@nuvlore/extension-access-pagerduty 0.1.1

package/vendor/extension-sso/src/serviceRegistry.mjs

@@ -0,0 +1,497 @@
+import { OKTA_USER_HOME_APPS } from "./oktaAppCatalog.mjs";
+
+function slugify(value) {
+  return String(value)
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-|-$/g, "");
+}
+
+const OKTA_APP_SERVICE_ID_OVERRIDES = {
+  Slack: "slack",
+  Sana: "sana",
+  "Workday - Google Apps Drive": "google-drive",
+  "Workday Service Hub": "service-hub",
+  Snyk: "snyk",
+  "Collibra Data Intelligence Platform": "collibra",
+  Mixpanel: "mixpanel"
+};
+
+function oktaServiceId(appName) {
+  return OKTA_APP_SERVICE_ID_OVERRIDES[appName] ?? `okta-${slugify(appName)}`;
+}
+
+function oktaAppExtensionName(appName) {
+  return `@nuvlore/extension-access-okta-${slugify(appName)}`;
+}
+
+function oktaAppServiceEntry(appName, app) {
+  return {
+    extension: oktaAppExtensionName(appName),
+    label: appName,
+    auth: "okta-sso",
+    domains: app.domains ?? [],
+    oktaAppName: appName,
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: app.defaultBaseUrl,
+      restPathPrefix: app.probePath ?? "/",
+      oktaAppName: appName,
+      oktaAppMode: app.mode ?? "cookie-http",
+      probePath: app.probePath ?? "/"
+    }
+  };
+}
+
+const OKTA_APP_SERVICES = Object.fromEntries(
+  Object.entries(OKTA_USER_HOME_APPS)
+    .filter(([, app]) => !app.serviceId)
+    .map(([appName, app]) => [oktaServiceId(appName), oktaAppServiceEntry(appName, app)])
+);
+
+/**
+ * Strict 1:1 registry: each `id` is one Nuvlore extension package.
+ * `id` matches agentRuntimeTools.service on that extension.
+ */
+const CORE_WORKDAY_SERVICES = {
+  sso: {
+    extension: "@nuvlore/extension-sso",
+    label: "Okta",
+    auth: "okta-hub",
+    domains: ["workday.okta.com", "workdaytech.okta.com"],
+    readAccess: { readOnly: true, methods: ["GET"], mode: "cookie-http" }
+  },
+  bamboo: {
+    extension: "@nuvlore/extension-bamboo",
+    ssoAccessExtension: "@nuvlore/extension-access-bamboo",
+    label: "Bamboo CI",
+    auth: "okta-sso",
+    domains: ["bamboo11.workday.com", "bamboo16.workday.com", "bamboo20.workday.com", "bamboo.workday.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://bamboo11.workday.com",
+      restPathPrefix: "/rest/api/latest"
+    }
+  },
+  bitbucket: {
+    extension: "@nuvlore/extension-bitbucket",
+    ssoAccessExtension: "@nuvlore/extension-access-bitbucket",
+    label: "Bitbucket",
+    auth: "okta-sso",
+    domains: ["bitbucket.workday.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://bitbucket.workday.com",
+      authUrl: "https://bitbucket.workday.com/plugins/servlet/external-login/1?authDest=%2Fdashboard",
+      restPathPrefix: "/rest/api/latest"
+    }
+  },
+  confluence: {
+    extension: "@nuvlore/extension-confluence",
+    ssoAccessExtension: "@nuvlore/extension-access-confluence",
+    label: "Confluence",
+    auth: "okta-sso",
+    domains: ["confluence.workday.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://confluence.workday.com",
+      restPathPrefix: "/rest/api"
+    }
+  },
+  jira: {
+    extension: "@nuvlore/extension-jira",
+    ssoAccessExtension: "@nuvlore/extension-access-jira",
+    label: "Jira",
+    auth: "okta-sso",
+    domains: ["jira2.workday.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://jira2.workday.com",
+      restPathPrefix: "/rest/api/latest"
+    }
+  },
+  pharos: {
+    extension: "@nuvlore/extension-pharos",
+    ssoAccessExtension: "@nuvlore/extension-access-pharos",
+    label: "Pharos",
+    auth: "okta-sso",
+    domains: [
+      "prod-us.auth.wdpharos.io",
+      "dev-us.auth.wdpharos.io",
+      "grafana.produs.us.wdpharos.io",
+      "grafana.dev.wdpharos.io",
+      "metrics.produs.us.wdpharos.io",
+      "metrics-apis.produs.us.wdpharos.io",
+      "metrics.dev.wdpharos.io",
+      "metrics-apis.dev.wdpharos.io"
+    ],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://grafana.produs.us.wdpharos.io",
+      restPathPrefix: "/api"
+    }
+  },
+  dashboard: {
+    extension: "@nuvlore/extension-dashboard",
+    ssoAccessExtension: "@nuvlore/extension-access-dashboard",
+    label: "Grafana / Solas Dashboards",
+    auth: "okta-sso",
+    domains: ["grafana.produs.us.wdpharos.io", "grafana.dev.wdpharos.io", "solas.workday.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://solas.workday.com",
+      restPathPrefix: "/s/readonly"
+    }
+  },
+  github: {
+    extension: "@nuvlore/extension-github-enterprise",
+    ssoAccessExtension: "@nuvlore/extension-access-github",
+    label: "GitHub Enterprise",
+    auth: "okta-sso",
+    domains: ["ghe.megaleo.com", "wd5-master.megaleo.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://ghe.megaleo.com",
+      restPathPrefix: "/api/v3"
+    }
+  },
+  teamcity: {
+    extension: "@nuvlore/extension-teamcity",
+    ssoAccessExtension: "@nuvlore/extension-access-teamcity",
+    label: "TeamCity",
+    auth: "okta-sso",
+    domains: ["toolcity.megaleo.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://toolcity.megaleo.com",
+      restPathPrefix: "/app/rest"
+    }
+  },
+  pagerduty: {
+    extension: "@nuvlore/extension-pagerduty",
+    ssoAccessExtension: "@nuvlore/extension-access-pagerduty",
+    label: "PagerDuty",
+    auth: "okta-sso",
+    domains: ["workday.pagerduty.com", "identity.pagerduty.com", "tickets.pagerduty.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://workday.pagerduty.com",
+      restPathPrefix: "/api/v2"
+    }
+  },
+  slack: {
+    extension: "@nuvlore/extension-access-okta-slack",
+    label: "Slack",
+    auth: "okta-sso",
+    domains: ["workday.enterprise.slack.com", "workday.slack.com", "workday-dev.slack.com", "slack.com", "app.slack.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://workday.enterprise.slack.com",
+      restPathPrefix: "/"
+    }
+  },
+  sana: {
+    extension: "@nuvlore/extension-access-okta-sana",
+    label: "Sana",
+    auth: "okta-sso",
+    domains: ["workday.sana.ai", "sana.ai", "sanalabs.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://workday.sana.ai",
+      restPathPrefix: "/"
+    }
+  },
+  "google-drive": {
+    extension: "@nuvlore/extension-access-okta-workday-google-apps-drive",
+    label: "Workday Google Drive",
+    auth: "okta-sso",
+    domains: ["drive.google.com", "accounts.google.com", "google.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://drive.google.com",
+      restPathPrefix: "/drive"
+    }
+  },
+  "service-hub": {
+    extension: "@nuvlore/extension-access-okta-workday-service-hub",
+    label: "Workday Service Hub",
+    auth: "okta-sso",
+    domains: ["workday.service-now.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://workday.service-now.com",
+      restPathPrefix: "/"
+    }
+  },
+  snyk: {
+    extension: "@nuvlore/extension-access-okta-snyk",
+    label: "Snyk",
+    auth: "okta-sso",
+    domains: ["app.snyk.io"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://app.snyk.io",
+      restPathPrefix: "/"
+    }
+  },
+  collibra: {
+    extension: "@nuvlore/extension-access-okta-collibra-data-intelligence-platform",
+    label: "Collibra Data Intelligence Platform",
+    auth: "okta-sso",
+    domains: ["workday.collibra.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://workday.collibra.com",
+      restPathPrefix: "/"
+    }
+  },
+  mixpanel: {
+    extension: "@nuvlore/extension-access-okta-mixpanel",
+    label: "Mixpanel",
+    auth: "okta-sso",
+    domains: ["mixpanel.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://mixpanel.com",
+      restPathPrefix: "/"
+    }
+  },
+  kubernetes: {
+    extension: "@nuvlore/extension-kubernetes",
+    label: "Kubernetes",
+    auth: "okta-sso+boundary",
+    domains: ["boundary.workday.com", "horizon.workdayinternal.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["get", "describe", "logs"],
+      mode: "cli-readonly",
+      note: "Use kubernetes_status_snapshot — kubectl get/describe/logs only."
+    }
+  },
+  "apache-projects": {
+    extension: "@nuvlore/extension-apache-projects",
+    label: "Apache Projects",
+    auth: "public",
+    domains: ["downloads.apache.org", "archive.apache.org"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "public-http",
+      defaultBaseUrl: "https://downloads.apache.org"
+    }
+  },
+  workflow: {
+    extension: "@nuvlore/extension-claude-code-client",
+    label: "Claude Code Workflows",
+    auth: "local",
+    domains: [],
+    readAccess: { readOnly: true, methods: [], mode: "local" }
+  },
+  local: {
+    extension: "@nuvlore/extension-local-diagnostics",
+    label: "Local Diagnostics",
+    auth: "local",
+    domains: [],
+    readAccess: { readOnly: true, methods: [], mode: "local" }
+  },
+  "log-analysis": {
+    extension: "@nuvlore/extension-log-analysis",
+    label: "Log Analysis",
+    auth: "local",
+    domains: [],
+    readAccess: { readOnly: true, methods: [], mode: "local" }
+  },
+  remote: {
+    extension: "@nuvlore/extension-remote-readonly",
+    label: "Remote SSH Read-only",
+    auth: "ssh",
+    domains: [],
+    readAccess: {
+      readOnly: true,
+      methods: ["read"],
+      mode: "ssh-readonly",
+      note: "Use remote_readonly_command — read-only shell policy."
+    }
+  },
+  repository: {
+    extension: "@nuvlore/extension-repository",
+    ssoAccessExtension: "@nuvlore/extension-access-repository",
+    label: "Repository / Artifactory",
+    auth: "okta-sso",
+    domains: ["artifactory.workday.com"],
+    readAccess: {
+      readOnly: true,
+      methods: ["GET"],
+      mode: "cookie-http",
+      defaultBaseUrl: "https://artifactory.workday.com",
+      restPathPrefix: "/artifactory/api"
+    }
+  },
+  review: {
+    extension: "@nuvlore/extension-review",
+    label: "Code Review",
+    auth: "workflow",
+    domains: [],
+    requires: ["bitbucket", "github", "jira"],
+    readAccess: { readOnly: true, methods: ["GET"], mode: "workflow" }
+  },
+  "runtime-governance": {
+    extension: "@nuvlore/extension-runtime-governance",
+    label: "Runtime Governance",
+    auth: "local",
+    domains: [],
+    readAccess: { readOnly: true, methods: [], mode: "local" }
+  },
+  pensiv: {
+    extension: "@nuvlore/extension-pensiv",
+    label: "Pensiv Memory",
+    auth: "mcp",
+    domains: [],
+    readAccess: { readOnly: true, methods: ["GET"], mode: "mcp" }
+  },
+  "workday-toolkit": {
+    extension: "@nuvlore/extension-read-only-toolkit",
+    label: "Workday Toolkit (library)",
+    auth: "library",
+    domains: [],
+    readAccess: { readOnly: true, methods: [], mode: "library" }
+  },
+  bds: {
+    extension: "@nuvlore/extension-bds",
+    label: "BDS Workflows",
+    auth: "workflow",
+    domains: [],
+    requires: ["jira", "bitbucket", "confluence", "pharos", "dashboard", "kubernetes", "repository"],
+    readAccess: { readOnly: true, methods: ["GET"], mode: "workflow" }
+  },
+  "workday-ci": {
+    extension: "@nuvlore/extension-workday-ci",
+    label: "Workday CI Workflows",
+    auth: "workflow",
+    domains: [],
+    requires: ["bamboo", "bitbucket", "github", "jira", "kubernetes", "log-analysis"],
+    readAccess: { readOnly: true, methods: ["GET"], mode: "workflow" }
+  },
+  "workday-enterprise-workflows": {
+    extension: "@nuvlore/extension-workday-enterprise-workflows",
+    label: "Workday Enterprise Workflows",
+    auth: "workflow",
+    domains: [],
+    requires: ["bamboo", "bitbucket", "confluence", "github", "jira", "pagerduty", "teamcity", "repository", "review"],
+    readAccess: { readOnly: true, methods: ["GET"], mode: "workflow" }
+  },
+  "workday-infra-access": {
+    extension: "@nuvlore/extension-workday-infra-access",
+    label: "Workday Infra Access",
+    auth: "okta-sso",
+    domains: [
+      "signin.aws.amazon.com",
+      "console.cloud.google.com",
+      "boundary.workday.com",
+      "signin.resourcecenter.workday.com",
+      "dcselfservice.myworkday.com"
+    ],
+    readAccess: {
+      readOnly: true,
+      methods: ["describe", "list", "get", "logs"],
+      mode: "cli-readonly",
+      platforms: {
+        aws: { domains: ["signin.aws.amazon.com"], tool: "aws_cust_federated_readonly_command_pack" },
+        gcp: { domains: ["console.cloud.google.com"], tool: "gcp_readonly_command_pack" },
+        boundary: { domains: ["boundary.workday.com"], tool: "workday_boundary_login", action: "status" }
+      }
+    }
+  },
+  "workday-sre-workflows": {
+    extension: "@nuvlore/extension-workday-sre-workflows",
+    label: "Workday SRE Workflows",
+    auth: "workflow",
+    domains: [],
+    requires: ["pharos", "dashboard", "pagerduty", "kubernetes", "workday-infra-access"],
+    readAccess: { readOnly: true, methods: ["GET"], mode: "workflow" }
+  }
+};
+
+export const WORKDAY_SERVICES = {
+  ...CORE_WORKDAY_SERVICES,
+  ...OKTA_APP_SERVICES
+};
+
+function assertUniqueExtensions() {
+  const seen = new Map();
+  for (const [id, service] of Object.entries(WORKDAY_SERVICES)) {
+    const pkg = service.extension;
+    if (seen.has(pkg)) {
+      throw new Error(`Duplicate extension ${pkg} on services ${seen.get(pkg)} and ${id}`);
+    }
+    seen.set(pkg, id);
+  }
+}
+assertUniqueExtensions();
+
+export function listWorkdayServices() {
+  return Object.entries(WORKDAY_SERVICES).map(([id, service]) => ({ id, ...service }));
+}
+
+export function listWorkdayExtensions() {
+  return listWorkdayServices();
+}
+
+export function getWorkdayService(id) {
+  const service = WORKDAY_SERVICES[id];
+  if (!service) {
+    throw new Error(`Unknown Workday service: ${id}`);
+  }
+  return { id, ...service };
+}
+
+export function getServiceDomains(id) {
+  return [...(getWorkdayService(id).domains ?? [])];
+}
+
+export function getServiceByExtension(packageName) {
+  const match = listWorkdayServices().find((service) => service.extension === packageName);
+  if (!match) {
+    throw new Error(`No SSO registry entry for extension: ${packageName}`);
+  }
+  return match;
+}
+
+export function getRequiredServices(id) {
+  const service = getWorkdayService(id);
+  return (service.requires ?? []).map((depId) => getWorkdayService(depId));
+}