@oomol-lab/open-connector 1.9.1 → 1.9.2

package/src/triggers/trigger-runner.js

@@ -1,10 +1,12 @@
 import { ConnectionError } from "../connection-service.js";
 import { optionalInteger, optionalRecord } from "../core/cast.js";
 import { withProviderHttpDispatch } from "../core/provider-http-dispatch.js";
+import { readOAuthClientConfigMetadata } from "../oauth/oauth-client-config-service.js";
 import { withProviderHttpDispatchResult } from "../providers/provider-runtime.js";
 import { HttpRequestError } from "../server/api/http-utils.js";
 import { mapConnectionErrorStatus } from "../server/api/runtime-api.js";
 import { resolveTriggerConfig } from "./common/config.js";
+import { PermanentIntegrationError } from "./common/integration.js";
 import { validateListenerPage } from "./common/integration.js";
 import { executeResourceSubscription, executeResourceSubscriptionOperation, abandonResourceSubscription, } from "./resources.js";
 import { executeSubscription, executeSubscriptionOperation } from "./subscriptions.js";
@@ -21,17 +23,40 @@ export class TriggerRunner {
         const decision = input.policy.evaluateTrigger(input.triggerId);
         if (!decision.allowed)
             throw new HttpRequestError(decision.code, decision.message, 403);
-        const stateful = input.request.operation !== "read" && input.request.operation !== "options";
-        if (stateful && !input.grant)
+        const stateful = !["read", "options", "source"].includes(input.request.operation);
+        if ((stateful || (input.request.operation === "source" && input.request.request.action === "receive")) &&
+            !input.grant)
             throw new HttpRequestError("trigger_owner_required", "Stateful Trigger operations require a persistent runtime token.", 403);
         const definition = await this.definition(input.service, input.triggerId);
         const target = await this.target(input.service, input.connectionName, input.connectionId, input.signal, input.policy);
+        const permission = this.options.catalog.providers
+            .find((provider) => provider.service === input.service)
+            ?.triggerPermissions?.find((permission) => permission.id === input.triggerId);
+        const alternatives = permission?.providerScopeAlternatives;
+        const cleanup = (input.request.operation === "reconcile" || input.request.operation === "resource") && !input.request.active;
+        if (!cleanup && alternatives && !alternatives.some((scope) => target.scopes.includes(scope)))
+            throw new HttpRequestError("scope_missing", "The Trigger requires additional provider permissions.", 403);
         const request = input.request;
+        if (request.operation === "source") {
+            const { executeSourceOperation } = await import("./sources/operation.js");
+            if (!("source" in definition) || !definition.source)
+                throw new HttpRequestError("invalid_input", "This Trigger has no shared source protocol.");
+            return this.providerOperation(input.service, () => executeSourceOperation(definition, request.request, target.proxy, input.signal));
+        }
         if (request.operation === "receive") {
-            if (definition.snapshot.type !== "integration" || ("eventSource" in definition && definition.eventSource))
+            if (!("receive" in definition) || definition.eventSource)
                 throw new HttpRequestError("invalid_input", "This Trigger has no remote webhook.");
             return this.providerOperation(input.service, () => executeSubscription(this.options.store, definition, { ...target.owner, tokenId: input.grant.tokenId, triggerId: input.triggerId }, request, target.proxy, input.signal));
         }
+        if (request.operation === "resource") {
+            if (!("resources" in definition) || !definition.resources)
+                throw new HttpRequestError("invalid_input", "This Trigger has no shared resource.");
+            const resources = definition.resources;
+            const config = "reconcile" in resources
+                ? request.config
+                : resolveTriggerConfig(definition.snapshot.configInputs, request.config);
+            return this.providerOperation(input.service, () => executeResourceSubscription(this.options.store, resources, { ...target.owner, tokenId: input.grant.tokenId, triggerId: input.triggerId }, { ...request, config }, target.proxy, input.signal));
+        }
         const config = resolveTriggerConfig(definition.snapshot.configInputs, request.config, request.operation === "options");
         const context = { config, connector: target.proxy, now: new Date(), signal: input.signal };
         return this.providerOperation(input.service, async () => {
@@ -43,7 +68,7 @@ export class TriggerRunner {
                     return definition.configOptions({ ...context, field: request.field });
                 }
                 case "read": {
-                    if (definition.snapshot.type === "poll")
+                    if ("poll" in definition)
                         return definition.poll({ ...context, checkpoint: request.checkpoint });
                     const listener = definition.listener;
                     if (!listener)
@@ -53,13 +78,9 @@ export class TriggerRunner {
                     return page;
                 }
                 case "reconcile":
-                    if (definition.snapshot.type !== "integration" || definition.eventSource)
+                    if (!("reconcile" in definition) || definition.eventSource)
                         throw new HttpRequestError("invalid_input", "This Trigger has no remote webhook.");
                     return executeSubscription(this.options.store, definition, { ...target.owner, tokenId: input.grant.tokenId, triggerId: input.triggerId }, { ...request, config }, target.proxy, input.signal);
-                case "resource":
-                    if (!definition.resources)
-                        throw new HttpRequestError("invalid_input", "This Trigger has no shared resource.");
-                    return executeResourceSubscription(this.options.store, definition.resources, { ...target.owner, tokenId: input.grant.tokenId, triggerId: input.triggerId }, { ...request, config }, target.proxy, input.signal);
             }
         });
     }
@@ -70,12 +91,13 @@ export class TriggerRunner {
         record.connectionRevision = target.owner.connectionRevision;
         const definition = await this.definition(record.service, record.triggerId);
         if (record.mode === "resource") {
-            if (!definition.resources)
+            if (!("resources" in definition) || !definition.resources)
                 throw new HttpRequestError("trigger_not_supported", "Resource subscriptions are unavailable.", 501);
-            await this.providerOperation(record.service, () => executeResourceSubscriptionOperation(this.options.store, definition.resources, record, save, { operation: "resource", config: record.config, active: false, requestKey: record.requestKey }, target.proxy, signal));
+            const resources = definition.resources;
+            await this.providerOperation(record.service, () => executeResourceSubscriptionOperation(this.options.store, resources, record, save, { operation: "resource", config: record.config, active: false, requestKey: record.requestKey }, target.proxy, signal));
         }
         else {
-            if (definition.snapshot.type !== "integration")
+            if (!("reconcile" in definition))
                 throw new HttpRequestError("trigger_not_found", "The remote Trigger definition is unavailable.", 404);
             await this.providerOperation(record.service, () => executeSubscriptionOperation(record, save, definition, {
                 operation: "reconcile",
@@ -89,10 +111,9 @@ export class TriggerRunner {
     }
     async abandonResource(record, signal) {
         const definition = await this.definition(record.service, record.triggerId);
-        const resources = definition.resources;
-        if (!resources)
+        if (!("resources" in definition) || !definition.resources)
             throw new HttpRequestError("trigger_not_supported", "Resource subscriptions are unavailable.", 501);
-        await abandonResourceSubscription(this.options.store, resources, record, signal);
+        await abandonResourceSubscription(this.options.store, definition.resources, record, signal);
     }
     async definition(service, triggerId) {
         if (!this.options.catalog.providers.some((provider) => provider.service === service))
@@ -127,7 +148,21 @@ export class TriggerRunner {
             const executor = await this.options.providerLoader.loadProxyExecutor(service);
             if (!executor)
                 throw new HttpRequestError("trigger_not_supported", "The provider has no Trigger transport.", 501);
+            let oauthClientConfig;
+            if (service === "jira" && credential.authType === "oauth2") {
+                oauthClientConfig = readOAuthClientConfigMetadata(service, credential.metadata);
+                if (!oauthClientConfig?.clientSecret) {
+                    const configured = await this.options.oauthClientConfigs?.getConfig(service);
+                    if (oauthClientConfig == null)
+                        oauthClientConfig = configured;
+                    else if (configured?.clientId === oauthClientConfig.clientId)
+                        oauthClientConfig = { ...oauthClientConfig, clientSecret: configured.clientSecret };
+                }
+            }
             const proxy = {
+                authType: credential.authType,
+                oauthClientConfig,
+                providerAccountId: credential.profile.accountId,
                 execute: async (request, requestSignal) => {
                     signal.throwIfAborted();
                     const result = await withProviderHttpDispatch({
@@ -147,6 +182,7 @@ export class TriggerRunner {
             };
             return {
                 proxy,
+                scopes: credential.profile.grantedScopes,
                 owner: {
                     service,
                     connectionId: stored.id,
@@ -175,7 +211,7 @@ export class TriggerRunner {
                 if (error.name === "TransientIntegrationError" || error.name === "TransientPollError")
                     throw new HttpRequestError("proxy_upstream_error", "The Trigger provider is temporarily unavailable.", 503);
                 if (error.name === "PermanentIntegrationError" || error.name === "PermanentPollError")
-                    throw new HttpRequestError("invalid_input", error.message);
+                    throw new HttpRequestError(error instanceof PermanentIntegrationError ? (error.reason ?? "invalid_input") : "invalid_input", error.message);
             }
             throw error;
         }