@oomol-lab/open-connector 1.6.5 → 1.8.0

package/src/server/api/policy-input.js

@@ -10,9 +10,14 @@ export function readRuntimePolicyRules(body) {
         blockedActions: readRules(body.blockedActions, "blockedActions", "action"),
         allowedProxies: readRules(body.allowedProxies, "allowedProxies", "proxy"),
         blockedProxies: readRules(body.blockedProxies, "blockedProxies", "proxy"),
+        allowedTriggers: readRules(body.allowedTriggers, "allowedTriggers", "action", true),
+        blockedTriggers: readRules(body.blockedTriggers, "blockedTriggers", "action", true),
     };
 }
 export function readTokenPolicy(body, allowOmitted = false) {
+    if (body.blockedTriggers !== undefined) {
+        throw invalidInput("Token policy does not support Trigger block rules.");
+    }
     if (body.blockedProxies !== undefined) {
         throw invalidInput("Token policy does not support proxy block rules.");
     }
@@ -20,6 +25,7 @@ export function readTokenPolicy(body, allowOmitted = false) {
         allowedActions: readRules(body.allowedActions, "allowedActions", "action", allowOmitted),
         blockedActions: readRules(body.blockedActions, "blockedActions", "action", allowOmitted),
         allowedProxies: readRules(body.allowedProxies, "allowedProxies", "proxy", allowOmitted),
+        allowedTriggers: readRules(body.allowedTriggers, "allowedTriggers", "action", true),
         allowedConnections: readConnectionIds(body.allowedConnections, "allowedConnections", allowOmitted),
     };
 }

package/src/server/api/runtime-api.d.ts

@@ -3,8 +3,9 @@ import type { ConnectionError, ConnectionSummary, ManagedConnectionSummary } fro
 import type { ProviderAuthSetup } from "../../core/provider-setup.ts";
 import type { ExecutionResult, ProviderScenario } from "../../core/types.ts";
 import type { OAuthClientConfigSummary } from "../../oauth/oauth-client-config-service.ts";
+import type { TriggerPermission } from "../../triggers/metadata.ts";
 import type { Context } from "hono";
-type RuntimeStatus = 400 | 401 | 402 | 403 | 404 | 409 | 413 | 429 | 500 | 501;
+export type RuntimeStatus = 400 | 401 | 402 | 403 | 404 | 409 | 413 | 429 | 500 | 501 | 502 | 503 | 504;
 export type RuntimeResponseMeta = Record<string, unknown>;
 export interface RuntimeSuccessEnvelope<TData> {
     success: true;
@@ -54,6 +55,7 @@ export interface RuntimeActionMetadata {
 }
 export interface RuntimeConnectedApp {
     id: string;
+    providerAccountId: string;
     service: string;
     status: "active" | "disconnected";
     alias: string;
@@ -74,6 +76,9 @@ export interface RuntimeFailureInput {
 export interface RuntimeActionResultInput {
     actionId: string;
     executionId: string;
+    remoteExecutionId?: string;
+    failureStatus?: RuntimeStatus;
+    retryAfter?: string;
     auditPersisted: boolean;
     result: ExecutionResult;
 }
@@ -100,7 +105,13 @@ export declare function serializeRuntimeFailure(input: RuntimeFailureInput): Run
 export declare function serializeRuntimeActionResult(input: RuntimeActionResultInput): RuntimeActionHttpResult;
 /** Validate an action response decoded from persistent storage. */
 export declare function parseRuntimeActionHttpResult(value: unknown): RuntimeActionHttpResult;
-/** Write a newly serialized or replayed action response. */
+/**
+ * Write a newly serialized or replayed action response; runtime failures,
+ * including proxy failures, go through here as well. A 429 whose provider
+ * details carry `retryAfterSeconds` also answers with the `Retry-After`
+ * header, so HTTP callers pace on the provider's own hint; the body keeps it,
+ * which is what an idempotent replay re-emits the header from.
+ */
 export declare function writeRuntimeActionHttpResult(context: Context, result: RuntimeActionHttpResult): Response;
 export declare function mapConnectionErrorStatus(error: ConnectionError): 400 | 404 | 409;
 /**
@@ -129,8 +140,12 @@ export interface RuntimeProviderSetup {
 interface RuntimeOAuthClientSetup {
     configured: boolean;
     customClientAvailable: boolean;
+    /** Redirect URI to register with the provider: the configured override, else the runtime callback. */
     expectedRedirectUri: string;
     missingFields: string[];
 }
-export declare function serializeRuntimeProviderSetup(provider: RuntimeProviderDefinition, oauth?: OAuthClientConfigSummary): RuntimeProviderSetup;
+export declare function serializeRuntimeProviderSetup(provider: RuntimeProviderDefinition, oauth?: Pick<OAuthClientConfigSummary, "configured" | "customClientAvailable" | "expectedRedirectUri" | "missingFields">): RuntimeProviderSetup;
+export declare function serializeRuntimeTriggerPermissions(provider: RuntimeProviderDefinition): (TriggerPermission & {
+    requiredScopes: readonly string[];
+})[];
 export {};

package/src/server/api/runtime-api.js

@@ -1,4 +1,4 @@
-import { optionalInteger, optionalRecord, requiredRecord } from "../../core/cast.js";
+import { optionalInteger, optionalString, optionalRecord, requiredRecord } from "../../core/cast.js";
 import { describeProviderAuth } from "../../core/provider-setup.js";
 export function serializeRuntimeProvider(provider) {
     return {
@@ -37,6 +37,7 @@ export function serializeRuntimeAction(action) {
 export function serializeRuntimeConnectedApp(connection) {
     return {
         id: connection.id,
+        providerAccountId: connection.profile.accountId,
         service: connection.service,
         status: connection.configured ? "active" : "disconnected",
         alias: connection.connectionName,
@@ -91,7 +92,7 @@ export function serializeRuntimeFailure(input) {
 /** Build the persistable HTTP response for a completed action execution. */
 export function serializeRuntimeActionResult(input) {
     const { actionId, executionId, auditPersisted, result } = input;
-    const meta = { executionId, actionId, auditPersisted };
+    const meta = { executionId, actionId, auditPersisted, remoteExecutionId: input.remoteExecutionId };
     if (result.ok) {
         return {
             status: 200,
@@ -104,10 +105,10 @@ export function serializeRuntimeActionResult(input) {
         };
     }
     return serializeRuntimeFailure({
-        status: mapExecutionErrorStatus(result.error?.code, result.error?.details),
+        status: input.failureStatus ?? mapExecutionErrorStatus(result.error?.code, result.error?.details),
         errorCode: result.error?.code ?? "provider_error",
         message: result.error?.message ?? "Action execution failed.",
-        data: result.error?.details ?? null,
+        data: input.retryAfter ? { details: { retryAfter: input.retryAfter } } : (result.error?.details ?? null),
         meta,
     });
 }
@@ -128,10 +129,31 @@ export function parseRuntimeActionHttpResult(value) {
     }
     throw invalid("status and body envelope do not match");
 }
-/** Write a newly serialized or replayed action response. */
+/**
+ * Write a newly serialized or replayed action response; runtime failures,
+ * including proxy failures, go through here as well. A 429 whose provider
+ * details carry `retryAfterSeconds` also answers with the `Retry-After`
+ * header, so HTTP callers pace on the provider's own hint; the body keeps it,
+ * which is what an idempotent replay re-emits the header from.
+ */
 export function writeRuntimeActionHttpResult(context, result) {
+    const retryAfter = optionalString(optionalRecord(optionalRecord(result.body.data)?.details)?.retryAfter);
+    if (result.status === 429 && retryAfter && (/^\d+$/.test(retryAfter) || Number.isFinite(Date.parse(retryAfter))))
+        context.header("Retry-After", retryAfter);
+    const retryAfterSeconds = readRuntimeRetryAfterSeconds(result);
+    if (retryAfterSeconds !== undefined) {
+        context.header("Retry-After", String(retryAfterSeconds));
+    }
     return context.json(result.body, result.status);
 }
+function readRuntimeRetryAfterSeconds(result) {
+    if (result.status !== 429) {
+        return undefined;
+    }
+    const seconds = optionalInteger(optionalRecord(optionalRecord(result.body.data)?.details)?.retryAfterSeconds);
+    // A safe integer is what keeps String() in plain delay-seconds digits: 1e21 would print as "1e+21".
+    return seconds !== undefined && Number.isSafeInteger(seconds) && seconds >= 0 ? seconds : undefined;
+}
 export function mapConnectionErrorStatus(error) {
     if (error.code === "unknown_service" || error.code === "connection_not_found") {
         return 404;
@@ -191,6 +213,9 @@ function isRuntimeStatus(value) {
         value === 409 ||
         value === 413 ||
         value === 429 ||
+        value === 502 ||
+        value === 503 ||
+        value === 504 ||
         value === 500 ||
         value === 501);
 }
@@ -231,3 +256,9 @@ export function serializeRuntimeProviderSetup(provider, oauth) {
             : undefined,
     };
 }
+export function serializeRuntimeTriggerPermissions(provider) {
+    return (provider.triggerPermissions ?? []).map((permission) => ({
+        ...permission,
+        requiredScopes: permission.providerPermissions,
+    }));
+}

package/src/server/api/saas-completion-page.d.ts

@@ -0,0 +1,2 @@
+/** The initial GET contains no account data and performs no authorization synchronization. */
+export declare function renderSaasCompletionPage(): string;

package/src/server/api/saas-completion-page.js

@@ -0,0 +1,103 @@
+import { oauthCompletionStrings, oauthCompletionStyles, oauthCompletionLocaleScript } from "./oauth-completion-page.js";
+/** The initial GET contains no account data and performs no authorization synchronization. */
+export function renderSaasCompletionPage() {
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Complete connection</title>
+<style>${oauthCompletionStyles}</style></head>
+<body><main class="card" aria-live="polite">
+<div class="header"><span id="badge" class="badge" hidden></span>
+<h1 id="title">Completing connection</h1><p id="status" role="status">Checking your Console session…</p></div>
+<div class="actions"><a id="login" class="button" href="/" target="_blank" rel="noopener" hidden>Open Console to sign in</a>
+<button id="retry" class="button" type="button">Check again</button>
+<button id="close" class="button" type="button" hidden>Close window</button>
+<p id="note" class="close-note" hidden></p></div></main>
+<script>
+const STR = ${JSON.stringify(oauthCompletionStrings).replaceAll("<", "\\u003c")};
+${oauthCompletionLocaleScript}
+const language = pick();
+const t = STR[language] || STR.en;
+document.documentElement.lang = language;
+document.title = t.checkingTitle;
+const title = document.getElementById('title');
+const status = document.getElementById('status');
+const login = document.getElementById('login');
+const close = document.getElementById('close');
+const badge = document.getElementById('badge');
+const note = document.getElementById('note');
+title.textContent = t.checkingTitle;
+status.textContent = t.checking;
+login.textContent = t.signIn;
+close.textContent = t.closeButton;
+const tryClose = () => { window.close(); note.textContent = t.manualClose; };
+close.addEventListener('click', tryClose);
+const button = document.getElementById('retry');
+button.textContent = t.retry;
+const request = new URL(location.href).searchParams.get('request');
+let timer;
+let busy = false;
+let terminal = false;
+let failures = 0;
+async function sync() {
+  if (busy || terminal) return;
+  clearTimeout(timer);
+  if (!request) { status.textContent = t.missing; button.hidden = true; return; }
+  busy = true;
+  button.disabled = true;
+  try {
+    const session = await fetch('/api/auth/session', { credentials: 'same-origin', cache: 'no-store' });
+    if (!session.ok || !(await session.json()).authenticated) {
+      status.textContent = t.login; login.hidden = false;
+      return;
+    }
+    login.hidden = true;
+    const response = await fetch('/api/oauth/connection-requests/' + encodeURIComponent(request) + '/sync', {
+      method: 'POST', credentials: 'same-origin', cache: 'no-store',
+      headers: { 'Content-Type': 'application/json', 'X-OpenConnector-Request': 'sync' }, body: '{}'
+    });
+    if (!response.ok) {
+      if ([401, 403, 404].includes(response.status)) { status.textContent = response.status === 401 ? t.login : response.status === 403 ? t.forbidden : t.notFound; login.hidden = response.status !== 401; return; }
+      status.textContent = t.retrying;
+      const retry = response.headers.get('Retry-After');
+      const retryMs = retry ? (/^\\d+$/.test(retry) ? Number(retry) * 1000 : Date.parse(retry) - Date.now()) : 0;
+      timer = setTimeout(sync, Math.max(2000, Math.min(30000, 2000 * 2 ** Math.min(failures++, 4)), Number.isFinite(retryMs) ? retryMs : 0));
+      return;
+    }
+    failures = 0;
+    const result = await response.json();
+    if (result.request.status === 'connected') {
+      terminal = true;
+      document.title = title.textContent = t.title;
+      status.textContent = t.body;
+      badge.textContent = t.badge;
+      badge.hidden = false;
+      button.hidden = true;
+      login.hidden = true;
+      close.hidden = false;
+      const message = { type: 'oauth.completed', service: result.request.service };
+      if (typeof BroadcastChannel !== 'undefined') { const channel = new BroadcastChannel('oomol-connect-oauth'); channel.postMessage(message); channel.close(); }
+      if (window.opener) window.opener.postMessage(message, location.origin);
+      if (result.returnUri) { location.assign(result.returnUri); return; }
+      note.hidden = false;
+      note.textContent = t.autoClose.replace('%N%', '2');
+      setTimeout(tryClose, 2000);
+      return;
+    }
+    if (result.request.status === 'failed' || result.request.status === 'expired') {
+      terminal = true;
+      status.textContent = result.request.status === 'expired' ? t.notFound : t.failed;
+      button.hidden = true;
+      close.hidden = false;
+      if (result.returnUri) location.assign(result.returnUri);
+      return;
+    }
+    status.textContent = t.waiting;
+    timer = setTimeout(sync, 2000);
+  } catch {
+    status.textContent = t.network;
+  } finally { busy = false; button.disabled = false; }
+}
+button.addEventListener('click', sync);
+sync();
+</script></body></html>`;
+}

package/src/server/connect-app.d.ts

@@ -7,6 +7,8 @@ import type { ITransitFileService } from "./files/transit-file-store.ts";
 import type { ISecretCodec } from "./secrets/secret-codec-core.ts";
 import type { RuntimeDatabase } from "./storage/runtime-database.ts";
 import type { Hono } from "hono";
+import { SaasCleanupService } from "../saas/saas-cleanup-service.ts";
+import { TriggerMaintenance } from "../triggers/maintenance.ts";
 export interface ConnectAppOptions {
     catalog: CatalogStore;
     providerLoader: IProviderLoader;
@@ -14,6 +16,7 @@ export interface ConnectAppOptions {
     transitFiles: ITransitFileService;
     uploadTransitFile?: (request: Request) => Promise<TransitFileUpload>;
     publicOrigin: string;
+    configuredOrigin?: string;
     secretCodec: ISecretCodec;
     adminToken?: string;
     runtimeToken?: string;
@@ -27,6 +30,8 @@ export interface ConnectAppOptions {
     serveDocumentation?: boolean;
 }
 export interface ConnectApp {
+    saasCleanup: SaasCleanupService;
+    triggerMaintenance: TriggerMaintenance;
     app: Hono;
     runtimeAuthConfigured: boolean;
 }

package/src/server/connect-app.js

@@ -1,12 +1,34 @@
 import { ConnectionService } from "../connection-service.js";
+import { ActionPolicyService as ExecutionPolicyService } from "../core/action-policy.js";
 import { MarketplaceService } from "../marketplace/marketplace-service.js";
 import { OAuthClientConfigService } from "../oauth/oauth-client-config-service.js";
 import { OAuthCredentialRefreshService } from "../oauth/oauth-credential-refresh-service.js";
 import { OAuthFlowService } from "../oauth/oauth-flow-service.js";
+import { SaasCleanupService } from "../saas/saas-cleanup-service.js";
+import { SaasClient } from "../saas/saas-client.js";
+import { SaasExecutionService } from "../saas/saas-execution-service.js";
+import { SaasOAuthService } from "../saas/saas-oauth-service.js";
+import { SaasProjectService } from "../saas/saas-project-service.js";
+import { TriggerMaintenance } from "../triggers/maintenance.js";
+import { TriggerRunner } from "../triggers/trigger-runner.js";
 import { ActionRunner } from "./actions/action-runner.js";
 import { ConnectServer } from "./connect-server.js";
 import { RuntimeTokenService } from "./storage/runtime-token-service.js";
 export async function createConnectApp(options) {
+    const saasClient = new SaasClient();
+    const saasProject = new SaasProjectService({
+        catalog: options.catalog,
+        store: options.runtimeDatabase.saasProjectStore,
+        secretCodec: options.secretCodec,
+        configuredOrigin: options.configuredOrigin,
+        client: saasClient,
+    });
+    const saasOAuth = new SaasOAuthService({
+        projects: saasProject,
+        requests: options.runtimeDatabase.connectionRequestStore,
+        client: saasClient,
+    });
+    const saas = new SaasExecutionService({ projects: saasProject, client: saasClient });
     const marketplace = new MarketplaceService({
         catalog: options.catalog,
         store: options.runtimeDatabase.marketplaceStore,
@@ -36,11 +58,33 @@ export async function createConnectApp(options) {
         providerLoader: options.providerLoader,
         connections,
         runs: options.runtimeDatabase.runLogStore,
+        saas,
         transitFiles: options.transitFiles,
         logger: options.logger,
         marketplace,
     });
+    const triggers = new TriggerRunner({
+        catalog: options.catalog,
+        providerLoader: options.providerLoader,
+        connections,
+        store: options.runtimeDatabase.triggerStore,
+    });
+    const triggerMaintenance = new TriggerMaintenance({
+        store: options.runtimeDatabase.triggerStore,
+        runner: triggers,
+        tokens: options.runtimeDatabase.runtimeTokenStore,
+        runtimePolicy: options.runtimeDatabase.runtimePolicyStore,
+        deploymentPolicy: options.actionPolicy ?? new ExecutionPolicyService(),
+        logger: options.logger,
+    });
     return {
+        triggerMaintenance,
+        saasCleanup: new SaasCleanupService({
+            store: options.runtimeDatabase.saasProjectStore,
+            requests: options.runtimeDatabase.connectionRequestStore,
+            client: saasClient,
+            logger: options.logger,
+        }),
         app: new ConnectServer({
             catalog: options.catalog,
             publicOrigin: options.publicOrigin,
@@ -55,8 +99,11 @@ export async function createConnectApp(options) {
                 requests: options.runtimeDatabase.connectionRequestStore,
                 secretCodec: options.secretCodec,
                 isCustomClientConfigAllowed,
+                saasOAuth,
             }),
             actions,
+            triggers,
+            triggerMaintenance,
             idempotency: options.runtimeDatabase.idempotencyStore,
             transitFiles: options.transitFiles,
             uploadTransitFile: options.uploadTransitFile,
@@ -73,6 +120,9 @@ export async function createConnectApp(options) {
             actionPolicy: options.actionPolicy,
             logger: options.logger,
             marketplace,
+            saas,
+            saasProject,
+            saasOAuth,
             compressApiResponses: options.compressApiResponses,
             serveDocumentation: options.serveDocumentation,
         }).createApp(),

package/src/server/connect-server.d.ts

@@ -4,6 +4,11 @@ import type { ActionSearchIndexProvider } from "../core/action-search.ts";
 import type { RuntimeLogger, TransitFileUpload } from "../core/types.ts";
 import type { MarketplaceService } from "../marketplace/marketplace-service.ts";
 import type { IProviderLoader } from "../providers/provider-loader.ts";
+import type { SaasExecutionService } from "../saas/saas-execution-service.ts";
+import type { SaasOAuthService } from "../saas/saas-oauth-service.ts";
+import type { SaasProjectService } from "../saas/saas-project-service.ts";
+import type { TriggerMaintenance } from "../triggers/maintenance.ts";
+import type { TriggerRunner } from "../triggers/trigger-runner.ts";
 import type { LocalAuthOptions } from "./api/auth.ts";
 import type { ITransitFileService } from "./files/transit-file-store.ts";
 import type { IIdempotencyStore } from "./storage/idempotency-store.ts";
@@ -33,6 +38,8 @@ export interface IConnectServerOptions {
     oauthFlow: OAuthFlowService;
     runtimeTokens: RuntimeTokenService;
     actions: ActionRunner;
+    triggers?: TriggerRunner;
+    triggerMaintenance?: TriggerMaintenance;
     idempotency: IIdempotencyStore;
     transitFiles: ITransitFileService;
     uploadTransitFile?: (request: Request) => Promise<TransitFileUpload>;
@@ -45,6 +52,9 @@ export interface IConnectServerOptions {
     compressApiResponses?: boolean;
     serveDocumentation?: boolean;
     marketplace?: MarketplaceService;
+    saasProject?: SaasProjectService;
+    saas?: SaasExecutionService;
+    saasOAuth?: SaasOAuthService;
 }
 /**
  * Local single-user HTTP server for catalog browsing, credential management,
@@ -78,6 +88,8 @@ export declare class ConnectServer {
     private searchRuntimeActions;
     private serializeSearchResults;
     private getRuntimeAction;
+    private getRuntimeTriggerPermissions;
+    private executeRuntimeTrigger;
     private createRuntimeActionRun;
     private executeRuntimeAction;
     private createRuntimeProxyRequest;