@helloleo/plugins 0.2.20 → 0.2.21

package/dist/index.js

@@ -25613,7 +25613,9 @@ function netsuiteServerTs() {
  * Config is read from the Cloudflare env binding via @helloleo/runtime.
  * Set NETSUITE_ACCOUNT_ID / _CLIENT_ID / _CLIENT_SECRET (secret optional for a
  * PKCE public client) and optional PUBLIC_APP_URL as HelloLeo Cloud secrets
- * (prod) or dev vars (preview). They never reach the browser.
+ * (prod) or dev vars (preview). NETSUITE_BROKER_CALLBACK (written by the
+ * HelloLeo wizard) switches the redirect URI to the shared OAuth broker so
+ * one URI serves every app/environment. They never reach the browser.
  */
 import { eq } from 'drizzle-orm'
 import { env as runtimeEnv } from '@helloleo/runtime'
@@ -25624,6 +25626,7 @@ interface NsEnv {
   NETSUITE_ACCOUNT_ID?: string
   NETSUITE_CLIENT_ID?: string
   NETSUITE_CLIENT_SECRET?: string
+  NETSUITE_BROKER_CALLBACK?: string
   PUBLIC_APP_URL?: string
   HELLOLEO_URL?: string
 }
@@ -25684,8 +25687,47 @@ export function appOrigin(request: Request) {
     url.host
   return \`\${proto}://\${hostHeader}\`
 }
+/**
+ * HelloLeo's shared OAuth broker (integration-proxy Worker). When
+ * NETSUITE_BROKER_CALLBACK is set (the platform writes it to the project env),
+ * customers register that ONE stable URI on their Integration Record instead
+ * of one URI per app/environment: the authorize redirect goes to the broker,
+ * the broker 302s the callback back to THIS app (looked up by the state
+ * nonce), and the token exchange passes the same broker URI. Unset (self-host
+ * / standalone), the app falls back to its own origin's callback.
+ */
+export function brokerCallback(): string | null {
+  const raw = nsEnv.NETSUITE_BROKER_CALLBACK
+  if (!raw) return null
+  try {
+    const u = new URL(raw)
+    return u.protocol === 'https:' ? u.toString() : null
+  } catch {
+    return null
+  }
+}
+
 export function redirectUri(request: Request) {
-  return \`\${appOrigin(request)}/auth/netsuite/callback\`
+  return brokerCallback() ?? \`\${appOrigin(request)}/auth/netsuite/callback\`
+}
+
+/**
+ * Tell the broker where to send this flow's callback: nonce -> this app's
+ * origin. MUST succeed before redirecting to NetSuite, otherwise the callback
+ * dead-ends at the broker. No-op when the broker isn't configured.
+ */
+export async function registerWithBroker(request: Request, flowId: string): Promise<void> {
+  const callback = brokerCallback()
+  if (!callback) return
+  const registerUrl = new URL('/auth/netsuite/register', callback)
+  const res = await fetch(registerUrl.toString(), {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ nonce: flowId, target: appOrigin(request) }),
+  })
+  if (!res.ok) {
+    throw new Error(\`NetSuite broker registration failed (HTTP \${res.status}) -- cannot start sign-in\`)
+  }
 }
 
 // Coerce ?return_to= to our OWN origin. The callback appends the session bearer
@@ -25849,6 +25891,7 @@ import {
   authorizeUrl,
   pkce,
   redirectUri,
+  registerWithBroker,
   requireConfig,
   safeReturnTo,
   SCOPE,
@@ -25866,6 +25909,10 @@ export const Route = createFileRoute('/auth/netsuite/start')({
 
         const { verifier, challenge } = await pkce()
         const flowId = crypto.randomUUID()
+        // With the shared broker, NetSuite redirects to the broker's fixed
+        // callback and the broker forwards here -- it must know this flow's
+        // target before the user leaves for NetSuite.
+        await registerWithBroker(request, flowId)
         await db.insert(netsuiteFlows).values({ flowId, codeVerifier: verifier, returnTo })
 
         const authorize = new URL(authorizeUrl(accountId))
@@ -26728,8 +26775,8 @@ import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
     "CONFIG -- NETSUITE_ACCOUNT_ID, NETSUITE_CLIENT_ID, NETSUITE_CLIENT_SECRET (secret optional for PKCE public clients). Never hardcode; never put in code. Same var names in every environment, different SOURCE:",
     "- DEV (Fly preview): read from the project .env. HelloLeo writes them there (the setup wizard, or the env tooling). In dev the app uses .env -- do NOT tell the user to use HelloLeo Cloud here.",
     "- PROD (published Worker): the SAME names live as HelloLeo Cloud secrets; the publish step promotes them from .env onto the Worker automatically. Same code path (@helloleo/runtime env), just a different source per environment.",
-    "- PUBLIC_APP_URL / HELLOLEO_URL are set by the platform per environment; don't hardcode them.",
-    "- REDIRECT URI -- never guess or hardcode it. It is derived server-side and auto-corrects behind the preview proxy. Read the exact value from GET /auth/netsuite/config (or getNetSuiteRedirectUri() on the client) and tell the user to register THAT on Integration Record #2 (scope: rest_webservices). ONE redirect URI per record: register exactly the value /auth/netsuite/config returns for the environment the user signs into. If login must work in BOTH the preview and the published app, use a separate Integration Record per environment (same env var names, different NETSUITE_CLIENT_ID/_SECRET values per environment) -- do not stack URLs on one record.",
+    "- PUBLIC_APP_URL / HELLOLEO_URL / NETSUITE_BROKER_CALLBACK are set by the platform per environment; don't hardcode them.",
+    "- REDIRECT URI -- never guess or hardcode it. When NETSUITE_BROKER_CALLBACK is set (the HelloLeo wizard writes it), the redirect URI is HelloLeo's shared OAuth broker: ONE stable URI the user registers ONCE on Integration Record #2 (scope: rest_webservices), valid for both the preview and the published app -- the broker routes each callback back to this app. Without it, the app falls back to its own origin's callback. Either way, read the exact value from GET /auth/netsuite/config (or getNetSuiteRedirectUri() on the client) and tell the user to register THAT.",
     "- Never replace <AuthLayout> with a password gate. Real OAuth is the only supported login."
   ].join(`
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/tools/setup-netsuite.ts

@@ -107,7 +107,9 @@ function netsuiteServerTs(): string {
  * Config is read from the Cloudflare env binding via @helloleo/runtime.
  * Set NETSUITE_ACCOUNT_ID / _CLIENT_ID / _CLIENT_SECRET (secret optional for a
  * PKCE public client) and optional PUBLIC_APP_URL as HelloLeo Cloud secrets
- * (prod) or dev vars (preview). They never reach the browser.
+ * (prod) or dev vars (preview). NETSUITE_BROKER_CALLBACK (written by the
+ * HelloLeo wizard) switches the redirect URI to the shared OAuth broker so
+ * one URI serves every app/environment. They never reach the browser.
  */
 import { eq } from 'drizzle-orm'
 import { env as runtimeEnv } from '@helloleo/runtime'
@@ -118,6 +120,7 @@ interface NsEnv {
   NETSUITE_ACCOUNT_ID?: string
   NETSUITE_CLIENT_ID?: string
   NETSUITE_CLIENT_SECRET?: string
+  NETSUITE_BROKER_CALLBACK?: string
   PUBLIC_APP_URL?: string
   HELLOLEO_URL?: string
 }
@@ -178,8 +181,47 @@ export function appOrigin(request: Request) {
     url.host
   return \`\${proto}://\${hostHeader}\`
 }
+/**
+ * HelloLeo's shared OAuth broker (integration-proxy Worker). When
+ * NETSUITE_BROKER_CALLBACK is set (the platform writes it to the project env),
+ * customers register that ONE stable URI on their Integration Record instead
+ * of one URI per app/environment: the authorize redirect goes to the broker,
+ * the broker 302s the callback back to THIS app (looked up by the state
+ * nonce), and the token exchange passes the same broker URI. Unset (self-host
+ * / standalone), the app falls back to its own origin's callback.
+ */
+export function brokerCallback(): string | null {
+  const raw = nsEnv.NETSUITE_BROKER_CALLBACK
+  if (!raw) return null
+  try {
+    const u = new URL(raw)
+    return u.protocol === 'https:' ? u.toString() : null
+  } catch {
+    return null
+  }
+}
+
 export function redirectUri(request: Request) {
-  return \`\${appOrigin(request)}/auth/netsuite/callback\`
+  return brokerCallback() ?? \`\${appOrigin(request)}/auth/netsuite/callback\`
+}
+
+/**
+ * Tell the broker where to send this flow's callback: nonce -> this app's
+ * origin. MUST succeed before redirecting to NetSuite, otherwise the callback
+ * dead-ends at the broker. No-op when the broker isn't configured.
+ */
+export async function registerWithBroker(request: Request, flowId: string): Promise<void> {
+  const callback = brokerCallback()
+  if (!callback) return
+  const registerUrl = new URL('/auth/netsuite/register', callback)
+  const res = await fetch(registerUrl.toString(), {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ nonce: flowId, target: appOrigin(request) }),
+  })
+  if (!res.ok) {
+    throw new Error(\`NetSuite broker registration failed (HTTP \${res.status}) -- cannot start sign-in\`)
+  }
 }
 
 // Coerce ?return_to= to our OWN origin. The callback appends the session bearer
@@ -345,6 +387,7 @@ import {
   authorizeUrl,
   pkce,
   redirectUri,
+  registerWithBroker,
   requireConfig,
   safeReturnTo,
   SCOPE,
@@ -362,6 +405,10 @@ export const Route = createFileRoute('/auth/netsuite/start')({
 
         const { verifier, challenge } = await pkce()
         const flowId = crypto.randomUUID()
+        // With the shared broker, NetSuite redirects to the broker's fixed
+        // callback and the broker forwards here -- it must know this flow's
+        // target before the user leaves for NetSuite.
+        await registerWithBroker(request, flowId)
         await db.insert(netsuiteFlows).values({ flowId, codeVerifier: verifier, returnTo })
 
         const authorize = new URL(authorizeUrl(accountId))
@@ -1260,8 +1307,8 @@ async function executeStart(dir: string): Promise<string> {
 		"CONFIG -- NETSUITE_ACCOUNT_ID, NETSUITE_CLIENT_ID, NETSUITE_CLIENT_SECRET (secret optional for PKCE public clients). Never hardcode; never put in code. Same var names in every environment, different SOURCE:",
 		"- DEV (Fly preview): read from the project .env. HelloLeo writes them there (the setup wizard, or the env tooling). In dev the app uses .env -- do NOT tell the user to use HelloLeo Cloud here.",
 		"- PROD (published Worker): the SAME names live as HelloLeo Cloud secrets; the publish step promotes them from .env onto the Worker automatically. Same code path (@helloleo/runtime env), just a different source per environment.",
-		"- PUBLIC_APP_URL / HELLOLEO_URL are set by the platform per environment; don't hardcode them.",
-		"- REDIRECT URI -- never guess or hardcode it. It is derived server-side and auto-corrects behind the preview proxy. Read the exact value from GET /auth/netsuite/config (or getNetSuiteRedirectUri() on the client) and tell the user to register THAT on Integration Record #2 (scope: rest_webservices). ONE redirect URI per record: register exactly the value /auth/netsuite/config returns for the environment the user signs into. If login must work in BOTH the preview and the published app, use a separate Integration Record per environment (same env var names, different NETSUITE_CLIENT_ID/_SECRET values per environment) -- do not stack URLs on one record.",
+		"- PUBLIC_APP_URL / HELLOLEO_URL / NETSUITE_BROKER_CALLBACK are set by the platform per environment; don't hardcode them.",
+		"- REDIRECT URI -- never guess or hardcode it. When NETSUITE_BROKER_CALLBACK is set (the HelloLeo wizard writes it), the redirect URI is HelloLeo's shared OAuth broker: ONE stable URI the user registers ONCE on Integration Record #2 (scope: rest_webservices), valid for both the preview and the published app -- the broker routes each callback back to this app. Without it, the app falls back to its own origin's callback. Either way, read the exact value from GET /auth/netsuite/config (or getNetSuiteRedirectUri() on the client) and tell the user to register THAT.",
 		"- Never replace <AuthLayout> with a password gate. Real OAuth is the only supported login.",
 	].join("\n");
 }