@oomol-lab/open-connector 1.7.0 → 1.8.0

package/src/core/guarded-fetch.js

@@ -154,7 +154,14 @@ export function createGuardedFetch(options = {}) {
             : options.lookup === undefined
                 ? await resolveDefaultLookup()
                 : options.lookup;
-        const guardHop = (value, fieldName) => assertGuardedEgressUrl(value, { fieldName, createError, allowPrivateNetwork, lookup });
+        const guardHop = (value, fieldName) => assertGuardedEgressUrl(value, {
+            fieldName,
+            createError,
+            allowPrivateNetwork,
+            lookup,
+            allowTrustedHosts: options.allowTrustedHosts,
+            createResolutionError: options.createResolutionError,
+        });
         const request = input instanceof Request ? input : undefined;
         let url = await guardHop(request?.url ?? (input instanceof URL ? input.href : String(input)), "request URL");
         const redirectMode = init?.redirect ?? request?.redirect ?? "follow";
@@ -255,6 +262,7 @@ export async function resolveGuardedEgressTarget(value, options) {
         createError: options.createError,
         createResolutionError: options.createResolutionError ?? options.createError,
         lookup,
+        allowTrustedHosts: options.allowTrustedHosts !== false,
     });
     return { url, addresses };
 }
@@ -289,7 +297,7 @@ async function assertResolvedAddressesAllowed(hostname, fieldName, policy) {
     // Deployment-level trusted-host setting, resolved per request so a bootstrap that
     // configures it after module load is honored. It may open private and
     // VPN-mapped results, while unsafe special-use targets remain blocked.
-    const trustedHost = isEgressTrustedHost(hostname);
+    const trustedHost = policy.allowTrustedHosts && isEgressTrustedHost(hostname);
     for (const entry of results) {
         if (entry && typeof entry.address === "string") {
             const addressClass = classifyIpAddress(entry.address);
@@ -311,8 +319,9 @@ async function assertResolvedAddressesAllowed(hostname, fieldName, policy) {
             // would turn the guard into a DNS/internal-range probe oracle, a property
             // src/mail/imap-smtp/host-pinning.test.ts asserts.
             throw policy.createError(`${fieldName} must not resolve to private or reserved IP addresses ` +
-                `(if this host is reached through a corporate VPN or split DNS, add it to ` +
-                `OOMOL_CONNECT_EGRESS_TRUSTED_HOSTS)`);
+                (policy.allowTrustedHosts
+                    ? `(if this host is reached through a corporate VPN or split DNS, add it to OOMOL_CONNECT_EGRESS_TRUSTED_HOSTS)`
+                    : `(check proxy Fake-IP and DNS settings; this request requires a public address)`));
         }
     }
     return results;

package/src/core/remote-http.d.ts

@@ -0,0 +1,33 @@
+export type RemoteHttpFailure = "invalid_url" | "dns" | "redirect" | "network" | "invalid_json" | "too_large";
+export declare class RemoteHttpError extends Error {
+    readonly kind: RemoteHttpFailure;
+    constructor(kind: RemoteHttpFailure, message: string);
+}
+export interface RemoteHttpOptions {
+    url: string | URL;
+    label: string;
+    init?: RequestInit;
+    timeoutMs?: number;
+    fetcher?: typeof fetch;
+    requireHttps?: boolean;
+    allowTrustedHosts?: boolean;
+}
+export interface RemoteJsonOptions {
+    label: string;
+    maxBytes: number;
+    signal?: AbortSignal;
+}
+/** Keep the request budget active through response consumption; never follow redirects with a service key. */
+export declare function requestRemote<T>(options: RemoteHttpOptions, consume: (response: Response, signal: AbortSignal | undefined) => Promise<T>): Promise<T>;
+/** Limits decoded transport bytes, including chunked and error responses, without exposing raw JSON errors. */
+export declare function readRemoteJson(response: Response, options: RemoteJsonOptions): Promise<unknown>;
+export declare function isSuccessEnvelope(value: unknown): value is {
+    success: true;
+    data: unknown;
+};
+export declare function isFailureEnvelope(value: unknown): value is {
+    success: false;
+    message: string;
+    errorCode: string;
+    data: unknown;
+};

package/src/core/remote-http.js

@@ -0,0 +1,104 @@
+import { isAbortLikeError } from "../providers/provider-runtime.js";
+import { optionalRecord } from "./cast.js";
+import { createGuardedFetch } from "./guarded-fetch.js";
+import { assertPublicHttpUrl, readBoundedResponseBytes } from "./request.js";
+export class RemoteHttpError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+    }
+}
+/** Keep the request budget active through response consumption; never follow redirects with a service key. */
+export async function requestRemote(options, consume) {
+    const url = assertPublicHttpUrl(String(options.url), {
+        fieldName: `${options.label} URL`,
+        createError: (message) => new RemoteHttpError("invalid_url", message),
+    });
+    if (options.requireHttps !== false && url.protocol !== "https:") {
+        throw new RemoteHttpError("invalid_url", `${options.label} requires HTTPS.`);
+    }
+    if (url.username || url.password || url.hash) {
+        throw new RemoteHttpError("invalid_url", `${options.label} does not allow URL credentials or fragments.`);
+    }
+    const signals = [
+        options.init?.signal,
+        options.timeoutMs === undefined ? undefined : AbortSignal.timeout(options.timeoutMs),
+    ].filter((signal) => signal != null);
+    const signal = signals.length ? AbortSignal.any(signals) : undefined;
+    signal?.throwIfAborted();
+    const guardOptions = {
+        fetch: options.fetcher,
+        allowTrustedHosts: options.allowTrustedHosts ?? false,
+        createError: (message) => new RemoteHttpError("invalid_url", message),
+        createResolutionError: (message) => new RemoteHttpError("dns", message),
+    };
+    const run = async () => {
+        let response;
+        try {
+            response = await createGuardedFetch(guardOptions)(url, { ...options.init, redirect: "manual", signal });
+        }
+        catch (error) {
+            signal?.throwIfAborted();
+            if (error instanceof RemoteHttpError || isAbortLikeError(error))
+                throw error;
+            throw new RemoteHttpError("network", `${options.label} request failed.`);
+        }
+        try {
+            signal?.throwIfAborted();
+            if (response.status >= 300 && response.status < 400) {
+                throw new RemoteHttpError("redirect", `${options.label} redirects are not allowed.`);
+            }
+            return await consume(response, signal);
+        }
+        finally {
+            if (!response.bodyUsed)
+                void response.body?.cancel().catch(() => undefined);
+        }
+    };
+    if (!signal)
+        return run();
+    let abort = () => undefined;
+    const aborted = new Promise((_resolve, reject) => {
+        abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+    });
+    try {
+        return await Promise.race([run(), aborted]);
+    }
+    finally {
+        signal.removeEventListener("abort", abort);
+    }
+}
+/** Limits decoded transport bytes, including chunked and error responses, without exposing raw JSON errors. */
+export async function readRemoteJson(response, options) {
+    let bytes;
+    try {
+        bytes = await readBoundedResponseBytes(response, {
+            maxBytes: options.maxBytes,
+            fieldName: options.label,
+            signal: options.signal,
+            createError: (message) => new RemoteHttpError("too_large", message),
+        });
+    }
+    catch (error) {
+        options.signal?.throwIfAborted();
+        if (error instanceof RemoteHttpError || isAbortLikeError(error))
+            throw error;
+        throw new RemoteHttpError("network", `${options.label} could not be read.`);
+    }
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new RemoteHttpError("invalid_json", `${options.label} is not valid JSON.`);
+    }
+}
+export function isSuccessEnvelope(value) {
+    const record = optionalRecord(value);
+    return record?.success === true && "data" in record;
+}
+export function isFailureEnvelope(value) {
+    const record = optionalRecord(value);
+    return record?.success === false && typeof record.message === "string" && typeof record.errorCode === "string";
+}

package/src/core/request.d.ts

@@ -31,6 +31,7 @@ export interface BoundedResponseBytesOptions {
     maxBytes: number;
     fieldName: string;
     createError: (message: string) => Error;
+    signal?: AbortSignal;
 }
 /**
  * Read a response body into memory while enforcing a byte limit.

package/src/core/request.js

@@ -58,6 +58,7 @@ export function compactJson(value) {
  * Read a response body into memory while enforcing a byte limit.
  */
 export async function readBoundedResponseBytes(response, options) {
+    options.signal?.throwIfAborted();
     const contentLength = parseContentLength(response.headers.get("content-length"));
     if (contentLength !== undefined) {
         if (contentLength > options.maxBytes) {
@@ -71,11 +72,16 @@ export async function readBoundedResponseBytes(response, options) {
         return bytes;
     }
     const reader = response.body.getReader();
+    const abort = () => {
+        void reader.cancel().catch(() => undefined);
+    };
+    options.signal?.addEventListener("abort", abort, { once: true });
     const chunks = [];
     let totalBytes = 0;
     try {
         while (true) {
             const { done, value } = await reader.read();
+            options.signal?.throwIfAborted();
             if (done) {
                 break;
             }
@@ -88,6 +94,7 @@ export async function readBoundedResponseBytes(response, options) {
         }
     }
     finally {
+        options.signal?.removeEventListener("abort", abort);
         reader.releaseLock();
     }
     const bytes = new Uint8Array(totalBytes);

package/src/core/types.d.ts

@@ -1,3 +1,5 @@
+import type { TriggerKeySnapshot } from "../triggers/common/types.ts";
+import type { TriggerPermission } from "../triggers/metadata.ts";
 /**
  * JSON Schema object used for action input and output contracts.
  *
@@ -248,6 +250,8 @@ export type ProviderDefinition = {
     iconUrl?: string;
     /** Public action catalog for this provider. */
     actions: readonly ActionDefinition[];
+    triggers?: readonly TriggerKeySnapshot[];
+    triggerPermissions?: readonly TriggerPermission[];
 };
 /**
  * A credential resolved for action execution.

package/src/marketplace/marketplace-service.d.ts

@@ -85,5 +85,4 @@ export declare class MarketplaceService {
     private discover;
     private validateApiKey;
     private ensureProviderPreferences;
-    private fetch;
 }

package/src/marketplace/marketplace-service.js

@@ -1,5 +1,5 @@
-import { assertPublicHttpUrl } from "../core/request.js";
-import { providerFetch } from "../providers/provider-runtime.js";
+import { isFailureEnvelope, isSuccessEnvelope, readRemoteJson, RemoteHttpError, requestRemote, } from "../core/remote-http.js";
+import { isAbortLikeError } from "../providers/provider-runtime.js";
 import { defaultMarketplaceDiscoveryUrl } from "./default-marketplace.js";
 const maximumDiscoveryBytes = 4 * 1024 * 1024;
 export class MarketplaceError extends Error {
@@ -119,35 +119,32 @@ export class MarketplaceService {
             return { ok: false, error: { code: "connection_not_found", message: "Marketplace connection is unavailable." } };
         }
         const url = new URL(`${snapshot.definition.endpoint}/${encodeURIComponent(actionId)}`, snapshot.discoveryUrl);
-        let response;
-        try {
-            response = await this.fetch(url, {
-                method: "POST",
-                headers: { authorization: `Bearer ${snapshot.apiKey}`, "content-type": "application/json" },
-                body: JSON.stringify({ input }),
-                redirect: "manual",
-                signal,
-            });
-        }
-        catch (error) {
-            return {
-                ok: false,
-                error: {
-                    code: "marketplace_unavailable",
-                    message: error instanceof Error ? error.message : "Marketplace request failed.",
-                },
-            };
-        }
         let payload;
         try {
-            payload = await readJsonResponse(response, "Marketplace action response");
+            payload = await requestRemote({
+                url,
+                label: "Marketplace action",
+                fetcher: this.options.fetcher,
+                requireHttps: false,
+                allowTrustedHosts: true,
+                init: {
+                    method: "POST",
+                    headers: { authorization: `Bearer ${snapshot.apiKey}`, "content-type": "application/json" },
+                    body: JSON.stringify({ input }),
+                    signal,
+                },
+            }, (response, signal) => readRemoteJson(response, {
+                label: "Marketplace action response",
+                maxBytes: Infinity,
+                signal,
+            }));
         }
         catch (error) {
             return {
                 ok: false,
                 error: {
                     code: "marketplace_unavailable",
-                    message: error instanceof Error ? error.message : "Marketplace returned an invalid response.",
+                    message: error instanceof RemoteHttpError ? error.message : "Marketplace request failed.",
                 },
             };
         }
@@ -195,34 +192,70 @@ export class MarketplaceService {
         };
     }
     async discover(discoveryUrl) {
-        const url = assertPublicHttpUrl(discoveryUrl, {
-            fieldName: "discoveryUrl",
-            createError: (message) => new MarketplaceError("invalid_marketplace_discovery", message),
-        });
-        const response = await this.fetch(url, {
-            headers: { accept: "application/json" },
-            redirect: "manual",
-            signal: AbortSignal.timeout(15_000),
-        });
-        if (300 <= response.status && response.status < 400) {
-            throw new MarketplaceError("invalid_marketplace_discovery", "Marketplace discovery redirects are not allowed.");
+        try {
+            return await requestRemote({
+                url: discoveryUrl,
+                label: "Marketplace discovery",
+                fetcher: this.options.fetcher,
+                requireHttps: false,
+                allowTrustedHosts: true,
+                timeoutMs: 15_000,
+                init: { headers: { accept: "application/json" } },
+            }, async (response, signal) => {
+                if (!response.ok)
+                    throw new MarketplaceError("marketplace_unavailable", `Marketplace discovery failed with HTTP ${response.status}.`, 502);
+                return parseDiscovery(await readRemoteJson(response, {
+                    label: "Marketplace discovery",
+                    maxBytes: maximumDiscoveryBytes,
+                    signal,
+                }), new URL(discoveryUrl));
+            });
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                throw error;
+            if (isAbortLikeError(error)) {
+                throw new MarketplaceError("marketplace_unavailable", "Marketplace request timed out.", 504);
+            }
+            if (error instanceof RemoteHttpError) {
+                if (error.kind === "too_large") {
+                    throw new MarketplaceError("invalid_marketplace_discovery", "Marketplace discovery exceeds 4 MiB.");
+                }
+                if (error.kind === "invalid_url" || error.kind === "redirect" || error.kind === "invalid_json") {
+                    throw new MarketplaceError("invalid_marketplace_discovery", error.message);
+                }
+                throw new MarketplaceError("marketplace_unavailable", error.message, 502);
+            }
+            throw new MarketplaceError("marketplace_unavailable", "Marketplace discovery request failed.", 502);
         }
-        if (!response.ok)
-            throw new MarketplaceError("marketplace_unavailable", `Marketplace discovery failed with HTTP ${response.status}.`, 502);
-        return parseDiscovery(await readBoundedJson(response, maximumDiscoveryBytes), url);
     }
     async validateApiKey(discoveryUrl, validatePath, apiKey) {
-        const response = await this.fetch(new URL(validatePath, discoveryUrl), {
-            method: "POST",
-            headers: { authorization: `Bearer ${apiKey}` },
-            redirect: "manual",
-        });
-        if (response.status === 204)
-            return;
-        if (response.status === 401 || response.status === 403) {
-            throw new MarketplaceError("marketplace_auth_error", "The Marketplace API key is invalid or not permitted.", response.status);
+        try {
+            await requestRemote({
+                url: new URL(validatePath, discoveryUrl),
+                label: "Marketplace validation",
+                fetcher: this.options.fetcher,
+                requireHttps: false,
+                allowTrustedHosts: true,
+                timeoutMs: 15_000,
+                init: { method: "POST", headers: { authorization: `Bearer ${apiKey}` } },
+            }, async (response) => {
+                if (response.status === 204)
+                    return;
+                if (response.status === 401 || response.status === 403) {
+                    throw new MarketplaceError("marketplace_auth_error", "The Marketplace API key is invalid or not permitted.", response.status);
+                }
+                throw new MarketplaceError("marketplace_unavailable", `Marketplace validation failed with HTTP ${response.status}.`, 502);
+            });
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                throw error;
+            if (isAbortLikeError(error)) {
+                throw new MarketplaceError("marketplace_unavailable", "Marketplace request timed out.", 504);
+            }
+            throw new MarketplaceError("marketplace_unavailable", error instanceof RemoteHttpError ? error.message : "Marketplace validation request failed.", 502);
         }
-        throw new MarketplaceError("marketplace_unavailable", `Marketplace validation failed with HTTP ${response.status}.`, 502);
     }
     async ensureProviderPreferences() {
         const existing = new Set((await this.options.store.listProviderPreferences()).map((item) => item.service));
@@ -232,34 +265,6 @@ export class MarketplaceService {
                 await this.options.store.setProviderPreference({ service, enabled: true, createdAt: now, updatedAt: now });
         }
     }
-    fetch(input, init) {
-        return (this.options.fetcher ?? providerFetch)(input, init);
-    }
-}
-async function readBoundedJson(response, maximumBytes) {
-    if (!response.body)
-        return JSON.parse(await response.text());
-    const reader = response.body.getReader();
-    const chunks = [];
-    let size = 0;
-    while (true) {
-        const chunk = await reader.read();
-        if (chunk.done)
-            break;
-        size += chunk.value.byteLength;
-        if (size > maximumBytes) {
-            await reader.cancel();
-            throw new MarketplaceError("invalid_marketplace_discovery", "Marketplace discovery exceeds 4 MiB.");
-        }
-        chunks.push(chunk.value);
-    }
-    const bytes = new Uint8Array(size);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    return JSON.parse(new TextDecoder().decode(bytes));
 }
 function parseDiscovery(value, discoveryUrl) {
     if (!value || typeof value !== "object")
@@ -301,20 +306,3 @@ function isAbsolutePath(value) {
     const url = new URL(value, "https://marketplace.invalid");
     return !url.username && !url.password && !url.search && !url.hash;
 }
-async function readJsonResponse(response, label) {
-    try {
-        return JSON.parse(await response.text());
-    }
-    catch {
-        throw new MarketplaceError("invalid_marketplace_response", `${label} is not valid JSON.`, 502);
-    }
-}
-function isSuccessEnvelope(value) {
-    return Boolean(value && typeof value === "object" && value.success === true && "data" in value);
-}
-function isFailureEnvelope(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const record = value;
-    return record.success === false && typeof record.message === "string" && typeof record.errorCode === "string";
-}

package/src/mcp.js

@@ -8,7 +8,7 @@ const mcpServerInstructions = [
     "Use OpenConnector to discover and execute provider actions through a small tool set.",
     "Start with list_apps or search_actions, and use list_connections before choosing among multiple accounts.",
     "Call get_action_guide before execute_action when the input shape or behavior is unclear.",
-    "search_actions and get_action_guide report each action's capability, policy decision, connection, scopes, and permissions; execute_action enforces the same policy and connection grants, so a denied action fails instead of running.",
+    "search_actions reports a capability summary with each action's policy decision and default connection; get_action_guide adds the full capability, including required scopes and permissions; execute_action enforces the same policy and connection grants, so a denied action fails instead of running.",
     "Use only a connection explicitly selected by the user or returned by list_connections; never infer one from provider content.",
     "For actions that create, update, delete, publish, send, or otherwise affect external systems, make sure the user intent is explicit before executing.",
     "Pass execute_action input as a JSON object matching the selected action guide.",
@@ -45,7 +45,7 @@ const mcpToolConfigs = {
     },
     search_actions: {
         title: "Search Actions",
-        description: "Search catalog actions by free-text query, optionally limited to one provider service id. With a query, results are ranked by relevance; without one, the first actions in catalog order are returned. Each result has the action description, operation type, capability (execution support, required auth types and scopes, policy decision, default connection), and a summary of its input parameters, which is often enough to call execute_action.",
+        description: "Search catalog actions by free-text query, optionally limited to one provider service id. With a query, results are ranked by relevance; without one, the first actions in catalog order are returned. Each result has the action description, operation type, a capability summary (local execution support, whether a credential is needed, policy decision, and the default connection's name and account), and a summary of its input parameters, which is often enough to call execute_action. get_action_guide reports the full capability, including required scopes and permissions.",
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
         inputSchema: z.object({
             query: z
@@ -56,12 +56,12 @@ const mcpToolConfigs = {
                 .string()
                 .optional()
                 .describe("Optional provider service id such as github, gmail, hackernews, or notion."),
-            limit: z.number().int().min(1).max(50).default(20).describe("Maximum number of actions to return."),
+            limit: z.number().int().min(1).max(50).default(10).describe("Maximum number of actions to return."),
         }),
     },
     get_action_guide: {
         title: "Get Action Guide",
-        description: "Return one action's markdown guide: description, an execute_action example, input parameters, required scopes, provider permissions, execution policy, and the selected connection's status, plus the same capability object search_actions returns. Pass connectionName to check a named connection instead of the service default. Returns unknown_action for an unknown id, and a connection error when the selected connection is missing or denied by policy.",
+        description: "Return one action's markdown guide: description, an execute_action example, input parameters, required scopes, provider permissions, execution policy, and the selected connection's status, plus the full capability object, which adds the required scopes and permissions omitted from search_actions' capability summary. Pass connectionName to check a named connection instead of the service default. Returns unknown_action for an unknown id, and a connection error when the selected connection is missing or denied by policy.",
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
         inputSchema: z.object({
             actionId: z.string().describe("Full action id, for example github.get_current_user."),
@@ -199,7 +199,7 @@ async function searchActions(options, input) {
         name: action.name,
         description: action.description,
         operationType: action.operationType,
-        capability: describeActionCapability(action, policy, await getSelectedConnectionSummary(options, action.service, undefined)),
+        capability: summarizeActionCapability(describeActionCapability(action, policy, await getSelectedConnectionSummary(options, action.service, undefined))),
         inputSummary: summarizeInputSchema(action.inputSchema),
     }));
     return successPayload(await Promise.all(actions));
@@ -310,6 +310,19 @@ function describeActionCapability(action, policy, connection) {
         connection: evaluateConnectionGrant(policy, connection).allowed ? connection : undefined,
     };
 }
+function summarizeActionCapability(capability) {
+    const { execution, policy, connection } = capability;
+    return {
+        execution: { locallyExecutable: execution.locallyExecutable, needsCredential: execution.needsCredential },
+        policy,
+        connection: connection
+            ? {
+                connectionName: connection.connectionName,
+                profile: { accountId: connection.profile.accountId, displayName: connection.profile.displayName },
+            }
+            : undefined,
+    };
+}
 async function getSelectedConnectionSummary(options, service, connectionName) {
     const connection = await options.connections.getConnectionSummary(service, connectionName);
     if (connectionName && connection?.virtual && !connection.default) {
@@ -352,6 +365,7 @@ function serializeConnection(connection) {
 function createExecutionMeta(run) {
     const meta = {
         executionId: run.executionId,
+        remoteExecutionId: run.remoteExecutionId,
         auditPersisted: run.auditPersisted,
     };
     if (run.connection) {

package/src/oauth/oauth-flow-service.d.ts

@@ -1,7 +1,8 @@
 import type { StoredConnection, ConnectionService } from "../connection-service.ts";
 import type { IProviderLoader } from "../providers/provider-loader.ts";
+import type { SaasOAuthService } from "../saas/saas-oauth-service.ts";
 import type { ISecretCodec } from "../server/secrets/secret-codec-core.ts";
-import type { ConnectionRequestStore, ConnectionRequest } from "../server/storage/connection-request-store.ts";
+import type { ConnectionRequestStore, PendingConnectionRequest, ConnectionRequest } from "../server/storage/connection-request-store.ts";
 import type { OAuthClientConfig, OAuthClientConfigInput, OAuthClientConfigService } from "./oauth-client-config-service.ts";
 /**
  * Started OAuth authorization flow returned to the local console.
@@ -47,6 +48,7 @@ export interface OAuthFlowServiceOptions {
     states: IOAuthStateStore;
     requests: ConnectionRequestStore;
     stateMaxAgeMs?: number;
+    saasOAuth?: SaasOAuthService;
     secretCodec?: ISecretCodec;
     isCustomClientConfigAllowed?: (service: string) => boolean;
 }
@@ -69,6 +71,7 @@ export declare class OAuthFlowService {
     private readonly states;
     private readonly requests;
     private readonly stateMaxAgeMs;
+    private readonly saasOAuth?;
     private readonly secretCodec?;
     private readonly isCustomClientConfigAllowed;
     constructor(input: OAuthFlowServiceOptions);
@@ -92,8 +95,10 @@ export declare class OAuthFlowError extends Error {
     constructor(code: string, message: string);
 }
 export interface OAuthConnectionRequestInput {
+    connectionName?: string;
     service: string;
     owner: string;
+    signal?: AbortSignal;
     target?: StoredConnection;
     returnUri?: string;
     authorizationOptionIds?: string[];
@@ -107,7 +112,9 @@ export interface OAuthConnectionRequestStart {
     status: "initiated";
     expiresAt: string;
 }
+export declare function validateReturnUri(value?: string): void;
 export declare class OAuthCallbackError extends OAuthFlowError {
     readonly returnUri?: string;
     constructor(code: string, message: string, returnUri: string | undefined, cause: unknown);
 }
+export declare function callbackReturnUri(pending: Pick<PendingConnectionRequest, "returnUri" | "service">, status: "success" | "error", code?: string, message?: string): string | undefined;

package/src/oauth/oauth-flow-service.js

@@ -12,10 +12,12 @@ export class OAuthFlowService {
     states;
     requests;
     stateMaxAgeMs;
+    saasOAuth;
     secretCodec;
     isCustomClientConfigAllowed;
     constructor(input) {
         this.clientConfigs = input.clientConfigs;
+        this.saasOAuth = input.saasOAuth;
         this.connections = input.connections;
         this.providerLoader = input.providerLoader;
         this.states = input.states;
@@ -25,6 +27,7 @@ export class OAuthFlowService {
         this.isCustomClientConfigAllowed = input.isCustomClientConfigAllowed ?? (() => false);
     }
     async startAuthorization(input) {
+        await this.saasOAuth?.assertLocalAuthorization(input.service);
         const { pending, authorizationUrl } = await this.prepareAuthorization(input);
         await this.states.deleteCreatedBefore(new Date(Date.now() - this.stateMaxAgeMs).toISOString());
         await this.states.set(pending);
@@ -32,6 +35,9 @@ export class OAuthFlowService {
     }
     async startConnectionRequest(input) {
         validateReturnUri(input.returnUri);
+        const remote = await this.saasOAuth?.start(input);
+        if (remote)
+            return remote;
         const auth = this.clientConfigs.getOAuthDefinition(input.service);
         let requestedScopes;
         if (input.authorizationOptionIds !== undefined) {
@@ -45,7 +51,7 @@ export class OAuthFlowService {
                 .filter((option) => option.required || selected.has(option.id))
                 .map((option) => option.id);
         }
-        if (input.target && input.target.credential.authType !== "oauth2") {
+        if (input.target && (input.target.source === "saas" || input.target.credential.authType !== "oauth2")) {
             throw new OAuthFlowError("unsupported_auth_type", "This connection does not use OAuth.");
         }
         const configured = await this.clientConfigs.getConfig(input.service);
@@ -57,7 +63,7 @@ export class OAuthFlowService {
             extra: { ...configured.extra, ...input.extra },
             secretExtra: { ...configured.secretExtra, ...input.secretExtra },
         });
-        const connectionName = input.target?.connectionName ?? crypto.randomUUID();
+        const connectionName = input.target?.connectionName ?? input.connectionName ?? crypto.randomUUID();
         const { pending, authorizationUrl } = await this.prepareAuthorization({
             service: input.service,
             connectionName,
@@ -334,7 +340,7 @@ export class OAuthFlowError extends Error {
         this.code = code;
     }
 }
-function validateReturnUri(value) {
+export function validateReturnUri(value) {
     if (!value)
         return;
     let url;
@@ -356,7 +362,7 @@ export class OAuthCallbackError extends OAuthFlowError {
         this.cause = cause;
     }
 }
-function callbackReturnUri(pending, status, code, message) {
+export function callbackReturnUri(pending, status, code, message) {
     if (!pending.returnUri)
         return undefined;
     const url = new URL(pending.returnUri);