@keystrokehq/sentry 0.0.15 → 0.0.16-integration-id-canonicalization.0

package/dist/sentry.credential-set-2b3TPFqv.mjs

@@ -0,0 +1,696 @@
+import { CredentialSet } from "@keystrokehq/core";
+import { z } from "zod";
+
+//#region ../../packages/credential-connection/src/token.ts
+/**
+* Shared OAuth 2.0 token-response plumbing.
+*
+* `parseOAuthTokenResponse` handles the two common wire formats (JSON and
+* form-urlencoded, the latter used by GitHub unless you explicitly ask for
+* JSON). `normalizeOAuthTokens` pulls the standard fields out of the parsed
+* body in both the flat form and Slack's nested `authed_user.access_token`
+* form. These helpers are exposed so integration authors overriding
+* `exchangeCode` / `refreshToken` do not have to re-implement them.
+*/
+var TokenExchangeError = class extends Error {
+	httpStatus;
+	constructor(httpStatus) {
+		super(`Token exchange failed: HTTP ${httpStatus}`);
+		this.name = "TokenExchangeError";
+		this.httpStatus = httpStatus;
+	}
+};
+async function parseOAuthTokenResponse(response) {
+	const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+	if (contentType.includes("application/json")) return await response.json();
+	const text = await response.text();
+	if (!text.trim()) return {};
+	if (contentType.includes("application/x-www-form-urlencoded") || text.includes("=")) {
+		const params = new URLSearchParams(text);
+		return Object.fromEntries(params.entries());
+	}
+	throw new Error(`Unsupported OAuth token response content type: ${contentType || "unknown"}`);
+}
+function normalizeOAuthTokens(tokenData) {
+	const authedUser = tokenData.authed_user;
+	const rawAccessToken = tokenData.access_token ?? authedUser?.access_token;
+	const rawRefreshToken = tokenData.refresh_token;
+	const rawExpiresIn = tokenData.expires_in;
+	const rawInstanceUrl = tokenData.instance_url;
+	return {
+		accessToken: typeof rawAccessToken === "string" ? rawAccessToken : void 0,
+		refreshToken: typeof rawRefreshToken === "string" ? rawRefreshToken : void 0,
+		expiresIn: typeof rawExpiresIn === "number" ? rawExpiresIn : typeof rawExpiresIn === "string" ? Number(rawExpiresIn) || void 0 : void 0,
+		instanceUrl: typeof rawInstanceUrl === "string" ? rawInstanceUrl : void 0
+	};
+}
+
+//#endregion
+//#region ../../packages/credential-connection/src/defaults.ts
+function buildAuthUrl(ctx) {
+	const { oauthClient, redirectUri, state, connection } = ctx;
+	const scopes = ctx.requestedScopes ?? connection.scopes;
+	const url = new URL(connection.authUrl);
+	url.searchParams.set("client_id", oauthClient.clientId);
+	url.searchParams.set("scope", scopes.join(" "));
+	url.searchParams.set("redirect_uri", redirectUri);
+	url.searchParams.set("state", state);
+	url.searchParams.set("response_type", "code");
+	return url.toString();
+}
+async function exchangeToken(params) {
+	const response = await fetch(params.tokenUrl, {
+		method: "POST",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/x-www-form-urlencoded"
+		},
+		body: params.body
+	});
+	if (!response.ok) throw new TokenExchangeError(response.status);
+	const raw = await parseOAuthTokenResponse(response);
+	const { accessToken, refreshToken, expiresIn, instanceUrl } = normalizeOAuthTokens(raw);
+	if (!accessToken) throw new Error("No access token in response");
+	return {
+		accessToken,
+		refreshToken,
+		expiresIn,
+		instanceUrl,
+		raw
+	};
+}
+async function exchangeCode(ctx) {
+	const { oauthClient, code, redirectUri, connection } = ctx;
+	if (!code) throw new Error("Missing authorization code");
+	return exchangeToken({
+		tokenUrl: connection.tokenUrl,
+		body: new URLSearchParams({
+			code,
+			client_id: oauthClient.clientId,
+			client_secret: oauthClient.clientSecret,
+			redirect_uri: redirectUri,
+			grant_type: "authorization_code"
+		})
+	});
+}
+async function refreshToken(ctx) {
+	const { oauthClient, refreshToken, connection } = ctx;
+	return exchangeToken({
+		tokenUrl: connection.tokenUrl,
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: oauthClient.clientId,
+			client_secret: oauthClient.clientSecret
+		})
+	});
+}
+const oauthDefaults = {
+	buildAuthUrl,
+	exchangeCode,
+	exchangeToken,
+	refreshToken
+};
+
+//#endregion
+//#region src/utils/errors.ts
+/**
+* Thrown from `createSentryClient(...)` methods on every non-2xx response
+* (after the retry-with-backoff loop gives up) and on any DSN-in-bearer-token
+* misuse. Operation files rely on the `kind` field to choose retry vs
+* bail-out behavior.
+*/
+var SentryApiError = class extends Error {
+	kind;
+	status;
+	providerCode;
+	requestId;
+	retryable;
+	retryAfterSec;
+	responseBody;
+	constructor(init) {
+		super(init.message, init.cause !== void 0 ? { cause: init.cause } : void 0);
+		this.name = "SentryApiError";
+		this.kind = init.kind;
+		this.status = init.status;
+		this.providerCode = init.providerCode;
+		this.requestId = init.requestId;
+		this.retryable = init.retryable;
+		this.retryAfterSec = init.retryAfterSec;
+		this.responseBody = init.responseBody;
+	}
+};
+/**
+* Classifies an HTTP response into a typed `SentryApiError`. The raw body may
+* already have been parsed as JSON or left as text; callers pass whichever
+* they produced.
+*/
+function classifyHttpResponse(response, body) {
+	const requestId = response.headers.get("x-request-id");
+	const retryAfterSec = parseRetryAfter(response.headers.get("retry-after"));
+	const providerCode = extractProviderCode(body);
+	const detail = extractDetail(body, response.status);
+	if (response.status === 401 || response.status === 403) return new SentryApiError({
+		kind: "auth",
+		message: `Sentry API authentication failed (${response.status}): ${detail}`,
+		status: response.status,
+		providerCode,
+		requestId,
+		retryable: false,
+		retryAfterSec,
+		responseBody: body
+	});
+	if (response.status === 404) return new SentryApiError({
+		kind: "not_found",
+		message: `Sentry API resource not found (404): ${detail}`,
+		status: 404,
+		providerCode,
+		requestId,
+		retryable: false,
+		retryAfterSec,
+		responseBody: body
+	});
+	if (response.status === 429) return new SentryApiError({
+		kind: "rate_limit",
+		message: `Sentry API rate limited (429): ${detail}`,
+		status: 429,
+		providerCode,
+		requestId,
+		retryable: true,
+		retryAfterSec,
+		responseBody: body
+	});
+	if (response.status === 400 || response.status === 422) return new SentryApiError({
+		kind: "validation",
+		message: `Sentry API validation failed (${response.status}): ${detail}`,
+		status: response.status,
+		providerCode,
+		requestId,
+		retryable: false,
+		retryAfterSec,
+		responseBody: body
+	});
+	if (response.status >= 500) return new SentryApiError({
+		kind: "http",
+		message: `Sentry API server error (${response.status}): ${detail}`,
+		status: response.status,
+		providerCode,
+		requestId,
+		retryable: true,
+		retryAfterSec,
+		responseBody: body
+	});
+	return new SentryApiError({
+		kind: "http",
+		message: `Sentry API request failed (${response.status}): ${detail}`,
+		status: response.status,
+		providerCode,
+		requestId,
+		retryable: false,
+		retryAfterSec,
+		responseBody: body
+	});
+}
+function parseRetryAfter(header) {
+	if (header == null) return null;
+	const asNumber = Number(header);
+	if (Number.isFinite(asNumber) && asNumber >= 0) return asNumber;
+	const asDate = Date.parse(header);
+	if (Number.isFinite(asDate)) {
+		const diff = Math.ceil((asDate - Date.now()) / 1e3);
+		return diff >= 0 ? diff : 0;
+	}
+	return null;
+}
+function extractDetail(body, status) {
+	if (body == null) return `HTTP ${status}`;
+	if (typeof body === "string") return body || `HTTP ${status}`;
+	if (typeof body === "object") {
+		const obj = body;
+		if (typeof obj.detail === "string") return obj.detail;
+		if (typeof obj.error === "string") return obj.error;
+		if (typeof obj.message === "string") return obj.message;
+	}
+	return `HTTP ${status}`;
+}
+function extractProviderCode(body) {
+	if (body == null || typeof body !== "object") return null;
+	const obj = body;
+	if (typeof obj.code === "string") return obj.code;
+	if (typeof obj.error_code === "string") return obj.error_code;
+	return null;
+}
+
+//#endregion
+//#region src/utils/pagination.ts
+function parseSentryLinkHeader(header) {
+	if (header == null || header.length === 0) return {
+		previous: null,
+		next: null
+	};
+	let previous = null;
+	let next = null;
+	for (const entry of splitLinkEntries(header)) {
+		const parsed = parseLinkEntry(entry);
+		if (!parsed) continue;
+		if (parsed.rel === "previous") previous = toPageLink(parsed.url);
+		else if (parsed.rel === "next") next = toPageLink(parsed.url);
+	}
+	return {
+		previous,
+		next
+	};
+}
+/**
+* Splits a single raw `Link` header value into its comma-separated entries.
+* Naive splitting on `,` is unsafe because cursor strings can legally contain
+* commas; we track angle-bracket depth.
+*/
+function splitLinkEntries(header) {
+	const entries = [];
+	let depth = 0;
+	let start = 0;
+	for (let i = 0; i < header.length; i += 1) {
+		const ch = header.charAt(i);
+		if (ch === "<") depth += 1;
+		else if (ch === ">") depth -= 1;
+		else if (ch === "," && depth === 0) {
+			entries.push(header.slice(start, i));
+			start = i + 1;
+		}
+	}
+	entries.push(header.slice(start));
+	return entries.map((e) => e.trim()).filter(Boolean);
+}
+function parseLinkEntry(entry) {
+	const openBracket = entry.indexOf("<");
+	const closeBracket = entry.indexOf(">", openBracket);
+	if (openBracket === -1 || closeBracket === -1) return null;
+	const url = entry.slice(openBracket + 1, closeBracket);
+	const params = parseLinkParams(entry.slice(closeBracket + 1));
+	const rel = params.rel ?? "";
+	const results = params.results === "true";
+	if (!rel) return null;
+	return {
+		url,
+		rel,
+		results
+	};
+}
+function parseLinkParams(paramsSection) {
+	const params = {};
+	for (const part of paramsSection.split(";").map((s) => s.trim())) {
+		if (!part) continue;
+		const eq = part.indexOf("=");
+		if (eq === -1) continue;
+		const key = part.slice(0, eq).trim();
+		let value = part.slice(eq + 1).trim();
+		if (value.startsWith("\"") && value.endsWith("\"")) value = value.slice(1, -1);
+		if (key) params[key] = value;
+	}
+	return params;
+}
+function toPageLink(url) {
+	return {
+		url,
+		cursor: extractCursor(url),
+		results: extractResults(url)
+	};
+}
+function extractCursor(url) {
+	const queryIndex = url.indexOf("?");
+	if (queryIndex === -1) return null;
+	const query = url.slice(queryIndex + 1);
+	for (const pair of query.split("&")) {
+		const eq = pair.indexOf("=");
+		if (eq === -1) continue;
+		if (pair.slice(0, eq) === "cursor") return decodeURIComponent(pair.slice(eq + 1));
+	}
+	return null;
+}
+function extractResults(url) {
+	const queryIndex = url.indexOf("?");
+	if (queryIndex === -1) return false;
+	const query = url.slice(queryIndex + 1);
+	for (const pair of query.split("&")) {
+		const eq = pair.indexOf("=");
+		if (eq === -1) continue;
+		if (pair.slice(0, eq) === "results") return pair.slice(eq + 1) === "true";
+	}
+	return false;
+}
+/**
+* Detects a Sentry DSN pasted where a bearer auth token was expected. DSNs
+* look like `https://<publicKey>@o<org>.ingest.sentry.io/<projectId>` (or
+* http(s) against a self-hosted host with an `@` before the host). We never
+* want to send these to the management API.
+*/
+function looksLikeSentryDsn(value) {
+	if (!value.includes("://")) return false;
+	try {
+		const parsed = new URL(value);
+		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return false;
+		return parsed.username.length > 0;
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+//#region src/utils/client.ts
+/**
+* Typed fetch-based client for the Sentry management API.
+*
+* The factory accepts the public connection credentials
+* (`SentryCredentials`) and returns a thin object with one method per HTTP
+* verb, plus a `paginate` helper that walks Sentry's `Link`-header cursor
+* chain and yields decoded results one batch at a time.
+*
+* Design notes:
+* - All requests go through `request()` so retry, DSN rejection, and error
+*   normalization live in one place.
+* - Retry policy: honours `Retry-After` on 429 and does exponential backoff
+*   with jitter on 5xx; all other 4xx responses throw immediately.
+* - Base URL: `SENTRY_REGION_URL` (persisted at install time by the OAuth
+*   hook) wins; otherwise default `https://sentry.io`. Self-hosted deployments
+*   override the region URL.
+* - The SDK path is `/api/0/` on whatever base URL the caller resolved.
+*/
+const SENTRY_DEFAULT_BASE_URL = "https://sentry.io";
+const DEFAULT_MAX_RETRIES = 3;
+const DEFAULT_BASE_DELAY_MS = 250;
+const DEFAULT_MAX_DELAY_MS = 3e4;
+const DEFAULT_TIMEOUT_MS = 3e4;
+function createSentryClient(credentials, options = {}) {
+	const token = credentials.SENTRY_ACCESS_TOKEN;
+	if (looksLikeSentryDsn(token)) throw new SentryApiError({
+		kind: "dsn_detected",
+		message: "A Sentry DSN was passed in place of a management-API bearer token. DSNs can only be used to send events; the management API requires an OAuth access token, auth token, or internal integration token.",
+		status: null,
+		providerCode: null,
+		requestId: null,
+		retryable: false,
+		retryAfterSec: null
+	});
+	const baseUrl = (credentials.SENTRY_REGION_URL ?? SENTRY_DEFAULT_BASE_URL).replace(/\/$/u, "");
+	const fetchImpl = options.fetch ?? fetch;
+	const maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES;
+	const retryBaseDelayMs = options.retryBaseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+	const maxDelayMs = options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	async function request(init) {
+		const url = buildUrl(baseUrl, init.path, init.query);
+		const headers = {
+			Authorization: `Bearer ${token}`,
+			Accept: "application/json",
+			...init.headers ?? {}
+		};
+		let body;
+		if (init.rawBody !== void 0) body = init.rawBody;
+		else if (init.body !== void 0 && init.method !== "GET" && init.method !== "DELETE") if (init.contentType === "application/x-www-form-urlencoded") {
+			headers["Content-Type"] = "application/x-www-form-urlencoded";
+			body = new URLSearchParams(init.body).toString();
+		} else {
+			headers["Content-Type"] = init.contentType ?? "application/json";
+			body = typeof init.body === "string" || init.body instanceof ArrayBuffer ? init.body : JSON.stringify(init.body);
+		}
+		let attempt = 0;
+		while (true) {
+			attempt += 1;
+			const controller = new AbortController();
+			const timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);
+			let response;
+			try {
+				response = await fetchImpl(url, {
+					method: init.method,
+					headers,
+					body,
+					signal: controller.signal
+				});
+			} catch (cause) {
+				clearTimeout(timeoutHandle);
+				if (attempt > maxRetries) throw new SentryApiError({
+					kind: "network",
+					message: `Sentry API network error: ${extractCauseMessage(cause)}`,
+					status: null,
+					providerCode: null,
+					requestId: null,
+					retryable: true,
+					retryAfterSec: null,
+					cause
+				});
+				await sleep(computeBackoffDelay(attempt, retryBaseDelayMs, maxDelayMs));
+				continue;
+			}
+			clearTimeout(timeoutHandle);
+			if (response.ok) {
+				const data = await parseResponseBody(response, init.parseAs ?? "json");
+				const links = parseSentryLinkHeader(response.headers.get("link"));
+				return {
+					data,
+					status: response.status,
+					headers: response.headers,
+					nextCursor: links.next?.results ? links.next.cursor : null,
+					previousCursor: links.previous?.results ? links.previous.cursor : null
+				};
+			}
+			const errorBody = await parseErrorBody(response);
+			const error = classifyHttpResponse(response, errorBody);
+			if (!error.retryable || attempt > maxRetries) throw error;
+			await sleep(error.retryAfterSec != null ? Math.min(error.retryAfterSec * 1e3, maxDelayMs) : computeBackoffDelay(attempt, retryBaseDelayMs, maxDelayMs));
+		}
+	}
+	async function get(path, query) {
+		return request({
+			method: "GET",
+			path,
+			query
+		});
+	}
+	async function post(path, bodyValue, query) {
+		return request({
+			method: "POST",
+			path,
+			body: bodyValue,
+			query
+		});
+	}
+	async function put(path, bodyValue, query) {
+		return request({
+			method: "PUT",
+			path,
+			body: bodyValue,
+			query
+		});
+	}
+	async function patch(path, bodyValue, query) {
+		return request({
+			method: "PATCH",
+			path,
+			body: bodyValue,
+			query
+		});
+	}
+	async function del(path, query) {
+		return request({
+			method: "DELETE",
+			path,
+			query,
+			parseAs: "none"
+		});
+	}
+	async function* paginate(path, query = {}) {
+		let cursor = null;
+		do {
+			const merged = { ...query };
+			if (cursor != null) merged.cursor = cursor;
+			const page = await get(path, merged);
+			yield page;
+			cursor = page.nextCursor;
+		} while (cursor !== null);
+	}
+	async function listAll(path, query) {
+		const acc = [];
+		for await (const page of paginate(path, query)) acc.push(...page.data);
+		return acc;
+	}
+	return {
+		get,
+		post,
+		put,
+		patch,
+		delete: del,
+		paginate,
+		listAll,
+		request,
+		resolveBaseUrl: () => baseUrl
+	};
+}
+function buildUrl(baseUrl, path, query) {
+	const base = `${baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
+	if (!query) return base;
+	const params = new URLSearchParams();
+	for (const [key, value] of Object.entries(query)) {
+		if (value == null) continue;
+		if (Array.isArray(value)) for (const v of value) {
+			if (v == null) continue;
+			params.append(key, String(v));
+		}
+		else if (typeof value === "boolean") params.append(key, value ? "true" : "false");
+		else params.append(key, String(value));
+	}
+	const qs = params.toString();
+	return qs ? `${base}?${qs}` : base;
+}
+async function parseResponseBody(response, mode) {
+	if (mode === "none") return void 0;
+	if (mode === "text") return await response.text();
+	if (response.status === 204) return void 0;
+	const raw = await response.text();
+	if (raw.length === 0) return void 0;
+	try {
+		return JSON.parse(raw);
+	} catch (cause) {
+		throw new SentryApiError({
+			kind: "http",
+			message: `Sentry API returned non-JSON body (status ${response.status})`,
+			status: response.status,
+			providerCode: null,
+			requestId: response.headers.get("x-request-id"),
+			retryable: false,
+			retryAfterSec: null,
+			responseBody: raw,
+			cause
+		});
+	}
+}
+async function parseErrorBody(response) {
+	const raw = await response.text();
+	if (raw.length === 0) return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return raw;
+	}
+}
+function computeBackoffDelay(attempt, baseMs, maxMs) {
+	const exponential = baseMs * 2 ** Math.max(0, attempt - 1);
+	const jitter = Math.random() * baseMs;
+	return Math.min(exponential + jitter, maxMs);
+}
+function extractCauseMessage(cause) {
+	if (cause instanceof Error) return cause.message;
+	if (typeof cause === "string") return cause;
+	return "unknown network error";
+}
+
+//#endregion
+//#region src/utils/oauth-connection.ts
+const SENTRY_OAUTH_SCOPES = [
+	"org:read",
+	"project:read",
+	"project:write",
+	"project:admin",
+	"team:read",
+	"team:write",
+	"team:admin",
+	"member:read",
+	"member:write",
+	"event:read",
+	"event:admin",
+	"alerts:read",
+	"alerts:write",
+	"release:admin"
+];
+const sentryOAuthConnection = {
+	kind: "oauth",
+	tokenType: "refreshable",
+	authUrl: "https://sentry.io/oauth/authorize/",
+	tokenUrl: "https://sentry.io/oauth/token/",
+	revokeUrl: null,
+	scopes: [...SENTRY_OAUTH_SCOPES],
+	vault: { accessToken: "SENTRY_ACCESS_TOKEN" },
+	async exchangeCode(ctx) {
+		const result = await oauthDefaults.exchangeCode(ctx);
+		const orgResponse = await fetch(`${SENTRY_DEFAULT_BASE_URL}/api/0/organizations/`, {
+			method: "GET",
+			headers: {
+				Authorization: `Bearer ${result.accessToken}`,
+				Accept: "application/json"
+			}
+		});
+		let firstOrg = null;
+		if (orgResponse.ok) {
+			const orgs = await orgResponse.json();
+			if (Array.isArray(orgs) && orgs.length > 0 && isOrganizationProbe(orgs[0])) firstOrg = orgs[0];
+		}
+		result.raw._sentryOrganization = firstOrg;
+		result.raw._sentryUser = pickUser(result.raw);
+		result.raw._sentryScopes = typeof result.raw.scope === "string" ? result.raw.scope : void 0;
+		return result;
+	},
+	extractInstallationInfo({ tokenResult }) {
+		const org = tokenResult.raw._sentryOrganization;
+		const user = tokenResult.raw._sentryUser;
+		const metadata = {};
+		if (org?.name) metadata.organizationName = org.name;
+		if (org?.slug) metadata.organizationSlug = org.slug;
+		const regionUrl = org?.links?.regionUrl;
+		if (regionUrl) metadata.regionUrl = regionUrl;
+		if (user?.name) metadata.userName = user.name;
+		if (user?.email) metadata.userEmail = user.email;
+		return {
+			externalInstallationId: org?.slug,
+			externalWorkspaceId: org?.id,
+			externalBotUserId: user?.id,
+			metadata
+		};
+	}
+};
+function isOrganizationProbe(value) {
+	return typeof value === "object" && value !== null;
+}
+function pickUser(raw) {
+	const user = raw.user;
+	if (user == null || typeof user !== "object") return null;
+	const u = user;
+	return {
+		id: typeof u.id === "string" ? u.id : void 0,
+		name: typeof u.name === "string" ? u.name : void 0,
+		email: typeof u.email === "string" ? u.email : void 0
+	};
+}
+
+//#endregion
+//#region src/credential-sets/sentry.credential-set.ts
+const sentryAuthSchema = z.object({
+	SENTRY_ACCESS_TOKEN: z.string().min(1),
+	SENTRY_REGION_URL: z.string().url().optional(),
+	SENTRY_ORG_SLUG: z.string().min(1).optional()
+});
+/**
+* User-facing Sentry credentials.
+*
+* Supports OAuth-installed integrations (Internal/Public Integrations) and
+* manual personal/organization auth tokens via the same vault shape:
+* `SENTRY_ACCESS_TOKEN` holds the bearer token in both cases.
+*/
+const sentryCredentialSet = new CredentialSet({
+	id: "sentry",
+	name: "Sentry",
+	description: "Sentry — issue lifecycle, release tracking, alerts, monitors, replays, feedback, and integration-platform webhook triggers",
+	auth: sentryAuthSchema,
+	proxy: { hosts: [
+		"sentry.io",
+		"us.sentry.io",
+		"de.sentry.io"
+	] },
+	connections: [{
+		id: "oauth",
+		...sentryOAuthConnection
+	}]
+});
+
+//#endregion
+export { createSentryClient as n, sentryCredentialSet as t };