@gitkraken/core-gitlens 0.4.0 → 0.4.101

package/src/plus/integrations/models/integration.ts

@@ -1,3 +1,4 @@
+import type { CollectionMetadata } from '@gitkraken/provider-apis';
 import type { Account } from '../../../git/models/author.js';
 import type { AutolinkReference, DynamicAutolinkReference } from '../../../git/models/autolink.js';
 import type { Issue, IssueShape } from '../../../git/models/issue.js';
@@ -22,10 +23,13 @@ import type { ProviderAuthenticationSession } from '../authentication/models.js'
 import type { IntegrationIds, IssuesCloudHostIntegrationId } from '../constants.js';
 import { GitCloudHostIntegrationId } from '../constants.js';
 import type { IntegrationServiceContext } from '../context.js';
-import { AuthenticationError, RequestClientError } from '../errors.js';
+import { AuthenticationError, RequestClientError, toError } from '../errors.js';
 import type { IntegrationConnectionChangeEvent } from '../integrationService.js';
+import type { IssueFilter } from '../providerFilters.js';
 import type { ProvidersApi } from '../providers/providersApi.js';
 import type { Sources } from '../telemetry.js';
+import { areDomainsOnSameHost } from '../utils/domain.utils.js';
+import { isGitSelfManagedHostIntegrationId } from '../utils/integration.utils.js';
 import type { GitHostIntegration } from './gitHostIntegration.js';
 import type { IssuesIntegration } from './issuesIntegration.js';
 
@@ -48,6 +52,50 @@ export type IntegrationResult<T> =
 	| { error: Error; duration?: number; value?: never }
 	| undefined;
 
+/**
+ * Account-wide issue read result. `truncated` is a provider-native incompleteness signal (GitHub's search
+ * ceiling, an Azure per-project backstop); cursor-capable providers also expose `cursor`/`hasMore`/`page`.
+ * `metadata` optionally carries structured per-scope failures from a fan-out (Azure across projects).
+ */
+export type AccountWideIssuesResult = {
+	values: IssueShape[];
+	truncated: boolean;
+	metadata?: CollectionMetadata;
+	cursor?: string;
+	hasMore?: boolean;
+	page?: number;
+};
+
+/**
+ * Options for the account-wide issue read. `includeAllAssignees` drops the "assigned to me" scoping so the
+ * read broadens to issues assigned to anyone (the account-wide equivalent of the repo-scoped
+ * {@link GitHostIntegration.getMyIssuesForReposResult}'s toggle). Authored/mentioned categories, where a
+ * provider has them, stay user-relative — they're meaningless without a user.
+ */
+export type SearchMyIssuesOptions = {
+	includeAllAssignees?: boolean;
+	/**
+	 * Narrows the account-wide read to the requested relationship(s) instead of the provider's own definition of
+	 * "my issues" (GitHub/GHE: authored ∪ assigned ∪ mentioned; Azure: assigned ∪ authored; GitLab:
+	 * assigned-to-me). Narrowing has to happen HERE, not on the returned page: the excluded items still counted
+	 * toward the provider's page/cursor, so a client-side filter desynchronizes `items` from `hasMore`.
+	 *
+	 * Only filters the provider can express server-side are accepted; the facade validates the set against
+	 * `ProviderMetadata.supportedAccountWideIssueFilters` (all-or-nothing) and refuses the read rather than
+	 * serving the unnarrowed union as if it had been filtered. Omitted keeps the provider's definition.
+	 */
+	filters?: IssueFilter[];
+	cursor?: string;
+	/**
+	 * Narrows the account-wide read to one org/account (Azure: the organization) and/or one project within it.
+	 * Only honored by a host with a project layer (Azure), whose account-wide read otherwise fans out over every
+	 * project of every org; the caller checks `supportsProjectDiscovery` before asking, so a host without a
+	 * project layer never silently returns an unscoped list as if it had been narrowed.
+	 */
+	org?: string;
+	project?: string;
+};
+
 type SyncReqUsecase = Exclude<
 	| 'getAccountForCommit'
 	| 'getAccountForEmail'
@@ -57,12 +105,20 @@ type SyncReqUsecase = Exclude<
 	| 'getIssue'
 	| 'getIssueOrPullRequest'
 	| 'getIssuesForProject'
+	| 'getIssuesForRepos'
+	| 'getMyPullRequestsForUser'
+	| 'getOrganizationsForUser'
+	| 'getProjectsForOrg'
 	| 'getProjectsForResources'
 	| 'getPullRequest'
+	| 'getRepositoriesForOrg'
+	| 'getRepositoriesForUser'
 	| 'getPullRequestForBranch'
 	| 'getPullRequestForCommit'
+	| 'getPullRequestsForRepos'
 	| 'getRepositoryMetadata'
 	| 'getResourcesForUser'
+	| 'getSshSigningKeysForEmails'
 	| 'mergePullRequest'
 	| 'searchMyIssues'
 	| 'searchMyPullRequests'
@@ -131,11 +187,15 @@ export abstract class IntegrationBase<
 		if (this._session == null) return undefined;
 
 		if (this._sessionFingerprint?.session !== this._session) {
-			this._sessionFingerprint = { session: this._session, hash: fnv1aHash64(this._session.accessToken) };
+			this._sessionFingerprint = { session: this._session, hash: this.getSessionFingerprint(this._session) };
 		}
 		return this._sessionFingerprint.hash;
 	}
 
+	protected getSessionFingerprint(session: ProviderAuthenticationSession): string {
+		return fnv1aHash64(session.accessToken);
+	}
+
 	get connectionExpired(): boolean | undefined {
 		if (this._session?.expiresAt == null) return undefined;
 		return new Date(this._session.expiresAt) < new Date();
@@ -148,7 +208,58 @@ export abstract class IntegrationBase<
 		if (this._session === undefined) {
 			return this.ensureSession({ createIfNeeded: false, source: source });
 		}
-		return this._session ?? undefined;
+		return this._session != null && this.isSessionForIntegrationHost(this._session) ? this._session : undefined;
+	}
+
+	private isSessionForIntegrationHost(session: ProviderAuthenticationSession): boolean {
+		if (!isGitSelfManagedHostIntegrationId(this.id)) return true;
+
+		return areDomainsOnSameHost(this.domain, session.domain);
+	}
+
+	/**
+	 * Resolves the session to read as, for a per-connection (multi-account) read. When `connectionId` is
+	 * omitted this is the integration's primary session, resolved exactly like the existing read flow
+	 * (ensure-connected + refresh-if-expired). When set, it resolves THAT connection's session directly
+	 * from the auth provider — refreshing it if expired — WITHOUT disturbing the cached primary
+	 * `_session`. Returns undefined when the requested session can't be resolved (e.g. the connection is
+	 * gone or the provider isn't connected), so callers degrade to "no results".
+	 */
+	protected async resolveReadSession(
+		connectionId: string | undefined,
+		scope: ScopedLogger | undefined,
+		source?: Sources,
+	): Promise<ProviderAuthenticationSession | undefined> {
+		if (
+			this.ctx.config.isIntegrationsEnabled?.() === false ||
+			this.ctx.storage.getWorkspace(this.connectedKey) === false
+		) {
+			return undefined;
+		}
+
+		// A truthy connectionId targets a specific account; an empty string is not a real target, so it falls
+		// through to the primary path below.
+		if (connectionId) {
+			// Degrade to "no results" on failure, matching the primary path (whose ensureSession/
+			// refreshSessionIfExpired swallow errors) so read methods keep their never-throws contract.
+			try {
+				const authProvider = await this.authenticationService.get(this.authProvider.id);
+				const session = await authProvider.getSession(
+					{ ...this.authProviderDescriptor, connectionId: connectionId, cloud: true },
+					{ source: source },
+				);
+				return session != null && this.isSessionForIntegrationHost(session) ? session : undefined;
+			} catch (ex) {
+				scope?.error(ex);
+				return undefined;
+			}
+		}
+
+		const connected = this.maybeConnected ?? (await this.isConnected());
+		if (!connected) return undefined;
+
+		await this.refreshSessionIfExpired(scope);
+		return this._session != null && this.isSessionForIntegrationHost(this._session) ? this._session : undefined;
 	}
 
 	@debug()
@@ -182,8 +293,14 @@ export abstract class IntegrationBase<
 		}
 
 		if (signOut) {
+			// Disconnecting a provider signs out of ALL its connected accounts (multi-account), not just the
+			// primary — otherwise secondary connections' secrets/config would be orphaned. Removing a single
+			// account is done via IntegrationService.deleteConnection instead. Pass this instance's descriptor
+			// so self-managed disconnects stay scoped to this host: those group every host under one provider
+			// id, so an unscoped clear would sign the user out of unrelated hosts. deleteAllSessions derives an
+			// undefined domain for cloud providers, so they still clear every account as intended.
 			const authProvider = await this.authenticationService.get(this.authProvider.id);
-			void authProvider.deleteSession(this.authProviderDescriptor);
+			void authProvider.deleteAllSessions(this.authProviderDescriptor);
 		}
 
 		this.resetRequestExceptionCount('all');
@@ -251,9 +368,33 @@ export abstract class IntegrationBase<
 		await this.ctx.storage.deleteWorkspace(this.connectedKey);
 	}
 
+	/**
+	 * Drops the in-memory session so the next access re-resolves it from storage. Used when the primary
+	 * connection changed underneath a warm integration (e.g. after `setPrimaryConnection`/
+	 * `deleteConnection`). Unlike {@link reset}/{@link disconnect}, it deletes nothing from storage.
+	 */
+	switchConnection(): void {
+		if (this._session === undefined) return;
+
+		const wasConnected = this._session != null;
+		this._session = undefined;
+		this._onDidChange.fire();
+		void this.refreshAfterSwitch(wasConnected);
+	}
+
+	private async refreshAfterSwitch(wasConnected: boolean): Promise<void> {
+		const session = await this.ensureSession({ createIfNeeded: false });
+		if (session != null || !wasConnected) return;
+
+		this._onDidChange.fire();
+		this.didChangeConnection?.fire({ integration: this, key: this.key, reason: 'disconnected' });
+		await this.providerOnDisconnect?.();
+	}
+
 	private skippedNonCloudReported = false;
 	@debug()
 	async syncCloudConnection(state: 'connected' | 'disconnected', forceSync: boolean): Promise<void> {
+		const scope = getScopedLogger();
 		// Initially the condition on `this._session.cloud` has been added here: https://github.com/gitkraken/vscode-gitlens/commit/e95e70c430bd162924cc3bd5c1e8ab90e6293449#diff-4213141a45cccaab7aa2e40028b155a87eb913b07388485831403e60ce5555e4R237
 		// I'm not sure about reasons, but it seems we want to replace it with the cloud session if it's connected.
 		// Gradually we'll stop having non-cloud sessions.
@@ -273,6 +414,7 @@ export abstract class IntegrationBase<
 		switch (state) {
 			case 'connected': {
 				const oldSession = this._session;
+				let resyncing = false;
 				if (forceSync) {
 					// Reset our stored session so that we get a new one from the cloud
 					const authProvider = await this.authenticationService.get(this.authProvider.id);
@@ -280,6 +422,7 @@ export abstract class IntegrationBase<
 					// Reset the session and clear our "stay disconnected" flag
 					this._session = undefined;
 					await this.ctx.storage.deleteWorkspace(this.connectedKey);
+					resyncing = true;
 				} else {
 					// Only sync if we're not connected and not disabled and don't have pending errors
 					if (
@@ -295,12 +438,31 @@ export abstract class IntegrationBase<
 
 				// sync option, rather than createIfNeeded, makes sure we don't call connectCloudIntegrations and open a gkdev window
 				// if there was no session or some problem fetching/refreshing the existing session from the cloud api
-				const newSession = await this.ensureSession({ sync: forceSync });
+				let newSession: ProviderAuthenticationSession | undefined;
+				let refetchFailed = false;
+				try {
+					newSession = await this.ensureSession({ sync: forceSync });
+				} catch (ex) {
+					// Not evidence the connection is gone (#5569). Also leaves `_session` as-is rather than
+					// latching null, so the next access can re-resolve it.
+					if (!isCancellationError(ex)) {
+						scope?.error(ex);
+					}
+					refetchFailed = true;
+				}
 
 				if (oldSession && newSession && newSession.accessToken !== oldSession.accessToken) {
 					this.resetRequestExceptionCount('all');
 				}
 
+				// The forced re-sync above deleted the cloud secret but kept the descriptor to avoid UI churn.
+				// Drop it only when the replacement fetch came back definitively empty, so a connection whose
+				// token is really gone is cleanly disconnected (#5497) while a healthy one survives a blip (#5569).
+				if (resyncing && newSession == null && !refetchFailed) {
+					const authProvider = await this.authenticationService.get(this.authProvider.id);
+					await authProvider.deleteSession(this.authProviderDescriptor, { preserveConfigured: false });
+				}
+
 				break;
 			}
 			case 'disconnected':
@@ -391,8 +553,14 @@ export abstract class IntegrationBase<
 					source?: Sources;
 			  },
 	): Promise<ProviderAuthenticationSession | undefined> {
+		const scope = getScopedLogger();
+
 		const { createIfNeeded, forceNewSession, source, sync } = options;
-		if (this._session != null) return this._session;
+		if (this._session != null) {
+			if (this.isSessionForIntegrationHost(this._session)) return this._session;
+
+			this._session = null;
+		}
 		if (this.ctx.config.isIntegrationsEnabled?.() === false) return undefined;
 
 		if (createIfNeeded || sync) {
@@ -418,13 +586,25 @@ export abstract class IntegrationBase<
 			if (session?.expiresAt != null && session.expiresAt < new Date()) {
 				session = null;
 			}
+			if (session != null && !this.isSessionForIntegrationHost(session)) {
+				session = undefined;
+			}
 		} catch (ex) {
 			await this.ctx.storage.deleteWorkspace(this.connectedKey);
 
-			if (ex instanceof Error && ex.message.includes('User did not consent')) {
+			// Only interactive paths can prompt for consent, so a sync failure must reach the rethrow below.
+			if (!sync && ex instanceof Error && ex.message.includes('User did not consent')) {
 				return undefined;
 			}
 
+			// On a forced re-sync, propagate so syncCloudConnection can tell a failure from a definitive empty
+			// result (#5569); other callers keep swallowing to null so reads never throw.
+			if (sync) {
+				// Throwing skips the reset below, and a lingering count blocks the next non-forced sync.
+				this.smoothifyRequestExceptionCount();
+				throw ex;
+			}
+
 			session = null;
 		}
 
@@ -441,7 +621,18 @@ export abstract class IntegrationBase<
 			queueMicrotask(() => {
 				this._onDidChange.fire();
 				this.didChangeConnection?.fire({ integration: this, key: this.key, reason: 'connected' });
-				void this.providerOnConnect?.();
+				// Fired detached, so there is no caller left to catch anything: every implementor is async, and
+				// a rejection would surface as a process-level unhandled rejection in the host. It is a
+				// best-effort warm-up, so swallow the failure with a warning instead.
+				void (async () => {
+					try {
+						await this.providerOnConnect?.();
+					} catch (ex) {
+						scope?.warn(
+							`Failed to run providerOnConnect for ${this.key}: ${ex instanceof Error ? ex.message : String(ex)}`,
+						);
+					}
+				})();
 			});
 		}
 
@@ -452,33 +643,51 @@ export abstract class IntegrationBase<
 		return this.authenticationService.ignoreSSLErrors(this);
 	}
 
-	async searchMyIssues(resource?: ResourceDescriptor, cancellation?: AbortSignal): Promise<IssueShape[] | undefined>;
+	async searchMyIssues(
+		resource?: ResourceDescriptor,
+		cancellation?: AbortSignal,
+		connectionId?: string,
+	): Promise<IssueShape[] | undefined>;
 	async searchMyIssues(
 		resources?: ResourceDescriptor[],
 		cancellation?: AbortSignal,
+		connectionId?: string,
 	): Promise<IssueShape[] | undefined>;
 	@trace()
 	async searchMyIssues(
 		resources?: ResourceDescriptor | ResourceDescriptor[],
 		cancellation?: AbortSignal,
+		connectionId?: string,
 	): Promise<IssueShape[] | undefined> {
-		const scope = getScopedLogger();
-		const connected = this.maybeConnected ?? (await this.isConnected());
-		if (!connected) return undefined;
+		return (await this.searchMyIssuesResult(resources, cancellation, connectionId))?.value;
+	}
 
-		await this.refreshSessionIfExpired(scope);
+	/**
+	 * Result-returning core of {@link searchMyIssues}. Recovers thrown errors into `{ error }` so callers
+	 * (e.g. the ProviderBackend account-wide issues read) can surface a per-provider warning instead of a
+	 * silent empty result. Returns the normalized {@link IssueShape} (there is no raw account-wide issue read).
+	 */
+	async searchMyIssuesResult(
+		resources?: ResourceDescriptor | ResourceDescriptor[],
+		cancellation?: AbortSignal,
+		connectionId?: string,
+	): Promise<IntegrationResult<IssueShape[] | undefined>> {
+		const scope = getScopedLogger();
+		// `connectionId` targets a specific account (multi-account); omitted reads the primary.
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return undefined;
 
 		try {
 			const issues = await this.searchProviderMyIssues(
-				this._session!,
+				session,
 				resources != null ? (Array.isArray(resources) ? resources : [resources]) : undefined,
 				cancellation,
 			);
 			this.resetRequestExceptionCount('searchMyIssues');
-			return issues;
+			return { value: issues };
 		} catch (ex) {
 			this.handleProviderException('searchMyIssues', ex, { scope: scope });
-			return undefined;
+			return { error: toError(ex) };
 		}
 	}
 
@@ -488,6 +697,52 @@ export abstract class IntegrationBase<
 		cancellation?: AbortSignal,
 	): Promise<IssueShape[] | undefined>;
 
+	/**
+	 * Paging/truncation-aware variant of {@link searchProviderMyIssues}. The default wraps the normalized read
+	 * as a complete single page; providers with native cursors or fan-out metadata override it.
+	 */
+	protected async searchProviderMyIssuesWithTruncation(
+		session: ProviderAuthenticationSession,
+		resources?: ResourceDescriptor[],
+		cancellation?: AbortSignal,
+		_options?: SearchMyIssuesOptions,
+	): Promise<AccountWideIssuesResult | undefined> {
+		// The default read has no assignee scoping to broaden, so `_options` is inert here; a provider whose
+		// account-wide read is user-scoped (GitHub/GitLab/Azure) overrides this and honors `includeAllAssignees`.
+		const values = await this.searchProviderMyIssues(session, resources, cancellation);
+		if (values == null) return undefined;
+		return { values: values, truncated: false };
+	}
+
+	/**
+	 * Result-returning, truncation-aware account-wide issue read. Recovers thrown errors into `{ error }` and
+	 * carries the `truncated` flag so the ProviderBackend facade can report an incomplete read honestly.
+	 */
+	async searchMyIssuesWithTruncationResult(
+		resources?: ResourceDescriptor | ResourceDescriptor[],
+		cancellation?: AbortSignal,
+		connectionId?: string,
+		options?: SearchMyIssuesOptions,
+	): Promise<IntegrationResult<AccountWideIssuesResult | undefined>> {
+		const scope = getScopedLogger();
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return undefined;
+
+		try {
+			const result = await this.searchProviderMyIssuesWithTruncation(
+				session,
+				resources != null ? (Array.isArray(resources) ? resources : [resources]) : undefined,
+				cancellation,
+				options,
+			);
+			this.resetRequestExceptionCount('searchMyIssues');
+			return { value: result };
+		} catch (ex) {
+			this.handleProviderException('searchMyIssues', ex, { scope: scope });
+			return { error: toError(ex) };
+		}
+	}
+
 	@trace()
 	async getLinkedIssueOrPullRequest(
 		resource: T,
@@ -577,16 +832,16 @@ export abstract class IntegrationBase<
 
 	async getCurrentAccount(options?: {
 		avatarSize?: number;
+		connectionId?: string;
 		expiryOverride?: boolean | number;
 	}): Promise<Account | undefined> {
 		const scope = getScopedLogger();
+		const { connectionId: requestedConnectionId, expiryOverride, ...opts } = options ?? {};
+		const connectionId = requestedConnectionId || undefined;
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return undefined;
 
-		const connected = this.maybeConnected ?? (await this.isConnected());
-		if (!connected) return undefined;
-
-		await this.refreshSessionIfExpired(scope);
-
-		const { expiryOverride, ...opts } = options ?? {};
+		const sessionFingerprint = this.getSessionFingerprint(session);
 
 		const currentAccount = await this.ctx.cache.getCurrentAccount(
 			this,
@@ -594,7 +849,7 @@ export abstract class IntegrationBase<
 			(cacheable: any) => ({
 				value: (async () => {
 					try {
-						const account = await this.getProviderCurrentAccount?.(this._session!, opts);
+						const account = await this.getProviderCurrentAccount?.(session, opts);
 						this.resetRequestExceptionCount('getCurrentAccount');
 						return account;
 					} catch (ex) {
@@ -615,7 +870,12 @@ export abstract class IntegrationBase<
 					}
 				})(),
 			}),
-			{ expiryOverride: expiryOverride, expireOnError: false },
+			{
+				connectionId: connectionId,
+				expiryOverride: expiryOverride,
+				expireOnError: false,
+				etag: `${this.id}:${this.maybeConnected ?? false}:${sessionFingerprint}`,
+			},
 		);
 		return currentAccount;
 	}
@@ -625,6 +885,15 @@ export abstract class IntegrationBase<
 		options?: { avatarSize?: number },
 	): Promise<Account | undefined>;
 
+	/**
+	 * Resolves the account for a specific session/token — including connections other than the current
+	 * primary (multi-account) — using this integration's provider API base URL and auth type. Returns
+	 * undefined when the provider doesn't support account lookup. Uncached (callers cache per connection).
+	 */
+	getProviderAccountForSession(session: ProviderAuthenticationSession): Promise<Account | undefined> {
+		return this.getProviderCurrentAccount?.(session) ?? Promise.resolve(undefined);
+	}
+
 	@trace()
 	async getPullRequest(resource: T, id: string): Promise<PullRequest | undefined> {
 		const scope = getScopedLogger();