@gadmin2n/schematics 0.0.138 → 0.0.140

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/httpRequest/http-request-runtime.controller.ts

@@ -0,0 +1,160 @@
+import {
+  BadGatewayException,
+  BadRequestException,
+  Body,
+  Controller,
+  NotFoundException,
+  Post,
+  UseGuards,
+} from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import axios from 'axios';
+import { PrismaService } from 'nestjs-prisma';
+import { Agent as HttpsAgent } from 'node:https';
+import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
+import { RuntimeTokenGuard } from '../humanApproval/runtime/runtime-token.guard';
+import { IntegrationConnectionService } from '../integrationConnection/integration-connection.service';
+import { ExecuteHttpRequestRuntimeDto } from './http-request-runtime.dto';
+import {
+  HttpRequestNodeConfig,
+  materializeHttpRequest,
+} from './http-request-runtime.util';
+
+@Controller('workflow-runtime/http-request')
+@UseGuards(RuntimeTokenGuard)
+export class HttpRequestRuntimeController {
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly connections: IntegrationConnectionService,
+    private readonly config: ConfigService,
+  ) {}
+
+  @Post('execute')
+  @AllowUnauthorizedRequest()
+  async execute(@Body() input: ExecuteHttpRequestRuntimeDto): Promise<{
+    status: number;
+    data: unknown;
+    headers: Record<string, unknown>;
+  }> {
+    const runtime = this.config.get<{ tenantNamespace: string }>(
+      'humanApprovalRuntime',
+    );
+    if (input.tenantNamespace !== runtime?.tenantNamespace)
+      throw runtimeError(
+        'WORKFLOW_RUNTIME_TENANT_MISMATCH',
+        'Runtime tenant does not match this application',
+      );
+
+    const instanceId = parseId(input.workflowInstanceId);
+    const versionId = parseId(input.workflowVersionId);
+    const instance = await this.prisma.workflowInstance.findUnique({
+      where: { id: instanceId },
+      select: { workflowId: true, versionId: true, temporalRunId: true },
+    });
+    if (
+      !instance ||
+      instance.versionId !== versionId ||
+      instance.temporalRunId !== input.temporalRunId
+    )
+      throw new NotFoundException({
+        code: 'WORKFLOW_RUNTIME_INSTANCE_NOT_FOUND',
+        message: 'Workflow runtime instance metadata does not match',
+        retryable: false,
+      });
+
+    const version = await this.prisma.workflowVersion.findUnique({
+      where: { id: versionId },
+      select: { workflowId: true, dsl: true },
+    });
+    const node = (version?.dsl as any)?.nodes?.find(
+      (item: any) => item.id === input.nodeId,
+    );
+    if (
+      !version ||
+      version.workflowId !== instance.workflowId ||
+      node?.runtimeKey !== 'http_request' ||
+      !node?.config ||
+      typeof node.config !== 'object' ||
+      typeof node.config.connectionRef !== 'string'
+    )
+      throw runtimeError(
+        'WORKFLOW_RUNTIME_COMPILED_INPUT_INVALID',
+        'HTTP Request input does not match the compiled workflow',
+      );
+
+    const nodeConfig = node.config as HttpRequestNodeConfig & {
+      retryOnFail?: boolean;
+      maxRetries?: number;
+      retryInterval?: number;
+    };
+    const connection = await this.connections.resolveRuntime(
+      nodeConfig.connectionRef,
+    );
+    const request = materializeHttpRequest(nodeConfig, connection, {
+      input: input.input,
+      workflow: input.workflow,
+      system: input.system ?? {},
+    });
+    const attempts = nodeConfig.retryOnFail
+      ? Math.min(Math.max(nodeConfig.maxRetries ?? 0, 0), 10) + 1
+      : 1;
+
+    let lastError: unknown;
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+      try {
+        const response = await axios.request({
+          url: request.url,
+          method: request.method,
+          params: request.query,
+          headers: request.headers,
+          data: request.body,
+          timeout: request.timeoutMs,
+          ...(request.ignoreSslErrors && {
+            httpsAgent: new HttpsAgent({ rejectUnauthorized: false }),
+          }),
+          maxRedirects: 5,
+          validateStatus: (status) => status >= 200 && status < 300,
+        });
+        return {
+          status: response.status,
+          data: response.data,
+          headers: Object.fromEntries(Object.entries(response.headers)),
+        };
+      } catch (error) {
+        lastError = error;
+        if (attempt + 1 < attempts)
+          await delay(
+            Math.min(Math.max(nodeConfig.retryInterval ?? 1000, 0), 60000),
+          );
+      }
+    }
+
+    const status = axios.isAxiosError(lastError)
+      ? lastError.response?.status
+      : undefined;
+    throw new BadGatewayException({
+      code: 'HTTP_REQUEST_EXECUTION_FAILED',
+      message: status
+        ? `External API returned HTTP ${status}`
+        : 'External API request failed',
+      retryable: true,
+    });
+  }
+}
+
+function parseId(value: string): bigint {
+  if (!/^[1-9][0-9]*$/.test(value))
+    throw runtimeError(
+      'WORKFLOW_RUNTIME_COMPILED_INPUT_INVALID',
+      'Runtime IDs must be positive integers',
+    );
+  return BigInt(value);
+}
+
+function runtimeError(code: string, message: string) {
+  return new BadRequestException({ code, message, retryable: false });
+}
+
+function delay(milliseconds: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/httpRequest/http-request-runtime.dto.ts

@@ -0,0 +1,41 @@
+import {
+  Allow,
+  IsDefined,
+  IsNotEmpty,
+  IsObject,
+  IsOptional,
+  IsString,
+} from 'class-validator';
+
+export class ExecuteHttpRequestRuntimeDto {
+  @IsString()
+  @IsNotEmpty()
+  tenantNamespace!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  workflowInstanceId!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  workflowVersionId!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  temporalRunId!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  nodeId!: string;
+
+  @Allow()
+  @IsDefined()
+  input!: unknown;
+
+  @IsObject()
+  workflow!: Record<string, unknown>;
+
+  @IsOptional()
+  @IsObject()
+  system?: Record<string, unknown>;
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/httpRequest/http-request-runtime.util.spec.ts

@@ -0,0 +1,171 @@
+import { materializeHttpRequest } from './http-request-runtime.util';
+
+describe('HTTP Request runtime materialization', () => {
+  it('resolves input, Workflow data, and fixed values into a request', () => {
+    const request = materializeHttpRequest(
+      {
+        connectionRef: 'servicenow_prod',
+        method: 'POST',
+        path: '/api/tickets/{{input.ticketId}}/approvers',
+        queryBindings: {
+          includeGroups: {
+            source: 'FIXED',
+            valueType: 'BOOLEAN',
+            value: 'true',
+          },
+        },
+        headerBindings: {
+          'x-department': { source: 'WORKFLOW', path: 'departmentId' },
+        },
+        bodyMode: 'FIELDS',
+        bodyBindings: {
+          amount: { source: 'INPUT', path: 'amount' },
+          tags: { source: 'WORKFLOW', path: 'tags' },
+        },
+        timeoutSeconds: 30,
+      },
+      {
+        baseUrl: 'https://servicenow.example.com/',
+        authType: 'BEARER',
+        publicConfig: { defaultHeaders: { Accept: 'application/json' } },
+        secrets: { token: 'secret-token' },
+      },
+      {
+        input: { ticketId: 'T-123', amount: 5000 },
+        workflow: {
+          departmentId: 'finance',
+          tags: ['urgent', 'finance'],
+        },
+      },
+    );
+
+    expect(request).toEqual({
+      url: 'https://servicenow.example.com/api/tickets/T-123/approvers',
+      method: 'POST',
+      query: { includeGroups: true },
+      headers: {
+        Accept: 'application/json',
+        'x-department': 'finance',
+        Authorization: 'Bearer secret-token',
+      },
+      body: { amount: 5000, tags: ['urgent', 'finance'] },
+      timeoutMs: 30000,
+    });
+  });
+
+  it('generates Tencent TOF headers without exposing the token', () => {
+    const request = materializeHttpRequest(
+      {
+        connectionRef: 'wecom_message',
+        method: 'POST',
+        path: '/SendRTXInfo',
+        bodyMode: 'JSON',
+        body: {
+          Sender: 'seat-mgmt',
+          Receiver: '{{input.receiver}}',
+          Title: '{{workflow.title}}',
+          MsgInfo: '{{workflow.content}}',
+        },
+      },
+      {
+        baseUrl: 'https://api-idc.sgw.woa.com/ebus/tof4_msg/api/v1/Message',
+        authType: 'API_KEY',
+        publicConfig: {
+          signatureType: 'TENCENT_TOF',
+          paasId: 'paas-id',
+        } as any,
+        secrets: { apiKey: 'tof-secret' },
+      },
+      {
+        input: { receiver: 'junrujrwang' },
+        workflow: { title: '测试消息', content: '你好' },
+      },
+      {
+        timestamp: '1700000000',
+        nonce: 'abc123',
+      },
+    );
+
+    expect(request.headers).toMatchObject({
+      'Content-Type': 'application/json',
+      'x-rio-paasid': 'paas-id',
+      'x-rio-timestamp': '1700000000',
+      'x-rio-nonce': 'abc123',
+      'x-rio-signature':
+        '5BE02693B15558DDE44974887C907585DC33B75500F930442B916756BB83CE3C',
+    });
+    expect(request.ignoreSslErrors).toBe(true);
+    expect(JSON.stringify(request)).not.toContain('tof-secret');
+  });
+
+  it('requires an explicit input or workflow source in templates', () => {
+    expect(() =>
+      materializeHttpRequest(
+        {
+          connectionRef: 'directory',
+          method: 'GET',
+          path: '/leaders/{{wecomId}}',
+        },
+        {
+          baseUrl: 'https://directory.example.com',
+          authType: 'NONE',
+          secrets: {},
+        },
+        {
+          input: { wecomId: 'wx-1' },
+          workflow: { wecomId: 'wx-2' },
+        },
+      ),
+    ).toThrow('HTTP_TEMPLATE_SOURCE_REQUIRED:wecomId');
+  });
+
+  it('resolves system-provided values without mixing them into Workflow data', () => {
+    const request = materializeHttpRequest(
+      {
+        connectionRef: 'myoa',
+        method: 'POST',
+        path: '/approvals',
+        headerBindings: {
+          'x-request-id': {
+            source: 'SYSTEM',
+            path: 'approval.requestId',
+          },
+        },
+        bodyMode: 'JSON',
+        body: {
+          title: '{{workflow.title}}',
+          data: [
+            {
+              key: 'gadmin_callback_token',
+              value: ['{{system.callback.token}}'],
+            },
+          ],
+        },
+      },
+      {
+        baseUrl: 'https://myoa.example.com',
+        authType: 'NONE',
+        secrets: {},
+      },
+      {
+        input: {},
+        workflow: { title: '服务器权限申请' },
+        system: {
+          approval: { requestId: '42' },
+          callback: { token: 'ext_cb_approval' },
+        },
+      },
+    );
+
+    expect(request.headers).toMatchObject({ 'x-request-id': '42' });
+    expect(request.body).toEqual({
+      title: '服务器权限申请',
+      data: [
+        {
+          key: 'gadmin_callback_token',
+          value: ['ext_cb_approval'],
+        },
+      ],
+    });
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/httpRequest/http-request-runtime.util.ts

@@ -0,0 +1,245 @@
+import { createHash, randomBytes } from 'crypto';
+import {
+  resolveParameterBinding,
+  validateParameterBinding,
+  type ParameterBinding,
+} from '../workflow/parameter-binding';
+
+export type IntegrationAuthType = 'NONE' | 'BASIC' | 'BEARER' | 'API_KEY';
+
+export interface HttpRequestNodeConfig {
+  connectionRef: string;
+  method: string;
+  path: string;
+  queryBindings?: Record<string, ParameterBinding>;
+  headerBindings?: Record<string, ParameterBinding>;
+  bodyMode?: 'FIELDS' | 'JSON';
+  bodyBindings?: Record<string, ParameterBinding>;
+  body?: unknown;
+  timeoutSeconds?: number;
+}
+
+export interface RuntimeHttpConnection {
+  baseUrl: string;
+  authType: IntegrationAuthType;
+  publicConfig?: {
+    defaultHeaders?: Record<string, string>;
+    apiKeyName?: string;
+    apiKeyLocation?: 'HEADER' | 'QUERY';
+    signatureType?: 'TENCENT_TOF';
+    paasId?: string;
+  };
+  secrets: Record<string, unknown>;
+}
+
+export interface MaterializedHttpRequest {
+  url: string;
+  method: string;
+  query: Record<string, unknown>;
+  headers: Record<string, string>;
+  body?: unknown;
+  timeoutMs: number;
+  ignoreSslErrors?: boolean;
+}
+
+export interface HttpRequestMaterializationOptions {
+  timestamp?: string;
+  nonce?: string;
+}
+
+export interface HttpRequestData {
+  input: unknown;
+  workflow: Record<string, unknown>;
+  system?: Record<string, unknown>;
+}
+
+export function materializeHttpRequest(
+  config: HttpRequestNodeConfig,
+  connection: RuntimeHttpConnection,
+  data: HttpRequestData,
+  _options: HttpRequestMaterializationOptions = {},
+): MaterializedHttpRequest {
+  const method = String(config.method || '').toUpperCase();
+  if (!['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD'].includes(method))
+    throw new Error('HTTP_REQUEST_METHOD_NOT_SUPPORTED');
+
+  const resolvedPath = resolveTemplates(config.path, data);
+  if (typeof resolvedPath !== 'string')
+    throw new Error('HTTP_REQUEST_PATH_INVALID');
+  const base = new URL(ensureTrailingSlash(connection.baseUrl));
+  const url = new URL(resolvedPath.replace(/^\//, ''), base);
+  if (url.origin !== base.origin)
+    throw new Error('HTTP_REQUEST_PATH_CANNOT_CHANGE_ORIGIN');
+
+  const query = resolveBindings(config.queryBindings ?? {}, data);
+  const resolvedHeaders = resolveBindings(config.headerBindings ?? {}, data);
+  const headers: Record<string, string> = {
+    ...(connection.publicConfig?.defaultHeaders ?? {}),
+    ...Object.fromEntries(
+      Object.entries(resolvedHeaders).map(([key, value]) => [
+        key,
+        String(value),
+      ]),
+    ),
+  };
+  applyAuthentication(connection, headers, query, _options);
+
+  const timeoutSeconds = config.timeoutSeconds ?? 30;
+  if (
+    !Number.isInteger(timeoutSeconds) ||
+    timeoutSeconds < 1 ||
+    timeoutSeconds > 300
+  )
+    throw new Error('HTTP_REQUEST_TIMEOUT_INVALID');
+
+  const body =
+    config.bodyMode === 'JSON'
+      ? resolveTemplates(config.body, data)
+      : Object.keys(config.bodyBindings ?? {}).length > 0
+      ? resolveBindings(config.bodyBindings ?? {}, data)
+      : undefined;
+
+  return {
+    url: url.toString().replace(/\/$/, resolvedPath.endsWith('/') ? '/' : ''),
+    method,
+    query,
+    headers,
+    ...(body !== undefined && { body }),
+    timeoutMs: timeoutSeconds * 1000,
+    ...(isTencentTofConnection(connection) && { ignoreSslErrors: true }),
+  };
+}
+
+function resolveBindings(
+  bindings: Record<string, ParameterBinding>,
+  data: HttpRequestData,
+): Record<string, unknown> {
+  return Object.fromEntries(
+    Object.entries(bindings).map(([key, binding]) => {
+      if (!validateParameterBinding(binding))
+        throw new Error(`HTTP_BINDING_INVALID:${key}`);
+      return [
+        key,
+        resolveParameterBinding(
+          binding,
+          data.input,
+          data.workflow,
+          data.system,
+        ),
+      ];
+    }),
+  );
+}
+
+function resolveTemplates(value: unknown, data: HttpRequestData): unknown {
+  if (typeof value === 'string') {
+    const exact = value.match(/^\{\{\s*([^{}]+?)\s*\}\}$/);
+    if (exact) return requireReference(data, exact[1]);
+    return value.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, (_, path) => {
+      const resolved = requireReference(data, path);
+      if (resolved !== null && typeof resolved === 'object')
+        throw new Error(`HTTP_TEMPLATE_REQUIRES_SCALAR:${path}`);
+      return String(resolved ?? '');
+    });
+  }
+  if (Array.isArray(value))
+    return value.map((item) => resolveTemplates(item, data));
+  if (value && typeof value === 'object')
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [
+        key,
+        resolveTemplates(item, data),
+      ]),
+    );
+  return value;
+}
+
+function requireReference(data: HttpRequestData, path: string): unknown {
+  const normalized = path.trim();
+  const [source, ...parts] = normalized.split('.');
+  if (!['input', 'workflow', 'system'].includes(source) || parts.length === 0)
+    throw new Error(`HTTP_TEMPLATE_SOURCE_REQUIRED:${normalized}`);
+
+  let current: unknown =
+    source === 'input'
+      ? data.input
+      : source === 'workflow'
+      ? data.workflow
+      : data.system;
+  for (const part of parts) {
+    if (!current || typeof current !== 'object' || !(part in current))
+      throw new Error(`HTTP_TEMPLATE_RESOLUTION_FAILED:${normalized}`);
+    current = (current as Record<string, unknown>)[part];
+  }
+  return current;
+}
+
+function applyAuthentication(
+  connection: RuntimeHttpConnection,
+  headers: Record<string, string>,
+  query: Record<string, unknown>,
+  options: HttpRequestMaterializationOptions,
+): void {
+  switch (connection.authType) {
+    case 'NONE':
+      return;
+    case 'BEARER': {
+      const token = requiredSecret(connection.secrets, 'token');
+      headers.Authorization = `Bearer ${token}`;
+      return;
+    }
+    case 'BASIC': {
+      const username = requiredSecret(connection.secrets, 'username');
+      const password = requiredSecret(connection.secrets, 'password');
+      headers.Authorization = `Basic ${Buffer.from(
+        `${username}:${password}`,
+      ).toString('base64')}`;
+      return;
+    }
+    case 'API_KEY': {
+      if (isTencentTofConnection(connection)) {
+        const paasId = connection.publicConfig?.paasId?.trim();
+        if (!paasId) throw new Error('TENCENT_TOF_PAAS_ID_REQUIRED');
+        const paasToken = requiredSecret(connection.secrets, 'apiKey');
+        const timestamp =
+          options.timestamp ?? Math.floor(Date.now() / 1000).toString();
+        const nonce = options.nonce ?? randomBytes(16).toString('hex');
+        const signature = createHash('sha256')
+          .update(timestamp + paasToken + nonce + timestamp, 'utf8')
+          .digest('hex')
+          .toUpperCase();
+        headers['Content-Type'] = 'application/json';
+        headers['x-rio-paasid'] = paasId;
+        headers['x-rio-signature'] = signature;
+        headers['x-rio-timestamp'] = timestamp;
+        headers['x-rio-nonce'] = nonce;
+        return;
+      }
+      const name = connection.publicConfig?.apiKeyName?.trim();
+      if (!name) throw new Error('HTTP_API_KEY_NAME_REQUIRED');
+      const value = requiredSecret(connection.secrets, 'apiKey');
+      if (connection.publicConfig?.apiKeyLocation === 'QUERY')
+        query[name] = value;
+      else headers[name] = value;
+      return;
+    }
+  }
+}
+
+function isTencentTofConnection(connection: RuntimeHttpConnection): boolean {
+  return (
+    connection.authType === 'API_KEY' &&
+    connection.publicConfig?.signatureType === 'TENCENT_TOF'
+  );
+}
+
+function requiredSecret(secrets: Record<string, unknown>, key: string): string {
+  const value = secrets[key];
+  if (typeof value !== 'string' || !value)
+    throw new Error(`INTEGRATION_CONNECTION_SECRET_REQUIRED:${key}`);
+  return value;
+}
+
+function ensureTrailingSlash(value: string): string {
+  return value.endsWith('/') ? value : `${value}/`;
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/httpRequest/httpRequest.module.ts

@@ -0,0 +1,22 @@
+import { Injectable, Module, OnModuleInit } from '@nestjs/common';
+import { RuntimeTokenGuard } from '../humanApproval/runtime/runtime-token.guard';
+import { IntegrationConnectionModule } from '../integrationConnection/integrationConnection.module';
+import { WidgetCatalogService } from '../workflowConfig/widget-catalog.service';
+import { WorkflowConfigModule } from '../workflowConfig/workflowConfig.module';
+import { HttpRequestRuntimeController } from './http-request-runtime.controller';
+
+@Injectable()
+class HttpRequestWidgetRegistrar implements OnModuleInit {
+  constructor(private readonly widgets: WidgetCatalogService) {}
+
+  onModuleInit(): void {
+    this.widgets.register('http-request-config');
+  }
+}
+
+@Module({
+  imports: [IntegrationConnectionModule, WorkflowConfigModule],
+  controllers: [HttpRequestRuntimeController],
+  providers: [RuntimeTokenGuard, HttpRequestWidgetRegistrar],
+})
+export class HttpRequestModule {}