@gitkraken/core-gitlens 0.4.0 → 0.4.100

package/src/plus/integrations/authentication/configuredIntegrationService.ts

@@ -10,6 +10,7 @@ import type {
 } from '../constants.js';
 import type { IntegrationServiceContext } from '../context.js';
 import { providersMetadata } from '../providers/models.js';
+import { areDomainsOnSameHost, hostFromDomain } from '../utils/domain.utils.js';
 import { isGitSelfManagedHostIntegrationId } from '../utils/integration.utils.js';
 import type { IntegrationAuthenticationSessionDescriptor } from './integrationAuthenticationProvider.js';
 import type {
@@ -28,6 +29,8 @@ interface StoredSession {
 	expiresAt?: string;
 	domain?: string;
 	protocol?: string;
+	/** The provider app key paired with the token for providers whose client needs one (e.g. Trello). */
+	appKey?: string;
 }
 
 export interface ConfiguredIntegrationsChangeEvent {
@@ -61,6 +64,14 @@ export class ConfiguredIntegrationService implements Disposable {
 
 				const descriptors = configured.map(d => ({
 					...d,
+					domain: this.normalizeConfiguredDomain(id, d.domain),
+					// Backfill a stable connection id for pre-multi-account stored data: the domain for
+					// self-managed hosts, or the provider's canonical domain for cloud (which is the legacy
+					// secret-key session id), so existing secrets keep resolving with zero migration. Fall back
+					// to the integration id (never empty) when no domain is known — self-managed providers carry
+					// `domain: ''` in metadata, and an empty id would collide across connections and produce
+					// ambiguous secret keys (`...|`).
+					id: d.id || d.domain || providersMetadata[id]?.domain || id,
 					expiresAt: d.expiresAt ? new Date(d.expiresAt) : undefined,
 				}));
 				this._configured.set(id, descriptors);
@@ -87,7 +98,8 @@ export class ConfiguredIntegrationService implements Disposable {
 		if (options?.domain != null || options?.cloud != null) {
 			for (const descriptor of configured) {
 				if (
-					(options?.domain != null && descriptor.domain !== options.domain) ||
+					(options?.domain != null &&
+						!this.domainsMatch(id ?? descriptor.integrationId, descriptor.domain, options.domain)) ||
 					(options?.cloud === true && !descriptor.cloud) ||
 					(options?.cloud === false && descriptor.cloud)
 				) {
@@ -121,22 +133,51 @@ export class ConfiguredIntegrationService implements Disposable {
 	}
 
 	private async addOrUpdateConfigured(descriptor: ConfiguredIntegrationDescriptor): Promise<void> {
+		descriptor = {
+			...descriptor,
+			domain: this.normalizeConfiguredDomain(descriptor.integrationId, descriptor.domain),
+		};
 		const descriptors = this.configured.get(descriptor.integrationId) ?? [];
-		const existing = descriptors.find(
-			d =>
-				d.domain === descriptor.domain &&
-				d.integrationId === descriptor.integrationId &&
-				d.cloud === descriptor.cloud,
-		);
+		// Key connections by their stable id (+ cloud, to preserve legacy local/cloud coexistence) so
+		// multiple accounts on the same provider+domain no longer overwrite each other.
+		const existing = descriptors.find(d => d.id === descriptor.id && d.cloud === descriptor.cloud);
+
+		// The first connection for a provider/domain is primary by default; an explicit flag (or the
+		// existing value) always wins. Self-managed providers can span multiple hosts under the same
+		// integration id, so each host needs its own primary.
+		const primaryScope = this.getPrimaryScope(descriptor.integrationId, descriptors, descriptor.domain);
+		const primary = descriptor.primary ?? existing?.primary ?? !primaryScope.some(d => d.primary);
+		// Preserve a previously-resolved type/accountName when the incoming write doesn't carry them (e.g.
+		// the model re-stores the primary session with an empty account, after reconcile enriched it).
+		const type = descriptor.type ?? existing?.type;
+		const accountName = descriptor.accountName ?? existing?.accountName;
+		const normalized: ConfiguredIntegrationDescriptor = {
+			...descriptor,
+			primary: primary,
+			type: type,
+			accountName: accountName,
+		};
 
 		let changed: boolean;
 		if (existing != null) {
-			if (existing.expiresAt === descriptor.expiresAt && existing.scopes === descriptor.scopes) {
+			if (
+				existing.domain === normalized.domain &&
+				existing.expiresAt === normalized.expiresAt &&
+				existing.scopes === normalized.scopes &&
+				(existing.primary ?? false) === (normalized.primary ?? false) &&
+				existing.type === normalized.type &&
+				existing.accountName === normalized.accountName
+			) {
 				return;
 			}
 
-			// Only fire the change event if the scopes changes (i.e. ignore any expiresAt changes)
-			changed = existing.scopes !== descriptor.scopes;
+			// Only fire the change event on domain/scopes/primary/type/accountName changes (ignore expiresAt churn)
+			changed =
+				existing.domain !== normalized.domain ||
+				existing.scopes !== normalized.scopes ||
+				(existing.primary ?? false) !== (normalized.primary ?? false) ||
+				existing.type !== normalized.type ||
+				existing.accountName !== normalized.accountName;
 
 			// remove the existing descriptor from the array
 			descriptors.splice(descriptors.indexOf(existing), 1);
@@ -144,7 +185,7 @@ export class ConfiguredIntegrationService implements Disposable {
 			changed = true;
 		}
 
-		descriptors.push(descriptor);
+		descriptors.push(normalized);
 		this.configured.set(descriptor.integrationId, descriptors);
 
 		if (changed) {
@@ -155,31 +196,44 @@ export class ConfiguredIntegrationService implements Disposable {
 
 	private async removeConfigured(
 		id: IntegrationIds,
-		options: { cloud: boolean | undefined; domain: string | undefined },
+		options: { connectionId: string; cloud: boolean | undefined },
 	): Promise<void> {
-		let changed = false;
-		const descriptors = [];
+		const existing = this.configured.get(id);
+		if (existing == null || existing.length === 0) return;
 
-		for (const d of this.configured.get(id) ?? []) {
+		const removedPrimaryDomains = new Set<string | undefined>();
+		const descriptors: ConfiguredIntegrationDescriptor[] = [];
+		for (const d of existing) {
 			if (
-				d.domain === options.domain &&
+				d.id === options.connectionId &&
 				(options?.cloud == null ||
 					(options?.cloud === true && d.cloud === true) ||
 					(options?.cloud === false && d.cloud === false))
 			) {
-				changed = true;
+				if (d.primary) {
+					removedPrimaryDomains.add(d.domain);
+				}
 				continue;
 			}
 
 			descriptors.push(d);
 		}
 
-		this.configured.set(id, descriptors);
+		if (descriptors.length === existing.length) return; // nothing matched
 
-		if (changed) {
-			this.fireChange(undefined, id);
+		// Promote a secondary to primary when the removed connection was the primary and others remain
+		// in the same primary scope, so the provider/host stays in a well-defined connected state.
+		for (const domain of removedPrimaryDomains) {
+			if (descriptors.some(d => this.isInPrimaryScope(id, d, domain) && d.primary)) continue;
+
+			const index = descriptors.findIndex(d => this.isInPrimaryScope(id, d, domain));
+			if (index !== -1) {
+				descriptors[index] = { ...descriptors[index], primary: true };
+			}
 		}
 
+		this.configured.set(id, descriptors);
+		this.fireChange(undefined, id);
 		await this.storeConfigured();
 	}
 
@@ -191,8 +245,8 @@ export class ConfiguredIntegrationService implements Disposable {
 		id: IntegrationIds,
 		descriptor: IntegrationAuthenticationSessionDescriptor,
 	): Promise<ProviderAuthenticationSession | undefined> {
-		const sessionId = this.getSessionId(descriptor);
-		let session = await this.readSecret(id, sessionId, false);
+		const sessionId = this.resolveConnectionId(id, descriptor);
+		let session = descriptor.cloud === true ? undefined : await this.readSecret(id, sessionId, false);
 
 		let cloudIfMissing = false;
 		if (session != null) {
@@ -208,7 +262,7 @@ export class ConfiguredIntegrationService implements Disposable {
 		}
 
 		// If no local session we try to restore a session with the cloud key
-		if (session == null) {
+		if (session == null && descriptor.cloud !== false) {
 			cloudIfMissing = true;
 			session = await this.readSecret(id, sessionId, true);
 		}
@@ -220,12 +274,13 @@ export class ConfiguredIntegrationService implements Disposable {
 		id: IntegrationIds,
 		descriptor: IntegrationAuthenticationSessionDescriptor,
 		cloud?: boolean,
+		options?: { preserveConfigured?: boolean },
 	): Promise<void> {
-		await this.deleteSecrets(id, this.getSessionId(descriptor), cloud);
+		await this.deleteSecrets(id, this.resolveConnectionId(id, descriptor), cloud, options);
 	}
 
-	async deleteAllStoredSessions(id: IntegrationIds, cloud?: boolean): Promise<void> {
-		await this.deleteAllSecrets(id, cloud);
+	async deleteAllStoredSessions(id: IntegrationIds, cloud?: boolean, domain?: string): Promise<void> {
+		await this.deleteAllSecrets(id, cloud, domain);
 	}
 
 	/**
@@ -247,9 +302,14 @@ export class ConfiguredIntegrationService implements Disposable {
 			if (!(id in stored)) continue;
 
 			for (const descriptor of stored[id] ?? []) {
-				const sessionId = descriptor.domain ?? '';
-				await this.ctx.storage.deleteSecret(this.getLocalSecretKey(id as IntegrationIds, sessionId));
-				await this.ctx.storage.deleteSecret(this.getCloudSecretKey(id as IntegrationIds, sessionId));
+				// Mirror the hydration backfill so the secret keys we delete match what was written: fall back
+				// through domain, the provider's canonical domain, then the integration id (never empty). A
+				// legacy cloud descriptor stored neither id nor domain, so an empty connection id here would
+				// miss the canonical-domain secret (e.g. `integration.auth.cloud:github|github.com`) and orphan it.
+				const connectionId =
+					descriptor.id || descriptor.domain || providersMetadata[id as IntegrationIds]?.domain || id;
+				await this.ctx.storage.deleteSecret(this.getLocalSecretKey(id as IntegrationIds, connectionId));
+				await this.ctx.storage.deleteSecret(this.getCloudSecretKey(id as IntegrationIds, connectionId));
 				if (descriptor.domain) {
 					await this.ctx.storage.deleteWorkspace(`connected:${id}:${descriptor.domain}`);
 				}
@@ -262,35 +322,55 @@ export class ConfiguredIntegrationService implements Disposable {
 		await this.ctx.storage.store('integrations:configured', remaining as StoredIntegrationConfigurations);
 	}
 
-	async deleteSecrets(id: IntegrationIds, sessionId: string, cloud?: boolean): Promise<void> {
+	async deleteSecrets(
+		id: IntegrationIds,
+		connectionId: string,
+		cloud?: boolean,
+		options?: { preserveConfigured?: boolean },
+	): Promise<void> {
 		if (cloud == null || cloud === false) {
-			await this.ctx.storage.deleteSecret(this.getLocalSecretKey(id, sessionId));
+			await this.ctx.storage.deleteSecret(this.getLocalSecretKey(id, connectionId));
 		}
 
 		if (cloud == null || cloud === true) {
-			await this.ctx.storage.deleteSecret(this.getCloudSecretKey(id, sessionId));
+			await this.ctx.storage.deleteSecret(this.getCloudSecretKey(id, connectionId));
 		}
 
-		await this.removeConfigured(id, {
-			cloud: cloud,
-			domain: isGitSelfManagedHostIntegrationId(id) ? sessionId : undefined,
-		});
+		if (options?.preserveConfigured) return;
+
+		await this.removeConfigured(id, { connectionId: connectionId, cloud: cloud });
 	}
 
-	async deleteAllSecrets(id: IntegrationIds, cloud?: boolean): Promise<void> {
-		if (isGitSelfManagedHostIntegrationId(id)) {
-			// Hack because session IDs are tied to domain. Update this when session ids are different
-			const configuredDomains = this.configured.get(id)?.map(c => c.domain);
-			if (configuredDomains != null) {
-				for (const domain of configuredDomains) {
-					await this.deleteSecrets(id, domain!, cloud);
-				}
+	async deleteAllSecrets(id: IntegrationIds, cloud?: boolean, domain?: string): Promise<void> {
+		// Delete every connection's secret (multi-account): secrets are keyed per connection id, so a
+		// single canonical-domain delete would orphan secondary tokens. When a domain is given (self-managed
+		// disconnect of one host), scope to that host so other hosts under the same provider id survive.
+		const descriptors = this.configured.get(id);
+		const connectionIds = [
+			...new Set(
+				(domain != null ? descriptors?.filter(c => this.domainsMatch(id, c.domain, domain)) : descriptors)?.map(
+					c => c.id,
+				) ?? [],
+			),
+		];
+		if (connectionIds.length) {
+			for (const connectionId of connectionIds) {
+				await this.deleteSecrets(id, connectionId, cloud);
 			}
 
 			return;
 		}
 
-		await this.deleteSecrets(id, providersMetadata[id].domain, cloud);
+		// A domain-scoped clear that matched nothing means this host has no stored connections, so it must be
+		// a no-op. The canonical-domain fallback below would target a bogus key (self-managed canonical domain
+		// is empty), so skip it.
+		if (domain != null) return;
+
+		// No configured connections (e.g. an orphaned secret with no descriptor): fall back to the
+		// provider's canonical domain, which is the legacy session id for cloud providers. Mirror the
+		// hydration backfill's `|| id` guard so a self-managed provider (empty canonical domain) doesn't
+		// target an ambiguous empty connection id.
+		await this.deleteSecrets(id, providersMetadata[id]?.domain || id, cloud);
 	}
 
 	async writeSecret(id: IntegrationIds, session: ProviderAuthenticationSession | StoredSession): Promise<void> {
@@ -300,11 +380,14 @@ export class ConfiguredIntegrationService implements Disposable {
 		);
 
 		await this.addOrUpdateConfigured({
+			id: session.id,
 			integrationId: id,
 			domain: isGitSelfManagedHostIntegrationId(id) ? session.domain : undefined,
 			expiresAt: session.expiresAt,
 			scopes: session.scopes.join(','),
 			cloud: session.cloud ?? false,
+			type: session.type,
+			accountName: session.account?.label || undefined,
 		});
 	}
 
@@ -320,18 +403,27 @@ export class ConfiguredIntegrationService implements Disposable {
 				storedSession = JSON.parse(sessionJSON);
 				if (storedSession != null) {
 					const configured = this.configured.get(id);
-					const domain = isGitSelfManagedHostIntegrationId(id) ? storedSession.id : undefined;
+					const connectionId = storedSession.id ?? sessionId;
+					const sessionCloud = storedSession.cloud ?? cloud;
+					const domain = isGitSelfManagedHostIntegrationId(id)
+						? (storedSession.domain ?? storedSession.id)
+						: undefined;
 					if (
 						configured == null ||
 						configured.length === 0 ||
-						!configured.some(c => c.domain === domain && c.integrationId === id)
+						!configured.some(
+							c => c.id === connectionId && c.integrationId === id && c.cloud === sessionCloud,
+						)
 					) {
 						await this.addOrUpdateConfigured({
+							id: connectionId,
 							integrationId: id,
 							domain: domain,
 							expiresAt: storedSession.expiresAt,
 							scopes: storedSession.scopes.join(','),
-							cloud: storedSession.cloud ?? false,
+							cloud: sessionCloud,
+							type: storedSession.type,
+							accountName: storedSession.account?.label || undefined,
 						});
 					}
 				}
@@ -363,13 +455,155 @@ export class ConfiguredIntegrationService implements Disposable {
 		return `integration.auth.cloud:${id}|${sessionId}`;
 	}
 
-	getSessionId(descriptor: IntegrationAuthenticationSessionDescriptor): string {
-		return descriptor.domain;
+	private getPrimaryScope(
+		id: IntegrationIds,
+		descriptors: ConfiguredIntegrationDescriptor[],
+		domain: string | undefined,
+	): ConfiguredIntegrationDescriptor[] {
+		return isGitSelfManagedHostIntegrationId(id)
+			? descriptors.filter(d => this.isInPrimaryScope(id, d, domain))
+			: descriptors;
+	}
+
+	private isInPrimaryScope(
+		id: IntegrationIds,
+		descriptor: ConfiguredIntegrationDescriptor,
+		domain: string | undefined,
+	): boolean {
+		return !isGitSelfManagedHostIntegrationId(id) || this.domainsMatch(id, descriptor.domain, domain);
+	}
+
+	/**
+	 * Resolves the connection id used as the secret-key session id for an auth descriptor.
+	 * - If the descriptor targets a specific connection (`connectionId`), that wins.
+	 * - Otherwise returns the primary connection's id for the provider (matching the descriptor's domain
+	 *   for self-managed hosts; any connection for cloud hosts, where the stored domain is undefined).
+	 * - Falls back to the descriptor domain when nothing is configured yet, preserving legacy
+	 *   (pre-multi-account) reads with zero secret migration.
+	 */
+	resolveConnectionId(id: IntegrationIds, descriptor: IntegrationAuthenticationSessionDescriptor): string {
+		// An empty connectionId is not a real target — treat it as "no target" so it resolves the primary
+		// rather than keying a secret under an empty id.
+		if (descriptor.connectionId) return descriptor.connectionId;
+
+		const domain = isGitSelfManagedHostIntegrationId(id) ? descriptor.domain : undefined;
+		const candidates = this.scopeConnectionCandidates(id, domain, descriptor.cloud);
+		return (candidates?.find(c => c.primary) ?? candidates?.[0])?.id ?? descriptor.domain;
+	}
+
+	/**
+	 * Returns the id of the configured connection an unscoped descriptor resolves to (the primary for the
+	 * descriptor's domain, matching {@link resolveConnectionId}'s selection), or `undefined` when nothing is
+	 * configured for it. Unlike {@link resolveConnectionId} this only returns a genuine per-connection cloud
+	 * token id (never a local/PAT or domain-derived legacy id), so callers can safely use it to scope a cloud
+	 * token fetch to one host of a multi-host self-managed provider, or fall through to the provider-global
+	 * primary endpoint on `undefined`.
+	 */
+	getConfiguredConnectionId(id: IntegrationIds, domain: string | undefined, cloud?: boolean): string | undefined {
+		const scoped = isGitSelfManagedHostIntegrationId(id) ? domain : undefined;
+		const candidates = this.scopeConnectionCandidates(id, scoped, cloud);
+		const connection = candidates?.find(c => c.primary) ?? candidates?.[0];
+		if (connection == null) return undefined;
+
+		// Only return a real per-connection cloud token id. Reject a local (PAT) descriptor (surfaced by
+		// scopeConnectionCandidates' non-cloud fallback) and a domain-derived legacy id (the descriptor's own
+		// domain or the provider's canonical domain — see ConfiguredIntegrationDescriptor.id), either of which
+		// would target `v1/provider-tokens/tokens/{domain}` (rejected as a non-uuid). Callers then fall through
+		// to the provider-scoped primary endpoint.
+		if (!connection.cloud) return undefined;
+
+		const canonicalDomain = providersMetadata[id]?.domain;
+		if (connection.id === connection.domain || (canonicalDomain && connection.id === canonicalDomain)) {
+			return undefined;
+		}
+		return connection.id;
+	}
+
+	/**
+	 * Selects configured descriptors for a provider matching `domain`, further narrowed to the `cloud`
+	 * variant when specified. A connection id can have both a local (PAT) and cloud descriptor whose ids
+	 * differ (e.g. a legacy local descriptor keyed by domain alongside a real cloud token id); scoping by
+	 * `cloud` keeps a cloud-scoped read/delete from resolving the local id (and vice versa). Falls back to
+	 * the domain-only set when no variant matches, so legacy single-variant resolution is unchanged.
+	 */
+	private scopeConnectionCandidates(
+		id: IntegrationIds,
+		domain: string | undefined,
+		cloud: boolean | undefined,
+	): ConfiguredIntegrationDescriptor[] | undefined {
+		const candidates = this.configured.get(id)?.filter(c => this.domainsMatch(id, c.domain, domain));
+		if (cloud == null || candidates == null) return candidates;
+
+		const scoped = candidates.filter(c => c.cloud === cloud);
+		return scoped.length ? scoped : candidates;
+	}
+
+	/**
+	 * Marks the given connection as the primary/default for the provider and clears the flag on its
+	 * siblings. Persists immediately instead of relying on a session re-store to carry the primary flag.
+	 */
+	async setPrimaryConnection(id: IntegrationIds, connectionId: string): Promise<void> {
+		const descriptors = this.configured.get(id);
+		if (descriptors == null || descriptors.length === 0) return;
+		if (!descriptors.some(d => d.id === connectionId)) return;
+
+		const target =
+			descriptors.find(d => d.id === connectionId && d.cloud) ?? descriptors.find(d => d.id === connectionId);
+		if (target == null) return;
+
+		const domain = isGitSelfManagedHostIntegrationId(id) ? target.domain : undefined;
+		// A connection id can have both a local (PAT) and cloud descriptor. Mark the primary on a single
+		// canonical variant (prefer cloud, since multi-account primaries are cloud-driven) within the
+		// provider/host scope, so other self-managed hosts keep their own default connection.
+		const primaryIsCloud = descriptors.some(
+			d => d.id === connectionId && d.cloud && this.isInPrimaryScope(id, d, domain),
+		);
+
+		let changed = false;
+		const updated = descriptors.map(d => {
+			if (!this.isInPrimaryScope(id, d, domain)) return d;
+
+			const primary = d.id === connectionId && (d.cloud ?? false) === primaryIsCloud;
+			if ((d.primary ?? false) === primary) return d;
+
+			changed = true;
+			return { ...d, primary: primary };
+		});
+		if (!changed) return;
+
+		this.configured.set(id, updated);
+		this.fireChange(id);
+		await this.storeConfigured();
+	}
+
+	/**
+	 * Removes a single connection (its secret + configured descriptor). If it was the primary and other
+	 * connections remain, a secondary is promoted (see {@link removeConfigured}). Unlike
+	 * {@link deleteAllStoredSessions}, this only affects the targeted connection. Pass `cloud` to scope
+	 * the removal to the cloud/local variant when a local PAT and a cloud session share a connection id.
+	 */
+	async deleteConnection(id: IntegrationIds, connectionId: string, cloud?: boolean): Promise<void> {
+		await this.deleteSecrets(id, connectionId, cloud);
 	}
 
 	private _addedIds = new Set<IntegrationIds>();
 	private _removedIds = new Set<IntegrationIds>();
 	private _fireChangeDebounced?: () => void;
+
+	private normalizeConfiguredDomain(id: IntegrationIds, domain: string | undefined): string | undefined {
+		if (!isGitSelfManagedHostIntegrationId(id)) return domain;
+
+		return hostFromDomain(domain) ?? domain;
+	}
+
+	private domainsMatch(id: IntegrationIds, first: string | undefined, second: string | undefined): boolean {
+		if (first === second) return true;
+		if (!isGitSelfManagedHostIntegrationId(id)) return false;
+		if (first == null || second == null) return false;
+
+		return areDomainsOnSameHost(first, second);
+	}
+
 	private fireChange(added?: IntegrationIds, removed?: IntegrationIds) {
 		this._fireChangeDebounced ??= debounce(() => {
 			const added = [...this._addedIds];
@@ -410,5 +644,8 @@ function convertStoredSessionToSession(
 		domain: storedSession.domain ?? descriptor.domain,
 		protocol: storedSession.protocol,
 		type: storedSession.type,
+		// Carried for providers whose client needs an app key alongside the token (e.g. Trello); without
+		// this a rehydrated session silently loses the key and every read no-ops.
+		appKey: storedSession.appKey,
 	};
 }