@headless-lms/core 0.3.0 → 0.5.0

package/dist/automations/service.js

@@ -1,12 +1,12 @@
 import { deliverWebhookInputSchema } from "../types/schemas/automations.js";
-import { ConflictError, NotFoundError } from "../shared/errors.js";
 import { noopLogger } from "../shared/logger.js";
+import { ConflictError, InvalidInputError, NotFoundError } from "../shared/errors.js";
 import { ActionFailedError, AutomationKindMismatchError, InvalidTriggerError, ReservedActionError } from "./model.js";
 import { DELIVER_WEBHOOK_ACTION, catalogActions, catalogTriggers, publicDataSchema } from "./catalog.js";
 import { generateWebhookSecret } from "./webhook-signing.js";
 import { executeAction } from "./actions.js";
+import { assertGrantsAllowed, assertReadsEvents } from "./event-permissions.js";
 import { automationEvents } from "./events.js";
-import { communitySeeds, orgSeeds } from "./seeds.js";
 import { cronSupported } from "./schedule.js";
 //#region src/automations/service.ts
 /** True only when `input` sets `enabled` and nothing else — emits automation.enabled|disabled instead of automation.updated. */
@@ -23,11 +23,6 @@ function floorMinute(at) {
 function unique(values) {
 	return [...new Set(values)];
 }
-function recordString(value, key) {
-	if (typeof value !== "object" || value === null || !(key in value)) return null;
-	const found = value[key];
-	return typeof found === "string" ? found : null;
-}
 function filterMatches(filter, data) {
 	if (filter == null) return true;
 	if (typeof data !== "object" || data === null || Array.isArray(data)) return false;
@@ -48,8 +43,18 @@ function assertCatalogTriggers(triggers, schedules) {
 	const known = new Set(catalogTriggers().map((t) => t.type));
 	for (const trigger of triggers) if (!(schedules && trigger.startsWith("schedule:")) && !known.has(trigger)) throw new InvalidTriggerError(trigger, "unknown");
 }
+const REMOVED_ACTIONS = /* @__PURE__ */ new Set([
+	"notify",
+	"publishDuePosts",
+	"expireDueGrants",
+	"sendDigest",
+	"removeUnattachedUploads"
+]);
 function assertAuthorableActions(actions) {
-	for (const action of actions) if (action.type === "deliverWebhook") throw new ReservedActionError(action.type);
+	for (const action of actions) {
+		if (action.type === "deliverWebhook") throw new ReservedActionError(action.type);
+		if (REMOVED_ACTIONS.has(action.type)) throw new InvalidInputError(`The action "${action.type}" is no longer available`);
+	}
 }
 const SCHEDULE_FIRED = "automation.schedule.fired";
 function publicEventData(event) {
@@ -124,12 +129,13 @@ var AutomationsServiceImpl = class {
 	mailer;
 	lookups;
 	integrations;
+	systemActor;
 	credentials;
 	webhooks;
 	mail;
 	grants;
-	desk;
-	scheduledWork;
+	delivery;
+	processor;
 	logger;
 	constructor(params) {
 		this.repo = params.repo;
@@ -139,6 +145,7 @@ var AutomationsServiceImpl = class {
 		this.mailer = params.mailer;
 		this.lookups = params.lookups;
 		this.integrations = params.integrations;
+		this.systemActor = params.systemActor;
 		this.credentials = params.credentials;
 		this.webhooks = params.webhooks;
 		this.mail = {
@@ -146,13 +153,12 @@ var AutomationsServiceImpl = class {
 			recentMessageRecipients: (orgId, automationId, chatId, since) => this.runsRepo.recentRecipients(orgId, automationId, chatId, since)
 		};
 		this.grants = params.grants;
-		this.desk = params.desk;
-		this.scheduledWork = params.scheduledWork;
+		this.delivery = params.delivery;
+		this.processor = params.processor;
 		this.logger = params.logger ?? noopLogger;
 	}
 	async handle(event) {
 		if (event.type.startsWith("automation.")) return;
-		await this.seedFor(event);
 		const automations = await this.safeListByTrigger(event);
 		for (const automation of automations) {
 			const matches = filterMatches(automation.filter, event.data);
@@ -166,50 +172,7 @@ var AutomationsServiceImpl = class {
 			}
 			await this.dispatchOne(automation, event);
 		}
-	}
-	seedsFor(event) {
-		if (event.type === "organization.created") return orgSeeds();
-		if (event.type !== "content.community.created") return null;
-		const communityId = recordString(event.data, "id");
-		if (!communityId) {
-			this.logger.error("community seed missing id", {
-				orgId: event.orgId,
-				eventId: event.id
-			});
-			return null;
-		}
-		return communitySeeds(communityId);
-	}
-	async seedFor(event) {
-		const rows = this.seedsFor(event);
-		if (!rows) return;
-		if (await this.uow.run(async ({ automations, outbox }) => {
-			const created = [];
-			for (const row of rows) {
-				const inserted = await automations.insertSeed(event.orgId, {
-					name: row.name,
-					description: row.description,
-					triggers: row.triggers,
-					actions: row.actions,
-					filter: row.filter,
-					kind: "workflow",
-					source: "system"
-				});
-				if (inserted) created.push(automationEvents.automationCreated.make({
-					orgId: event.orgId,
-					data: inserted
-				}));
-			}
-			if (created.length > 0) {
-				await outbox.append(created);
-				this.logger.info("system automations seeded", {
-					orgId: event.orgId,
-					trigger: event.type,
-					count: created.length
-				});
-			}
-			return created.length;
-		}) > 0) await this.reconcileSchedules(event.orgId);
+		await this.processor.process(event);
 	}
 	async reconcileSchedules(orgId) {
 		try {
@@ -283,7 +246,7 @@ var AutomationsServiceImpl = class {
 			event
 		};
 	}
-	/** Best-effort: logs and never rethrows — `handle` must never throw. */
+	/** Best-effort: logs and never rethrows, so an org automation never fails `handle`. */
 	async recordFailure(run, error) {
 		try {
 			return await this.uow.run(async ({ runs, outbox }) => {
@@ -321,8 +284,6 @@ var AutomationsServiceImpl = class {
 				webhooks: this.webhooks,
 				mail: this.mail,
 				grants: this.grants,
-				desk: this.desk,
-				scheduledWork: this.scheduledWork,
 				automationId: d.automationId,
 				actionInput: action.input,
 				logger: this.logger
@@ -356,6 +317,9 @@ var AutomationsServiceImpl = class {
 			...failed.length > 0 ? { error: `delivery failed for ${failed.length} recipients: ${failed.join(", ")}` } : {}
 		};
 	}
+	runDelivery(d, lastAttempt) {
+		return this.delivery.run(d, lastAttempt);
+	}
 	async listSchedules() {
 		return this.repo.listSchedules();
 	}
@@ -369,13 +333,6 @@ var AutomationsServiceImpl = class {
 			});
 			return;
 		}
-		if (!await this.scheduleHasWork(orgId, automation, firedAt)) {
-			this.logger.debug("schedule idle", {
-				orgId,
-				automationId
-			});
-			return;
-		}
 		const event = {
 			type: SCHEDULE_FIRED,
 			id: `schedule_${automationId}_${firedAt.toISOString()}`,
@@ -389,21 +346,6 @@ var AutomationsServiceImpl = class {
 		};
 		await this.dispatchOne(automation, event);
 	}
-	async scheduleHasWork(orgId, automation, firedAt) {
-		const checks = automation.actions.map((action) => this.pendingWork(action.type));
-		const known = checks.filter((check) => check !== null);
-		if (checks.length === 0 || known.length < checks.length) return true;
-		for (const check of known) if (await check(orgId, firedAt)) return true;
-		return false;
-	}
-	pendingWork(type) {
-		switch (type) {
-			case "publishDuePosts": return (orgId, now) => this.scheduledWork.hasDuePosts(orgId, now);
-			case "expireDueGrants": return (orgId, now) => this.scheduledWork.hasDueGrants(orgId, now);
-			case "removeUnattachedUploads": return (orgId, now) => this.scheduledWork.hasUnattachedUploads(orgId, now);
-			default: return null;
-		}
-	}
 	async finalize(d, results) {
 		const status = results.length === d.actions.length && results.every((r) => r.status === "completed") ? "completed" : "failed";
 		await this.uow.run(async ({ runs, outbox }) => {
@@ -457,9 +399,12 @@ var AutomationsServiceImpl = class {
 			}))
 		});
 	}
-	async create(orgId, input) {
+	async create(input, actor) {
+		actor.permissions.require("automations:write");
+		const orgId = actor.orgId;
 		assertCatalogTriggers(input.triggers, true);
 		assertAuthorableActions(input.actions);
+		assertGrantsAllowed(actor, input.actions);
 		const automation = await this.uow.run(async ({ automations, outbox }) => {
 			const created = await automations.insert(orgId, {
 				...input,
@@ -474,16 +419,22 @@ var AutomationsServiceImpl = class {
 		});
 		this.logger.info("automation created", {
 			orgId,
-			automationId: automation.id
+			automationId: automation.id,
+			actorId: actor.id
 		});
 		await this.reconcileSchedules(orgId);
 		return automation;
 	}
-	async update(orgId, id, input) {
+	async update(id, input, actor) {
+		actor.permissions.require("automations:write");
+		const orgId = actor.orgId;
 		if (input.triggers !== void 0) assertCatalogTriggers(input.triggers, true);
-		if (input.actions !== void 0) assertAuthorableActions(input.actions);
+		if (input.actions !== void 0) {
+			assertAuthorableActions(input.actions);
+			assertGrantsAllowed(actor, input.actions);
+		}
 		const existing = await this.repo.findById(orgId, id);
-		if (!existing) return null;
+		if (!existing) throw new NotFoundError("Automation", id);
 		if (existing.kind !== "workflow") throw new AutomationKindMismatchError(id, existing.kind);
 		const patch = input.triggers === void 0 ? input : {
 			...input,
@@ -495,21 +446,21 @@ var AutomationsServiceImpl = class {
 			await outbox.append([updateEvent(orgId, input, updated)]);
 			return updated;
 		});
-		if (automation) {
-			this.logger.info("automation updated", {
-				orgId,
-				automationId: id
-			});
-			await this.reconcileSchedules(orgId);
-		}
+		if (!automation) throw new NotFoundError("Automation", id);
+		this.logger.info("automation updated", {
+			orgId,
+			automationId: id
+		});
+		await this.reconcileSchedules(orgId);
 		return automation;
 	}
-	async delete(orgId, id) {
+	async delete(id, actor) {
+		actor.permissions.require("automations:delete");
+		const orgId = actor.orgId;
 		const existing = await this.repo.findById(orgId, id);
-		if (!existing) return false;
+		if (!existing) throw new NotFoundError("Automation", id);
 		if (existing.kind !== "workflow") throw new AutomationKindMismatchError(id, existing.kind);
-		if (existing.source === "system") throw new ConflictError("A system automation cannot be deleted");
-		const deleted = await this.uow.run(async ({ automations, outbox }) => {
+		if (!await this.uow.run(async ({ automations, outbox }) => {
 			const removed = await automations.delete(orgId, id);
 			if (!removed) return null;
 			await outbox.append([automationEvents.automationDeleted.make({
@@ -517,35 +468,39 @@ var AutomationsServiceImpl = class {
 				data: removed
 			})]);
 			return removed;
+		})) throw new NotFoundError("Automation", id);
+		this.logger.info("automation deleted", {
+			orgId,
+			automationId: id
 		});
-		if (deleted) {
-			this.logger.info("automation deleted", {
-				orgId,
-				automationId: id
-			});
-			await this.reconcileSchedules(orgId);
-		}
-		return deleted !== null;
+		await this.reconcileSchedules(orgId);
 	}
-	async list(orgId, query) {
-		return (await this.repo.listByOrg(orgId, query?.kind)).map(toAutomationView);
+	async list(query, actor) {
+		actor.permissions.require("automations:read");
+		return (await this.repo.listByOrg(actor.orgId, query?.kind)).map(toAutomationView);
 	}
-	async get(orgId, id) {
-		const automation = await this.repo.findById(orgId, id);
-		return automation ? toAutomationView(automation) : null;
+	async get(id, actor) {
+		actor.permissions.require("automations:read");
+		const automation = await this.repo.findById(actor.orgId, id);
+		if (!automation) throw new NotFoundError("Automation", id);
+		return toAutomationView(automation);
 	}
-	async listRuns(orgId, automationId, query) {
-		const page = await this.runsRepo.list(orgId, automationId, query);
+	async listRuns(automationId, query, actor) {
+		actor.permissions.require("automations:read");
+		const page = await this.runsRepo.list(actor.orgId, automationId, query);
 		return {
 			...page,
 			rows: page.rows.map(toRunView)
 		};
 	}
-	async rerun(orgId, automationId, runId) {
+	async rerun(automationId, runId, actor) {
+		actor.permissions.require("automations:write");
+		const orgId = actor.orgId;
 		const existing = await this.runsRepo.findById(orgId, runId);
 		if (!existing || existing.automationId !== automationId) throw new NotFoundError("Automation run", runId);
 		const automation = await this.repo.findById(orgId, automationId);
 		if (!automation) throw new NotFoundError("Automation", automationId);
+		assertGrantsAllowed(actor, automation.actions);
 		const run = await this.uow.run(async ({ runs, outbox }) => {
 			const restarted = await runs.restart(orgId, runId, /* @__PURE__ */ new Date());
 			if (!restarted) return null;
@@ -575,16 +530,20 @@ var AutomationsServiceImpl = class {
 		});
 		return toRunView(run);
 	}
-	async listWebhooks(orgId) {
-		return (await this.repo.listByOrg(orgId, "webhook")).map(toWebhook);
+	async listWebhooks(actor) {
+		actor.permissions.require("automations:read");
+		return (await this.repo.listByOrg(actor.orgId, "webhook")).map(toWebhook);
 	}
-	async getWebhook(orgId, id) {
-		const automation = await this.findWebhook(orgId, id);
-		return automation ? toWebhook(automation) : null;
+	async getWebhook(id, actor) {
+		actor.permissions.require("automations:read");
+		return toWebhook(await this.requireWebhook(actor.orgId, id));
 	}
-	async createWebhook(orgId, input) {
+	async createWebhook(input, actor) {
+		actor.permissions.require("automations:write");
+		const orgId = actor.orgId;
 		const events = unique(input.events);
 		assertCatalogTriggers(events, false);
+		assertReadsEvents(actor, events);
 		const secret = generateWebhookSecret();
 		const automation = await this.uow.run(async ({ automations, credentials, outbox }) => {
 			const secretRef = await credentials.store(orgId, { secret });
@@ -616,11 +575,15 @@ var AutomationsServiceImpl = class {
 			secret
 		};
 	}
-	async updateWebhook(orgId, id, input) {
-		const existing = await this.findWebhook(orgId, id);
-		if (!existing) return null;
+	async updateWebhook(id, input, actor) {
+		actor.permissions.require("automations:write");
+		const orgId = actor.orgId;
+		const existing = await this.requireWebhook(orgId, id);
 		const events = input.events === void 0 ? void 0 : unique(input.events);
-		if (events) assertCatalogTriggers(events, false);
+		if (events) {
+			assertCatalogTriggers(events, false);
+			assertReadsEvents(actor, events);
+		}
 		const { secretRef } = webhookTarget(existing);
 		const patch = {
 			name: input.url,
@@ -641,18 +604,18 @@ var AutomationsServiceImpl = class {
 			await outbox.append([updateEvent(orgId, input, row)]);
 			return row;
 		});
-		if (!updated) return null;
+		if (!updated) throw new NotFoundError("Webhook", id);
 		this.logger.info("webhook updated", {
 			orgId,
 			automationId: id
 		});
 		return toWebhook(updated);
 	}
-	async deleteWebhook(orgId, id) {
-		const existing = await this.findWebhook(orgId, id);
-		if (!existing) return false;
-		const { secretRef } = webhookTarget(existing);
-		const deleted = await this.uow.run(async ({ automations, credentials, outbox }) => {
+	async deleteWebhook(id, actor) {
+		actor.permissions.require("automations:delete");
+		const orgId = actor.orgId;
+		const { secretRef } = webhookTarget(await this.requireWebhook(orgId, id));
+		if (!await this.uow.run(async ({ automations, credentials, outbox }) => {
 			const removed = await automations.delete(orgId, id);
 			if (!removed) return null;
 			await credentials.destroy(orgId, secretRef);
@@ -661,23 +624,24 @@ var AutomationsServiceImpl = class {
 				data: removed
 			})]);
 			return removed;
-		});
-		if (deleted) this.logger.info("webhook deleted", {
+		})) throw new NotFoundError("Webhook", id);
+		this.logger.info("webhook deleted", {
 			orgId,
 			automationId: id
 		});
-		return deleted !== null;
 	}
-	async revealWebhookSecret(orgId, id) {
-		const existing = await this.findWebhook(orgId, id);
-		if (!existing) return null;
+	async revealWebhookSecret(id, actor) {
+		actor.permissions.require("automations:write");
+		const orgId = actor.orgId;
+		const existing = await this.requireWebhook(orgId, id);
 		const secret = (await this.credentials.reveal(orgId, webhookTarget(existing).secretRef))?.["secret"];
 		if (typeof secret !== "string") throw new Error(`webhook ${id}: signing secret is missing`);
 		return { secret };
 	}
-	async rotateWebhookSecret(orgId, id) {
-		const existing = await this.findWebhook(orgId, id);
-		if (!existing) return null;
+	async rotateWebhookSecret(id, actor) {
+		actor.permissions.require("automations:write");
+		const orgId = actor.orgId;
+		const existing = await this.requireWebhook(orgId, id);
 		const secret = generateWebhookSecret();
 		await this.credentials.update(orgId, webhookTarget(existing).secretRef, { secret });
 		this.logger.info("webhook secret rotated", {
@@ -686,19 +650,22 @@ var AutomationsServiceImpl = class {
 		});
 		return { secret };
 	}
-	async findWebhook(orgId, id) {
+	async requireWebhook(orgId, id) {
 		const automation = await this.repo.findById(orgId, id);
-		return automation?.kind === "webhook" ? automation : null;
+		if (automation?.kind !== "webhook") throw new NotFoundError("Webhook", id);
+		return automation;
 	}
-	availableActions() {
-		return [...catalogActions(), ...this.integrations.available().flatMap((integration) => integration.actions.map((action) => ({
+	availableActions(actor) {
+		actor.permissions.require("automations:read");
+		return [...catalogActions(), ...this.integrations.available(this.systemActor(actor.orgId)).flatMap((integration) => integration.actions.map((action) => ({
 			type: `${integration.id}.${action.id}`,
 			description: action.description,
 			inputSchema: action.inputSchema,
 			source: integration.id
 		})))];
 	}
-	availableTriggers() {
+	availableTriggers(actor) {
+		actor.permissions.require("automations:read");
 		return { triggers: catalogTriggers() };
 	}
 };