@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.3

package/packages/identity/src/server/worker-router.js

@@ -7,6 +7,8 @@ import { getGoogleAuthUrl, exchangeGoogleCode } from '../providers/google/oauth.
 import { fetchGoogleProfile } from '../providers/google/profile.js';
 import { getGithubAuthUrl, exchangeGithubCode } from '../providers/github/oauth.js';
 import { fetchGithubProfile } from '../providers/github/profile.js';
+import { getCloudflareAuthUrl, exchangeCloudflareCode } from '../providers/cloudflare/oauth.js';
+import { fetchCloudflareProfile } from '../providers/cloudflare/profile.js';
 import { AUTH_LOGIN_PATH } from '../core/constants.js';
 import { resolveOAuthCredentialLane } from '../oauth/credentials.js';
 import { iamPlatformOAuthCallback, iamPlatformOAuthStart } from '../oauth/iam-platform.js';
@@ -89,8 +91,14 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
       password: body.password,
     });
     if (!result.ok) {
+      await adapter.logAuthEvent({
+        eventType: 'login', status: 'failed', provider: 'email', request,
+      });
       return jsonResponse({ ok: false, error: result.error }, 401);
     }
+    await adapter.logAuthEvent({
+      userId: result.user.id, eventType: 'login', status: 'ok', provider: 'email', request,
+    });
     return identity.buildLoginSuccessResponse(request, result.sessionId, body.next);
   }
 
@@ -108,7 +116,11 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   }
 
   if (path === '/api/auth/logout' && method === 'POST') {
+    const sessionCtx = await identity.sessionFromRequest(request).catch(() => null);
     await identity.logout(request);
+    await adapter.logAuthEvent({
+      userId: sessionCtx?.user?.id, eventType: 'logout', status: 'ok', request,
+    });
     return identity.buildLogoutResponse(request);
   }
 
@@ -198,21 +210,26 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   if (path === '/api/oauth/iam/start' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'iam');
     if (!lane) return jsonResponse({ ok: false, error: 'iam_oauth_not_configured' }, 503);
-    return iamPlatformOAuthStart(request, env, adapter);
+    return iamPlatformOAuthStart(request, env, adapter, identity);
   }
 
   if (path === '/api/oauth/google/start' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'google');
     if (!lane) return jsonResponse({ ok: false, error: 'google_oauth_not_configured' }, 503);
-    if (lane.lane === 'iam_platform') return iamPlatformOAuthStart(request, env, adapter);
+    if (lane.lane === 'iam_platform') return iamPlatformOAuthStart(request, env, adapter, identity);
     return oauthStart(request, env, adapter, 'google', lane);
   }
   if (path === '/api/oauth/github/start' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'github');
     if (!lane) return jsonResponse({ ok: false, error: 'github_oauth_not_configured' }, 503);
-    if (lane.lane === 'iam_platform') return iamPlatformOAuthStart(request, env, adapter);
+    if (lane.lane === 'iam_platform') return iamPlatformOAuthStart(request, env, adapter, identity);
     return oauthStart(request, env, adapter, 'github', lane);
   }
+  if (path === '/api/oauth/cloudflare/start' && method === 'GET') {
+    const lane = resolveOAuthCredentialLane(env, 'cloudflare');
+    if (!lane) return jsonResponse({ ok: false, error: 'cloudflare_oauth_not_configured' }, 503);
+    return oauthStart(request, env, adapter, 'cloudflare', lane);
+  }
 
   if (path === '/api/oauth/google/callback' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'google');
@@ -234,6 +251,13 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
     }
     return oauthCallback(request, env, identity, adapter, 'github', lane);
   }
+  if (path === '/api/oauth/cloudflare/callback' && method === 'GET') {
+    const lane = resolveOAuthCredentialLane(env, 'cloudflare');
+    if (!lane) {
+      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_not_configured`, 302);
+    }
+    return oauthCallback(request, env, identity, adapter, 'cloudflare', lane);
+  }
 
   // Auth HTML shells — use extensionless paths; assets serves foo.html at /foo.
   const authPageMap = {
@@ -277,7 +301,9 @@ async function oauthStart(request, env, adapter, provider, creds) {
   const state = randomOAuthState();
   const codeVerifier = pkceVerifier();
   const codeChallenge = await pkceChallenge(codeVerifier);
-  const redirectTo = url.searchParams.get('next') || url.searchParams.get('return_to') || '/dashboard/cms';
+  const redirectTo = identity.resolvePostLoginPath(
+    url.searchParams.get('next') || url.searchParams.get('return_to'),
+  );
   await adapter.saveOAuthState({ state, provider, codeVerifier, redirectTo });
 
   const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
@@ -289,6 +315,13 @@ async function oauthStart(request, env, adapter, provider, creds) {
       state,
       codeChallenge,
     });
+  } else if (provider === 'cloudflare') {
+    authUrl = getCloudflareAuthUrl({
+      clientId: creds.clientId,
+      redirectUri,
+      state,
+      codeChallenge,
+    });
   } else {
     authUrl = getGithubAuthUrl({
       clientId: creds.clientId,
@@ -306,10 +339,12 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
   const state = url.searchParams.get('state');
   const err = url.searchParams.get('error');
   if (err || !code || !state) {
+    await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'oauth_failed' } });
     return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_failed`, 302);
   }
   const saved = await adapter.consumeOAuthState(state);
   if (!saved || saved.provider !== provider) {
+    await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'state_mismatch' } });
     return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=state_mismatch`, 302);
   }
   const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
@@ -327,6 +362,18 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
       return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
     }
     profile = await fetchGoogleProfile(token.access_token);
+  } else if (provider === 'cloudflare') {
+    token = await exchangeCloudflareCode({
+      code,
+      codeVerifier: saved.code_verifier,
+      clientId: creds.clientId,
+      clientSecret: creds.clientSecret,
+      redirectUri,
+    });
+    if (!token?.access_token) {
+      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
+    }
+    profile = await fetchCloudflareProfile(token.access_token);
   } else {
     token = await exchangeGithubCode({
       code,
@@ -344,9 +391,14 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
     return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=userinfo_failed`, 302);
   }
 
-  const normalized = provider === 'google'
-    ? { subject: profile.sub, email: profile.email, name: profile.name }
-    : { subject: String(profile.id), email: profile.email, name: profile.name || profile.login };
+  let normalized;
+  if (provider === 'google') {
+    normalized = { subject: profile.sub, email: profile.email, name: profile.name };
+  } else if (provider === 'cloudflare') {
+    normalized = { subject: String(profile.sub), email: profile.email, name: profile.name || profile.email };
+  } else {
+    normalized = { subject: String(profile.id), email: profile.email, name: profile.name || profile.login };
+  }
 
   const result = await identity.provisionOAuthUser({
     provider,
@@ -354,8 +406,11 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
     email: normalized.email,
     displayName: normalized.name,
   });
+  await adapter.logAuthEvent({
+    userId: result.authUserId, eventType: 'login', status: 'ok', provider, request,
+  });
 
-  const redirectTo = saved.redirect_to || '/dashboard/cms';
+  const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
   const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
   const globeUrl = `${url.origin}${AUTH_LOGIN_PATH}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
   return new Response(null, {

package/packages/identity/tests/identity-service.test.mjs

@@ -66,6 +66,21 @@ function createMemoryAdapter() {
 }
 
 describe('identity service', () => {
+  it('owns its fallback and rejects external OAuth return targets', () => {
+    const identity = createIdentityService({
+      adapter: createMemoryAdapter(),
+      defaultRedirect: '/agentsam',
+    });
+
+    assert.equal(identity.resolvePostLoginPath('/projects?tab=recent'), '/projects?tab=recent');
+    assert.equal(identity.resolvePostLoginPath('https://attacker.example/'), '/agentsam');
+    assert.equal(identity.resolvePostLoginPath('//attacker.example/'), '/agentsam');
+    assert.equal(identity.resolvePostLoginPath(null), '/agentsam');
+
+    const neutral = createIdentityService({ adapter: createMemoryAdapter() });
+    assert.equal(neutral.resolvePostLoginPath(null), '/');
+  });
+
   it('signup and login issue session', async () => {
     const identity = createIdentityService({ adapter: createMemoryAdapter() });
     const signup = await identity.signup({

package/packages/providers/completeful/README.md

@@ -0,0 +1,38 @@
+# @inneranimalmedia/agentsam-provider-completeful
+
+Portable Completeful provider mechanics for AgentSam.
+
+This package is deliberately **not** a Fuel & Free Time data layer. It owns provider HTTP behavior, provider tool definitions/execution, structured provider errors, webhook signature verification, and normalized Completeful event envelopes.
+
+The host owns:
+
+- resolving `completeful.api_key` to a real secret such as Fuel & Free Time's `CAPP_KEY`;
+- account/shop configuration and authorization;
+- D1/R2 catalog mirrors and curation;
+- business workflows such as `fnf.order.sync`;
+- mapping provider events like `completeful.order.created` into domain events such as `commerce.order.created`;
+- execution receipts, queues, hook persistence, approvals and UI.
+
+## First slice
+
+The initial read-first tool surface is:
+
+- `completeful.shop.list`
+- `completeful.shop.get`
+- `completeful.catalog.list`
+- `completeful.catalog.get`
+- `completeful.catalog.semantic`
+- `completeful.order.get`
+- `completeful.webhook.list`
+
+The first mutation set is also present, with fail-closed live-write checks and explicit side-effect/idempotency metadata:
+
+- `completeful.design.create`
+- `completeful.product.create`
+- `completeful.product.publish`
+- `completeful.order.quote`
+- `completeful.order.create`
+- `completeful.order.cancel`
+- `completeful.webhook.ensure`
+
+Order reads/writes declare redacted receipt policy for address/email fields, and webhook tools declare/redact secret-bearing paths. The Completeful pinned OpenAPI contract remains under `apps/ecommerce-cms-agentsam/providers/completeful/reference/`.

package/packages/providers/completeful/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@inneranimalmedia/agentsam-provider-completeful",
+  "version": "0.1.0",
+  "private": false,
+  "description": "Portable Completeful provider adapter and AgentSam tool definitions.",
+  "type": "module",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./client": "./src/client.js",
+    "./tools": "./src/tools.js",
+    "./webhooks": "./src/webhooks.js",
+    "./events": "./src/events.js"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
+  "files": [
+    "src",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22 <25"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT"
+}

package/packages/providers/completeful/src/client.js

@@ -0,0 +1,162 @@
+export const DEFAULT_COMPLETEFUL_API_ORIGIN = 'https://vxapi.completeful.com';
+
+function trimSlashes(value) {
+  return String(value || '').replace(/\/+$/, '');
+}
+
+export function completefulApiBase(apiUrl = DEFAULT_COMPLETEFUL_API_ORIGIN) {
+  const configured = trimSlashes(apiUrl || DEFAULT_COMPLETEFUL_API_ORIGIN);
+  return configured.endsWith('/v1') ? configured : `${configured}/v1`;
+}
+
+export function completefulKeyMode(apiKey) {
+  const key = String(apiKey || '');
+  if (key.startsWith('capp_test_')) return 'test';
+  if (key.startsWith('capp_live_')) return 'live';
+  return key ? 'unknown' : 'missing';
+}
+
+export class CompletefulApiError extends Error {
+  constructor(message, details = {}) {
+    super(message);
+    this.name = 'CompletefulApiError';
+    this.status = details.status || 502;
+    this.code = details.code || null;
+    this.requestId = details.requestId || null;
+    this.path = details.path || null;
+    this.remediation = details.remediation || null;
+    this.details = details.details || null;
+    this.providerBody = details.providerBody || null;
+  }
+
+  toJSON() {
+    return {
+      error: this.message,
+      code: this.code,
+      request_id: this.requestId,
+      path: this.path,
+      remediation: this.remediation,
+      details: this.details,
+    };
+  }
+}
+
+function buildUrl(base, path, query) {
+  const normalizedPath = String(path || '').startsWith('/') ? String(path) : `/${path}`;
+  const url = new URL(`${base}${normalizedPath}`);
+  if (query) {
+    for (const [key, value] of Object.entries(query)) {
+      if (value === undefined || value === null || value === '') continue;
+      url.searchParams.set(key, String(value));
+    }
+  }
+  return url;
+}
+
+async function parseProviderResponse(response) {
+  const text = await response.text();
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { raw: text.slice(0, 4000) };
+  }
+}
+
+export function createCompletefulClient({
+  apiKey,
+  apiUrl = DEFAULT_COMPLETEFUL_API_ORIGIN,
+  allowLiveWrites = false,
+  fetchImpl = globalThis.fetch,
+} = {}) {
+  if (typeof fetchImpl !== 'function') {
+    throw new TypeError('Completeful client requires a fetch implementation');
+  }
+
+  const base = completefulApiBase(apiUrl);
+  const mode = completefulKeyMode(apiKey);
+
+  function assertConfigured() {
+    if (mode !== 'missing') return;
+    throw new CompletefulApiError('Completeful API key is missing', {
+      status: 503,
+      code: 'completeful_not_configured',
+      remediation: 'Resolve a Completeful API key through the host authority adapter.',
+    });
+  }
+
+  function assertMutationAllowed() {
+    assertConfigured();
+    if (mode === 'test') return;
+    if (mode === 'live' && allowLiveWrites) return;
+    throw new CompletefulApiError('Completeful live writes are disabled', {
+      status: 409,
+      code: 'completeful_live_writes_disabled',
+      remediation: 'Use a capp_test_ key or explicitly enable live writes in the host configuration.',
+    });
+  }
+
+  async function request(method, path, { query = null, body = undefined, idempotencyKey = null, headers = null } = {}) {
+    assertConfigured();
+
+    const url = buildUrl(base, path, query);
+    const requestHeaders = new Headers(headers || {});
+    requestHeaders.set('Accept', 'application/json');
+    requestHeaders.set('Authorization', `Bearer ${apiKey}`);
+
+    let requestBody = body;
+    if (body !== undefined && body !== null && !(body instanceof FormData)) {
+      requestHeaders.set('Content-Type', 'application/json');
+      requestBody = typeof body === 'string' ? body : JSON.stringify(body);
+    }
+    if (idempotencyKey) requestHeaders.set('Idempotency-Key', idempotencyKey);
+
+    const response = await fetchImpl(url.toString(), {
+      method,
+      headers: requestHeaders,
+      body: requestBody,
+    });
+
+    const data = await parseProviderResponse(response);
+    const requestId =
+      response.headers.get('x-request-id') ||
+      response.headers.get('x-capp-request-id') ||
+      data?.request_id ||
+      null;
+
+    const meta = {
+      status: response.status,
+      request_id: requestId,
+      mode: response.headers.get('x-capp-mode') || null,
+      dry_run: response.headers.get('x-capp-dry-run') === 'true',
+    };
+
+    if (!response.ok) {
+      const provider = data && typeof data === 'object' ? data : {};
+      throw new CompletefulApiError(
+        provider.error || provider.message || `Completeful request failed (${response.status})`,
+        {
+          status: response.status,
+          code: provider.code || 'completeful_request_failed',
+          requestId,
+          path: provider.path || url.pathname,
+          remediation: provider.remediation || null,
+          details: provider.details || null,
+          providerBody: provider,
+        },
+      );
+    }
+
+    return { data, meta };
+  }
+
+  return {
+    providerKey: 'completeful',
+    apiBase: base,
+    keyMode: mode,
+    allowLiveWrites: Boolean(allowLiveWrites),
+    request,
+    assertConfigured,
+    assertMutationAllowed,
+  };
+}

package/packages/providers/completeful/src/events.js

@@ -0,0 +1,49 @@
+function normalizeTopic(topic) {
+  return String(topic || 'unknown')
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '.')
+    .replace(/^\.+|\.+$/g, '') || 'unknown';
+}
+
+function providerObjectId(event) {
+  const data = event?.data || {};
+  return data.order_id || data.product_id || data.shop_id || data.id || event?.resource_id || null;
+}
+
+function toUnixMilliseconds(value, fallback = Date.now()) {
+  if (value == null || value === '') return fallback;
+  if (Number.isFinite(Number(value))) {
+    const n = Number(value);
+    return n > 1e12 ? Math.floor(n) : Math.floor(n * 1000);
+  }
+  const parsed = Date.parse(String(value));
+  return Number.isFinite(parsed) ? parsed : fallback;
+}
+
+export function normalizeCompletefulEvent(event, context = {}) {
+  const topic = normalizeTopic(event?.type);
+  const id = String(event?.id || context.id || crypto.randomUUID());
+  const subject = providerObjectId(event);
+  return {
+    id,
+    eventKey: `completeful.${topic}`,
+    occurredAt: toUnixMilliseconds(event?.created ?? event?.created_at, context.occurredAt),
+    source: {
+      kind: 'webhook',
+      provider: 'completeful',
+      ref: context.webhookId || undefined,
+      metadata: {
+        provider_event_id: event?.id || null,
+        provider_webhook_id: context.providerWebhookId || null,
+        shop_id: context.shopId || event?.data?.shop_id || null,
+      },
+    },
+    payload: event,
+    accountId: context.accountId,
+    subject: subject ? String(subject) : undefined,
+    correlationId: context.correlationId,
+    causationId: context.causationId,
+    metadata: context.metadata,
+  };
+}

package/packages/providers/completeful/src/index.js

@@ -0,0 +1,22 @@
+export {
+  DEFAULT_COMPLETEFUL_API_ORIGIN,
+  CompletefulApiError,
+  completefulApiBase,
+  completefulKeyMode,
+  createCompletefulClient,
+} from './client.js';
+
+export {
+  COMPLETEFUL_TOOL_DEFINITIONS,
+  getCompletefulToolDefinition,
+  executeCompletefulProviderTool,
+  createCompletefulProviderAdapter,
+} from './tools.js';
+
+export {
+  COMPLETEFUL_WEBHOOK_TOLERANCE_SECONDS,
+  computeCompletefulWebhookSignature,
+  verifyCompletefulWebhook,
+} from './webhooks.js';
+
+export { normalizeCompletefulEvent } from './events.js';