@helyx/bot 0.4.31 → 0.4.33

package/dist/control-server.js

@@ -9,6 +9,7 @@ import { z, ZodError } from "zod";
 import { addChannelMessageReaction as addDiscordChannelMessageReaction, deleteChannelMessage as deleteDiscordChannelMessage, editChannelMessage as editDiscordChannelMessage, normalizeDiscordPermission, sendToChannel as sendDiscordMessageToChannel, } from "./interactions.js";
 import { SHARD_HEALTH_STALE_MS, } from "./shard-contracts.js";
 import { dashboardCategoryLabel } from "./dashboard-category.js";
+import { assertVersion, dashboardActionPermissionId, declaredManagedResourcePermission, emptyPolicy, fromDashboardPolicy, managedResourcePermissionId, permissionPoliciesEqual, permissionPolicyKey, safeOptionalVersion, safeVersion, toDashboardPolicy, } from "./control-permissions.js";
 const snowflake = z.string().regex(/^\d{17,20}$/u);
 const moduleId = z.string().regex(/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)+$/u);
 const MAX_DISCORD_SETTING_SELECTIONS = 25;
@@ -84,6 +85,7 @@ const managedResourcePageSchema = z
     .object({
     items: z.array(managedResourceSummarySchema).max(50),
     nextCursor: resourceCursor.optional(),
+    total: z.number().int().min(0).optional(),
 })
     .strict()
     .refine(hasBoundedManagedResourceBytes);
@@ -129,11 +131,11 @@ export class DiscordGuildResourceDirectory {
     }
     async getGuildResources(guildId) {
         try {
-            const guild = await this.client.guilds.fetch(guildId);
-            const [channels, roles] = await Promise.all([
-                guild.channels.fetch(),
-                guild.roles.fetch(),
-            ]);
+            const cachedGuild = this.client.guilds.cache.get(guildId);
+            const guild = cachedGuild ?? (await this.client.guilds.fetch(guildId));
+            const [channels, roles] = cachedGuild?.available === true
+                ? [cachedGuild.channels.cache, cachedGuild.roles.cache]
+                : await Promise.all([guild.channels.fetch(), guild.roles.fetch()]);
             return {
                 channels: [...channels.values()]
                     .filter((channel) => channel?.type === ChannelType.GuildText ||
@@ -284,6 +286,26 @@ export class BotControlService {
             })
             : []);
     }
+    async cleanupOAuthConsumer(input) {
+        const module = this.#modules.get(input.moduleId);
+        if (!module)
+            throw new BotControlNotFoundError("OAuth consumer module is unavailable");
+        const consumer = module.oauthConsumers?.find((candidate) => candidate.provider === input.provider &&
+            candidate.resourceType === input.resourceType &&
+            candidate.version === input.contractVersion);
+        if (!consumer)
+            throw new BotControlNotFoundError("OAuth consumer cleanup contract is unavailable");
+        return consumer.cleanup({
+            consumerBindingId: input.consumerBindingId,
+            provider: input.provider,
+            guildId: input.guildId,
+            resourceType: input.resourceType,
+            resourceId: input.resourceId,
+            subjectUserId: input.subjectUserId,
+            correlationId: input.correlationId,
+            services: this.#services,
+        });
+    }
     async listGuildPresence(input) {
         const guildIds = [...new Set(input.guildIds)];
         if (guildIds.length > 200)
@@ -389,11 +411,25 @@ export class BotControlService {
         });
     }
     async getGuildState(guildId) {
-        const [resources, installedModules, storedLoggingPolicies, runtime] = await Promise.all([
+        const dashboardEntries = this.#dashboardModules.map((dashboardModule) => ({
+            dashboardModule,
+            module: this.#requireModule(dashboardModule.id),
+        }));
+        const moduleIds = dashboardEntries.map(({ dashboardModule }) => dashboardModule.id);
+        const permissionTargets = dashboardEntries.flatMap(({ dashboardModule, module }) => [
+            { moduleId: dashboardModule.id },
+            ...dashboardCommands(module).map(({ id }) => ({
+                moduleId: dashboardModule.id,
+                commandId: id,
+            })),
+        ]);
+        const [resources, installedModules, storedLoggingPolicies, runtime, storedConfigurations, storedPermissions,] = await Promise.all([
             this.resources.getGuildResources(guildId),
             new InstallationRepository(this.database).listModules(guildId),
             new ModuleLoggingPolicyRepository(this.database).listForGuild(guildId),
             this.#inspectRuntimeCapabilities(),
+            this.#readConfigurations(guildId, moduleIds),
+            this.#readPermissionPolicies(guildId, permissionTargets),
         ]);
         const installed = new Map(installedModules.map((module) => [module.moduleId, module]));
         const moduleStatuses = {};
@@ -404,24 +440,20 @@ export class BotControlService {
             `${policy.sourceModuleId}:${policy.eventId}`,
             policy,
         ]));
-        await Promise.all(this.#dashboardModules.map(async (dashboardModule) => {
-            const module = this.#requireModule(dashboardModule.id);
+        for (const { dashboardModule, module } of dashboardEntries) {
             const installation = installed.get(dashboardModule.id);
             moduleStatuses[dashboardModule.id] = installation
                 ? installation.enabled
                     ? "enabled"
                     : "disabled"
                 : "unavailable";
-            const [configuration, permission] = await Promise.all([
-                this.#configurations.get(guildId, dashboardModule.id),
-                this.#getPermissionState(guildId, module),
-            ]);
+            const configuration = storedConfigurations.get(dashboardModule.id);
             if (configuration)
                 configurations[dashboardModule.id] = {
                     version: safeVersion(configuration.version),
                     value: configuration.value,
                 };
-            permissions[dashboardModule.id] = permission;
+            permissions[dashboardModule.id] = this.#buildPermissionState(module, storedPermissions);
             logging[dashboardModule.id] = dashboardModule.logEvents.map((event) => {
                 const stored = loggingPolicies.get(`${dashboardModule.id}:${event.id}`);
                 return {
@@ -430,7 +462,7 @@ export class BotControlService {
                     version: stored ? safeVersion(stored.version) : 0,
                 };
             });
-        }));
+        }
         return {
             discordCapabilities: {
                 messageContent: runtime.messageContent,
@@ -444,12 +476,17 @@ export class BotControlService {
         };
     }
     async canAccessDashboard(input) {
-        const actor = await this.resources.resolveActor(input.guildId, input.actorUserId);
-        return canAccessGuildDashboard(actor, await this.#readGuildAccessPolicy(input.guildId));
+        const [actor, policy] = await Promise.all([
+            this.resources.resolveActor(input.guildId, input.actorUserId),
+            this.#readGuildAccessPolicy(input.guildId),
+        ]);
+        return canAccessGuildDashboard(actor, policy);
     }
     async getGuildAccessPolicy(input) {
-        const actor = await this.resources.resolveActor(input.guildId, input.actorUserId);
-        const record = await new GuildAccessPolicyRepository(this.database).get(input.guildId);
+        const [actor, record] = await Promise.all([
+            this.resources.resolveActor(input.guildId, input.actorUserId),
+            new GuildAccessPolicyRepository(this.database).get(input.guildId),
+        ]);
         const policy = record ?? DEFAULT_GUILD_ACCESS_POLICY;
         return {
             administratorRoleIds: [...policy.administratorRoleIds],
@@ -560,9 +597,14 @@ export class BotControlService {
     }
     async canAccessManagedResource(input) {
         try {
-            const { module } = await this.#prepareManagedResource(input);
+            const { module, resource } = this.#prepareManagedResource(input);
             this.#requireManagedResourceOperation(module, input.resourceType, input.operation);
-            await this.#authorizeAction(input.guildId, module, input.actorUserId, managedResourcePermissionId(module, input.resourceType, input.operation));
+            await Promise.all([
+                this.#authorizeAction(input.guildId, module, input.actorUserId, managedResourcePermissionId(module, input.resourceType, input.operation, undefined, declaredManagedResourcePermission(module, input.resourceType, input.operation))),
+                resource.availableWhileDisabled
+                    ? Promise.resolve()
+                    : this.#requireEnabledManagedResource(input.guildId, input.moduleId),
+            ]);
             return true;
         }
         catch (error) {
@@ -840,10 +882,13 @@ export class BotControlService {
         if (!declared || !action) {
             throw new BotControlNotFoundError("Dashboard action is not declared by this module");
         }
-        if (!(await new InstallationRepository(this.database).isModuleEnabled(input.guildId, input.moduleId))) {
+        const [enabled] = await Promise.all([
+            new InstallationRepository(this.database).isModuleEnabled(input.guildId, input.moduleId),
+            this.#authorizeAction(input.guildId, module, input.actorUserId, dashboardActionPermissionId(module, input.actionId)),
+        ]);
+        if (!enabled) {
             throw new BotControlValidationError("Enable this module before running its dashboard actions");
         }
-        await this.#authorizeAction(input.guildId, module, input.actorUserId, dashboardActionPermissionId(module, input.actionId));
         return action.execute({
             guildId: input.guildId,
             actorUserId: input.actorUserId,
@@ -854,7 +899,7 @@ export class BotControlService {
         });
     }
     async listManagedResources(input) {
-        const { module, resource } = await this.#prepareManagedResource(input);
+        const { module, resource } = this.#prepareManagedResource(input);
         this.#requireManagedResourceOperation(module, input.resourceType, "list");
         this.#validateManagedResourceQuery(module, input.resourceType, input);
         const result = await resource.list(await this.#managedResourceContext(input, module, "list"), {
@@ -866,7 +911,7 @@ export class BotControlService {
         return normalizeManagedResourcePage(managedResourcePageSchema.parse(result), managedResourceColumnKeys(module, input.resourceType));
     }
     async readManagedResource(input) {
-        const { module, resource } = await this.#prepareManagedResource(input);
+        const { module, resource } = this.#prepareManagedResource(input);
         this.#requireManagedResourceOperation(module, input.resourceType, "read");
         const result = await resource.read(await this.#managedResourceContext(input, module, "read"), input.resourceId);
         if (!result)
@@ -874,7 +919,7 @@ export class BotControlService {
         return normalizeManagedResourceDetail(managedResourceDetailSchema.parse(result), managedResourceColumnKeys(module, input.resourceType));
     }
     async listManagedResourceRelation(input) {
-        const { module, resource } = await this.#prepareManagedResource(input);
+        const { module, resource } = this.#prepareManagedResource(input);
         this.#requireManagedResourceOperation(module, input.resourceType, "read");
         const relation = module.manifest.dashboard?.resources
             ?.find(({ id }) => id === input.resourceType)
@@ -890,12 +935,12 @@ export class BotControlService {
         })), relation.columns.map(({ key }) => key));
     }
     async previewManagedResource(input) {
-        const { module, resource } = await this.#prepareManagedResource(input);
+        const { module, resource } = this.#prepareManagedResource(input);
         this.#requireManagedResourceOperation(module, input.resourceType, "preview");
         return resource.preview(await this.#managedResourceContext(input, module, "preview"), input.value);
     }
     async createManagedResource(input) {
-        const { module, resource } = await this.#prepareManagedResource(input);
+        const { module, resource } = this.#prepareManagedResource(input);
         this.#requireManagedResourceOperation(module, input.resourceType, "create");
         const context = await this.#managedResourceContext(input, module, "create");
         const declaredIntents = module.manifest.dashboard?.resources?.find(({ id }) => id === input.resourceType)?.creationIntents ?? ["publish"];
@@ -904,7 +949,7 @@ export class BotControlService {
         return normalizeManagedResourceDetail(managedResourceDetailSchema.parse(await resource.create(context, input.value, input.intent)), managedResourceColumnKeys(module, input.resourceType));
     }
     async updateManagedResource(input) {
-        const { module, resource } = await this.#prepareManagedResource(input);
+        const { module, resource } = this.#prepareManagedResource(input);
         this.#requireManagedResourceOperation(module, input.resourceType, "update");
         return normalizeManagedResourceDetail(managedResourceDetailSchema.parse(await resource.update(await this.#managedResourceContext(input, module, "update"), {
             resourceId: input.resourceId,
@@ -913,7 +958,7 @@ export class BotControlService {
         })), managedResourceColumnKeys(module, input.resourceType));
     }
     async deleteManagedResource(input) {
-        const { module, resource } = await this.#prepareManagedResource(input);
+        const { module, resource } = this.#prepareManagedResource(input);
         this.#requireManagedResourceOperation(module, input.resourceType, "delete");
         return managedResourceDeleteResultSchema.parse(await resource.delete(await this.#managedResourceContext(input, module, "delete"), {
             resourceId: input.resourceId,
@@ -921,7 +966,7 @@ export class BotControlService {
         }));
     }
     async executeManagedResourceAction(input) {
-        const { module, resource } = await this.#prepareManagedResource(input);
+        const { module, resource } = this.#prepareManagedResource(input);
         const declared = module.manifest.dashboard?.resources
             ?.find(({ id }) => id === input.resourceType)
             ?.actions?.find(({ id }) => id === input.actionId);
@@ -941,11 +986,9 @@ export class BotControlService {
             ? null
             : normalizeManagedResourceDetail(managedResourceDetailSchema.parse(result), managedResourceColumnKeys(module, input.resourceType));
     }
-    async #prepareManagedResource(input) {
+    #prepareManagedResource(input) {
         const module = this.#requireDashboardModule(input.moduleId);
         const resource = this.#requireManagedResource(module, input.resourceType);
-        if (!resource.availableWhileDisabled)
-            await this.#requireEnabledManagedResource(input.guildId, input.moduleId);
         return { module, resource };
     }
     #requireManagedResource(module, resourceType) {
@@ -979,8 +1022,14 @@ export class BotControlService {
         if (!(await new InstallationRepository(this.database).isModuleEnabled(guildId, moduleIdValue)))
             throw new BotControlValidationError("Enable this module before managing its resources");
     }
-    async #managedResourceContext(input, module, operation, permissionId = managedResourcePermissionId(module, input.resourceType, operation)) {
-        const actor = await this.#authorizeAction(input.guildId, module, input.actorUserId, permissionId);
+    async #managedResourceContext(input, module, operation, permissionId = managedResourcePermissionId(module, input.resourceType, operation, undefined, declaredManagedResourcePermission(module, input.resourceType, operation))) {
+        const resource = this.#requireManagedResource(module, input.resourceType);
+        const [actor] = await Promise.all([
+            this.#authorizeAction(input.guildId, module, input.actorUserId, permissionId),
+            resource.availableWhileDisabled
+                ? Promise.resolve()
+                : this.#requireEnabledManagedResource(input.guildId, module.manifest.id),
+        ]);
         return {
             guildId: input.guildId,
             actor,
@@ -997,9 +1046,11 @@ export class BotControlService {
         };
     }
     async #authorizeAction(guildId, module, actorUserId, permissionId) {
-        const actor = await this.resources.resolveActor(guildId, actorUserId);
-        const policy = await this.#permissions.getEffectivePolicy(guildId, module.manifest.id, permissionId);
-        const guildAccess = await this.#permissions.getGuildAccessPolicy?.(guildId);
+        const [actor, policy, guildAccess] = await Promise.all([
+            this.resources.resolveActor(guildId, actorUserId),
+            this.#permissions.getEffectivePolicy(guildId, module.manifest.id, permissionId),
+            this.#permissions.getGuildAccessPolicy?.(guildId),
+        ]);
         if (!canUseCommand(actor, policy, guildAccess))
             throw new BotControlForbiddenError();
         return actor;
@@ -1026,12 +1077,50 @@ export class BotControlService {
     }
     async #getPermissionState(guildId, module) {
         const commands = dashboardCommands(module);
-        const modulePolicy = await this.#permissions.getPolicy(guildId, module.manifest.id);
+        const policies = await this.#readPermissionPolicies(guildId, [
+            { moduleId: module.manifest.id },
+            ...commands.map(({ id }) => ({
+                moduleId: module.manifest.id,
+                commandId: id,
+            })),
+        ]);
+        return this.#buildPermissionState(module, policies);
+    }
+    async #readConfigurations(guildId, moduleIds) {
+        const values = this.#configurations.getMany
+            ? await this.#configurations.getMany(guildId, moduleIds)
+            : await Promise.all(moduleIds.map((moduleId) => this.#configurations.get(guildId, moduleId)));
+        return new Map(values
+            .filter((value) => value !== null)
+            .map((value) => [value.moduleId, value]));
+    }
+    async #readPermissionPolicies(guildId, targets) {
+        const values = this.#permissions.getPolicies
+            ? await this.#permissions.getPolicies(guildId, targets)
+            : await Promise.all(targets.map(async (target) => ({
+                ...target,
+                ...(await this.#permissions.getPolicy(guildId, target.moduleId, target.commandId)),
+            })));
+        const policies = new Map(values.map((value) => [permissionPolicyKey(value), value]));
+        for (const target of targets)
+            if (!policies.has(permissionPolicyKey(target)))
+                throw new Error("Permission policy bulk response was incomplete");
+        return policies;
+    }
+    #buildPermissionState(module, policies) {
+        const modulePolicy = policies.get(permissionPolicyKey({ moduleId: module.manifest.id }));
+        if (!modulePolicy)
+            throw new Error("Module permission policy was not resolved");
         return {
             version: safeOptionalVersion(modulePolicy.version),
             module: toDashboardPolicy(modulePolicy.policy),
-            commands: await Promise.all(commands.map(async (command) => {
-                const value = await this.#permissions.getPolicy(guildId, module.manifest.id, command.id);
+            commands: dashboardCommands(module).map((command) => {
+                const value = policies.get(permissionPolicyKey({
+                    moduleId: module.manifest.id,
+                    commandId: command.id,
+                }));
+                if (!value)
+                    throw new Error("Command permission policy was not resolved");
                 return {
                     commandId: command.id,
                     version: safeOptionalVersion(value.version),
@@ -1041,7 +1130,7 @@ export class BotControlService {
                             module.defaultPermissions?.commands[command.id] !== undefined),
                     policy: toDashboardPolicy(value.policy),
                 };
-            })),
+            }),
         };
     }
     async #validateDiscordSettings(guildId, module, value) {
@@ -1144,6 +1233,23 @@ export async function createBotControlServer(input) {
     server.get("/health", (_request, reply) => readiness(reply));
     server.get("/v1/health", (_request, reply) => readiness(reply));
     server.post("/v1/verification/results", async (request) => input.service.acceptVerificationResult(signedAssessmentEnvelopeSchema.parse(request.body)));
+    server.post("/v1/oauth/consumers/cleanup", async (request) => {
+        const body = z
+            .object({
+            consumerBindingId: z.uuid(),
+            moduleId,
+            provider: z.enum(["youtube", "twitch"]),
+            guildId: snowflake,
+            resourceType: z.string().regex(/^[a-z][a-z0-9_-]*$/u),
+            resourceId,
+            subjectUserId: snowflake,
+            contractVersion: z.number().int().min(1).max(32_767),
+            correlationId: z.string().trim().min(1).max(200),
+        })
+            .strict()
+            .parse(request.body);
+        return input.service.cleanupOAuthConsumer(body);
+    });
     server.get("/v1/shards/health", async (request, reply) => {
         reply.header("Cache-Control", "no-store");
         if (!input.shardHealth)
@@ -1650,58 +1756,6 @@ function isUnknownMemberError(error) {
         "code" in error &&
         error.code === 10_007);
 }
-function dashboardActionPermissionId(module, actionId) {
-    const namespace = modulePermissionNamespace(module);
-    return selectDeclaredPermission(module, [
-        `${namespace}.${actionId.replaceAll("-", ".")}`,
-        `${namespace}.configure`,
-    ]);
-}
-function managedResourcePermissionId(module, resourceType, operation, actionId, declaredPermissionId) {
-    if (declaredPermissionId)
-        return declaredPermissionId;
-    const namespace = modulePermissionNamespace(module);
-    const resourcePermission = `resource.${resourceType}`;
-    const candidates = operation === "create" || operation === "preview"
-        ? [`${resourcePermission}.create`, `${namespace}.create`]
-        : operation === "update"
-            ? [
-                `${resourcePermission}.update`,
-                `${namespace}.edit`,
-                `${namespace}.manage`,
-            ]
-            : operation === "delete"
-                ? [
-                    `${resourcePermission}.delete`,
-                    `${namespace}.delete`,
-                    `${namespace}.cancel`,
-                ]
-                : operation === "action" && actionId
-                    ? [
-                        `${resourcePermission}.${actionId}`,
-                        `${resourcePermission}.action.${actionId}`,
-                        `${resourcePermission}.action`,
-                        `${namespace}.${actionId.replaceAll("-", ".")}`,
-                        `${namespace}.manage`,
-                    ]
-                    : [
-                        `${resourcePermission}.${operation}`,
-                        `${namespace}.read`,
-                        `${namespace}.list`,
-                        `${namespace}.manage`,
-                        `${namespace}.entries.read`,
-                    ];
-    return selectDeclaredPermission(module, candidates);
-}
-function modulePermissionNamespace(module) {
-    return module.manifest.id.startsWith("helyx.")
-        ? module.manifest.id.slice("helyx.".length)
-        : module.manifest.id;
-}
-function selectDeclaredPermission(module, candidates) {
-    const declared = module.defaultPermissions?.commands ?? {};
-    return (candidates.find((candidate) => candidate in declared) ?? candidates[0]);
-}
 function isBoundedManagedResourceValue(value, depth = 0, budget = { keys: 0 }) {
     if (depth > 8)
         return false;
@@ -1766,6 +1820,7 @@ function normalizeManagedResourcePage(value, attributeKeys) {
             updatedAt: item.updatedAt,
         })),
         ...(value.nextCursor === undefined ? {} : { nextCursor: value.nextCursor }),
+        ...(value.total === undefined ? {} : { total: value.total }),
     };
 }
 function normalizeManagedResourceRelationPage(value, valueKeys) {
@@ -1871,81 +1926,9 @@ function dashboardCommands(module) {
         ...new Map(commands.map((command) => [command.id, command])).values(),
     ];
 }
-function toDashboardPolicy(policy) {
-    const preset = policy.everyone
-        ? "everyone"
-        : policy.accessLevel === "administrator"
-            ? "administrators"
-            : policy.accessLevel === "moderator"
-                ? "moderators"
-                : policy.allowedRoleIds.length > 0 &&
-                    policy.requiredPermissions.length === 0
-                    ? "custom"
-                    : policy.requiredPermissions.includes("ADMINISTRATOR")
-                        ? "administrators"
-                        : policy.requiredPermissions.includes("MANAGE_GUILD")
-                            ? "moderators"
-                            : "custom";
-    return {
-        preset,
-        allowedRoleIds: [...policy.allowedRoleIds],
-        deniedRoleIds: [...policy.deniedRoleIds],
-    };
-}
-function fromDashboardPolicy(input, current) {
-    return {
-        everyone: input.preset === "everyone",
-        ...(input.preset === "administrators"
-            ? { accessLevel: "administrator" }
-            : input.preset === "moderators"
-                ? { accessLevel: "moderator" }
-                : {}),
-        requiredPermissions: [],
-        allowedRoleIds: input.preset === "custom" ? input.allowedRoleIds : [],
-        deniedRoleIds: input.deniedRoleIds,
-        allowedUserIds: [...current.allowedUserIds],
-        deniedUserIds: [...current.deniedUserIds],
-    };
-}
-function emptyPolicy() {
-    return {
-        everyone: false,
-        requiredPermissions: [],
-        allowedRoleIds: [],
-        deniedRoleIds: [],
-        allowedUserIds: [],
-        deniedUserIds: [],
-    };
-}
-function permissionPoliciesEqual(left, right) {
-    return (left.everyone === right.everyone &&
-        left.accessLevel === right.accessLevel &&
-        sameStrings(left.requiredPermissions, right.requiredPermissions) &&
-        sameStrings(left.allowedRoleIds, right.allowedRoleIds) &&
-        sameStrings(left.deniedRoleIds, right.deniedRoleIds) &&
-        sameStrings(left.allowedUserIds, right.allowedUserIds) &&
-        sameStrings(left.deniedUserIds, right.deniedUserIds));
-}
-function sameStrings(left, right) {
-    return (left.length === right.length &&
-        left.every((value, index) => value === right[index]));
-}
 function assertPermissionMutationAllowed(decision) {
     if (decision.allowed)
         return;
     throw new BotControlForbiddenError(permissionMutationDenialMessage(decision.reason));
 }
-function safeVersion(version) {
-    const value = Number(version);
-    if (!Number.isSafeInteger(value) || value < 1)
-        throw new Error("Configuration version exceeded the supported range");
-    return value;
-}
-function safeOptionalVersion(version) {
-    return version === null ? 0 : safeVersion(version);
-}
-function assertVersion(actual, requested) {
-    if (safeOptionalVersion(actual) !== requested)
-        throw new OptimisticConcurrencyError("Permission policy");
-}
 //# sourceMappingURL=control-server.js.map