": {
         "lint:fix": "prettier --write --loglevel error . && eslint . --fix",
         "test": "jest --passWithNoTests # TODO",
-        "validate:definitions": "node integrations/data-defined/scripts/validate.js",
+        "validate:definitions": "node integrations/definitions/scripts/validate.js",
         "prisma:generate:mongo": "npx prisma generate --schema ./prisma-mongodb/schema.prisma",
         "prisma:generate:postgres": "npx prisma generate --schema ./prisma-postgresql/schema.prisma",
         "prisma:generate": "npm run prisma:generate:mongo && npm run prisma:generate:postgres",
@@ -90,5 +90,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "b1a2d30f3296992d698742a0c0a99b916c7fbfbe"
+    "gitHead": "80ec1cc658ebdfbe53482d0705c42129685eb47f"
 }

package/prisma-mongodb/schema.prisma

@@ -455,7 +455,7 @@ model UsageCounter {
   @@map("UsageCounter")
 }
 
-// Data-defined integrations (ADR-063): one immutable row per published definition version.
+// Integrations published as definitions (ADR-063): one immutable row per published definition version.
 enum DefinitionStatus {
   DRAFT
   PUBLISHED
@@ -487,7 +487,7 @@ model IntegrationDefinitionVersion {
   @@map("IntegrationDefinitionVersion")
 }
 
-// One row per data-defined workflow run. trace holds step ids, statuses, timings and error messages, never request or
+// One row per workflow run. trace holds step ids, statuses, timings and error messages, never request or
 // response bodies.
 model WorkflowRun {
   id                String      @id @default(auto()) @map("_id") @db.ObjectId

package/prisma-postgresql/schema.prisma

@@ -436,7 +436,7 @@ model UsageCounter {
   @@index([metric, integrationType, window])
 }
 
-// Data-defined integrations (ADR-063): one immutable row per published definition version.
+// Integrations published as definitions (ADR-063): one immutable row per published definition version.
 enum DefinitionStatus {
   DRAFT
   PUBLISHED
@@ -467,7 +467,7 @@ model IntegrationDefinitionVersion {
   @@index([workspaceId, status])
 }
 
-// One row per data-defined workflow run. trace holds step ids, statuses, timings and error messages, never request or
+// One row per workflow run. trace holds step ids, statuses, timings and error messages, never request or
 // response bodies.
 model WorkflowRun {
   id                Int         @id @default(autoincrement())