@oomol-lab/open-connector 1.9.1 → 1.9.3

package/src/triggers/sources/sentry.js

@@ -0,0 +1,125 @@
+import { isJsonObject } from "../common/json.js";
+import { SourceIdentityError } from "./definition.js";
+import { verifySourceHmac } from "./signature.js";
+export const sentryApplication = {
+    kind: "sentry",
+    provider: "sentry",
+    applicationIngress: true,
+    maximumBodyBytes: 64 * 1024,
+    initialize(input, accountId) {
+        if (input.kind !== "sentry" || !accountId)
+            throw new SourceIdentityError("Connector must provide the verified Sentry organization identity.");
+        if (input.eventTypes.length !== 1 || input.eventTypes[0] !== "issue.alert")
+            throw new SourceIdentityError("Only Sentry Issue Alert Rule notifications are supported.");
+        return {
+            identity: JSON.stringify([input.teamId, input.connectionId, input.appId, input.installationId, accountId]),
+            eventTypes: input.eventTypes,
+            config: {
+                appId: input.appId,
+                installationId: input.installationId,
+                organizationId: input.organizationId,
+                accountId,
+            },
+            secrets: { signingSecret: input.signingSecret },
+            state: {},
+        };
+    },
+    async verifyIdentity(source, read) {
+        const identity = await read(source.config);
+        if (!isJsonObject(identity) ||
+            identity.accountId !== source.config.accountId ||
+            identity.appId !== source.config.appId ||
+            identity.installationId !== source.config.installationId ||
+            typeof identity.organizationSlug !== "string" ||
+            typeof identity.organizationId !== "string")
+            throw new SourceIdentityError("The Sentry installation does not belong to the connected organization and application.");
+        return {
+            ...source,
+            config: {
+                ...source.config,
+                organizationSlug: identity.organizationSlug,
+                organizationId: identity.organizationId,
+            },
+        };
+    },
+    update(source, input) {
+        if (input.verificationToken != null || input.encryptKey != null)
+            throw new SourceIdentityError("Sentry uses the integration Client Secret.");
+        if (input.eventTypes.length !== 1 || input.eventTypes[0] !== "issue.alert")
+            throw new SourceIdentityError("Only Sentry Issue Alert Rule notifications are supported.");
+        const signingSecret = input.signingSecret ?? source.secrets.signingSecret;
+        return {
+            ...source,
+            eventTypes: input.eventTypes,
+            secrets: { signingSecret },
+            state: signingSecret === source.secrets.signingSecret ? source.state : {},
+        };
+    },
+    view(source) {
+        return {
+            appId: String(source.config.appId),
+            installationId: String(source.config.installationId),
+            organizationId: String(source.config.organizationId),
+            manageSubscriptions: false,
+            verificationTokenConfigured: false,
+            encryptKeyConfigured: false,
+            signingSecretConfigured: true,
+            verifiedAt: typeof source.state.verifiedAt === "number" ? new Date(source.state.verifiedAt).toISOString() : null,
+        };
+    },
+    ready: (source) => typeof source.state.verifiedAt === "number",
+    async receive(source, bytes, headers, now) {
+        const signature = headers.get("sentry-hook-signature") ?? "";
+        if (!/^[0-9a-f]{64}$/.test(signature))
+            throw new TypeError("Invalid Sentry signature.");
+        if (!(await verifySourceHmac(bytes, signature, String(source.secrets.signingSecret))))
+            throw new TypeError("Invalid Sentry signature.");
+        const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        if (!isJsonObject(payload) || !isJsonObject(payload.installation))
+            throw new TypeError("Invalid Sentry envelope.");
+        if (payload.installation.uuid !== source.config.installationId ||
+            headers.get("sentry-hook-resource") !== "event_alert" ||
+            payload.action !== "triggered")
+            return { response: Response.json({}), state: source.state };
+        if (!isJsonObject(payload.data) || !isJsonObject(payload.data.event))
+            throw new TypeError("Invalid Sentry issue alert.");
+        const event = payload.data.event;
+        if (typeof event.event_id !== "string" ||
+            !event.event_id ||
+            typeof event.issue_id !== "string" ||
+            !event.issue_id ||
+            typeof payload.data.triggered_rule !== "string" ||
+            !payload.data.triggered_rule)
+            throw new TypeError("Incomplete Sentry issue alert.");
+        const deliveryId = JSON.stringify([source.config.installationId, event.event_id, payload.data.triggered_rule]);
+        return {
+            state: { ...source.state, verifiedAt: now },
+            event: {
+                id: deliveryId,
+                type: "issue.alert",
+                payload: {
+                    event: "issue.alert",
+                    deliveryId,
+                    organizationId: source.config.organizationId,
+                    issueId: event.issue_id,
+                    body: payload.data,
+                },
+            },
+        };
+    },
+    matches(config, event) {
+        if (!Array.isArray(config.eventTypes) || !config.eventTypes.includes(event.type))
+            return false;
+        const body = event.payload.body;
+        if (!isJsonObject(body) || !isJsonObject(body.event))
+            return false;
+        if (Array.isArray(config.projectIds) &&
+            config.projectIds.length > 0 &&
+            !config.projectIds.includes(String(body.event.project)))
+            return false;
+        return (!Array.isArray(config.ruleNames) ||
+            config.ruleNames.length === 0 ||
+            config.ruleNames.includes(body.triggered_rule));
+    },
+    resources: { triggerId: "sentry.on_issue_alert", requests: () => [] },
+};

package/src/triggers/sources/signature.d.ts

@@ -0,0 +1 @@
+export declare function verifySourceHmac(bytes: Uint8Array, signature: string, secret: string, hash?: "SHA-1" | "SHA-256"): Promise<boolean>;

package/src/triggers/sources/signature.js

@@ -0,0 +1,10 @@
+export async function verifySourceHmac(bytes, signature, secret, hash = "SHA-256") {
+    const length = hash === "SHA-1" ? 40 : 64;
+    if (signature.length !== length || !/^[0-9a-f]+$/.test(signature))
+        return false;
+    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash }, false, [
+        "verify",
+    ]);
+    const supplied = Uint8Array.from(signature.match(/../g), (value) => Number.parseInt(value, 16));
+    return crypto.subtle.verify("HMAC", key, supplied, bytes.slice());
+}

package/src/triggers/sources/slack-signature.d.ts

@@ -0,0 +1,10 @@
+interface SlackSignatureInput {
+    timestamp: string;
+    signature: string;
+    rawBody: Uint8Array;
+    signingSecret: string;
+    now: number;
+}
+/** Verify Slack's timestamp and signature over the original request bytes. */
+export declare function verifySlackSignature(input: SlackSignatureInput): Promise<"timestamp" | "signature" | undefined>;
+export {};

package/src/triggers/sources/slack-signature.js

@@ -0,0 +1,13 @@
+import { verifySourceHmac } from "./signature.js";
+/** Verify Slack's timestamp and signature over the original request bytes. */
+export async function verifySlackSignature(input) {
+    if (!/^\d{10}$/.test(input.timestamp) || Math.abs(input.now - Number(input.timestamp) * 1000) > 300_000)
+        return "timestamp";
+    if (!/^v0=[0-9a-f]{64}$/.test(input.signature) || !input.signingSecret)
+        return "signature";
+    const prefix = new TextEncoder().encode(`v0:${input.timestamp}:`);
+    const signed = new Uint8Array(prefix.length + input.rawBody.byteLength);
+    signed.set(prefix);
+    signed.set(input.rawBody, prefix.length);
+    return (await verifySourceHmac(signed, input.signature.slice(3), input.signingSecret)) ? undefined : "signature";
+}

package/src/triggers/sources/slack.d.ts

@@ -0,0 +1,3 @@
+import type { CreateEventSource, EventSource, UpdateEventSource } from "./configuration.ts";
+import type { EventSourceDefinition } from "./definition.ts";
+export declare const slackApplication: EventSourceDefinition<CreateEventSource, UpdateEventSource, Pick<EventSource, "appId" | "workspaceId" | "manageSubscriptions" | "verificationTokenConfigured" | "encryptKeyConfigured" | "signingSecretConfigured" | "verifiedAt">>;

package/src/triggers/sources/slack.js

@@ -0,0 +1,125 @@
+import { isJsonObject } from "../common/json.js";
+import { SourceIdentityError } from "./definition.js";
+import { verifySlackSignature } from "./slack-signature.js";
+const events = new Set(["app_mention", "message.im"]);
+export const slackApplication = {
+    kind: "slack",
+    applicationIngress: true,
+    provider: "slackbot",
+    maximumBodyBytes: 64 * 1024,
+    initialize(input, accountId) {
+        if (input.kind !== "slack" || accountId == null || !/^U[A-Z0-9]+$/.test(accountId))
+            throw new SourceIdentityError("Connector must provide the verified Slack bot user identity.");
+        if (input.eventTypes.some((event) => !events.has(event)))
+            throw new SourceIdentityError("Unsupported Slack event type.");
+        return {
+            identity: JSON.stringify([input.teamId, input.connectionId, input.appId, input.workspaceId, accountId]),
+            eventTypes: input.eventTypes,
+            config: { appId: input.appId, workspaceId: input.workspaceId, accountId },
+            secrets: { signingSecret: input.signingSecret },
+            state: {},
+        };
+    },
+    update(source, input) {
+        if (input.eventTypes.some((event) => !events.has(event)))
+            throw new SourceIdentityError("Unsupported Slack event type.");
+        const signingSecret = input.signingSecret ?? source.secrets.signingSecret;
+        return {
+            ...source,
+            eventTypes: input.eventTypes,
+            secrets: { signingSecret },
+            state: signingSecret === source.secrets.signingSecret ? source.state : {},
+        };
+    },
+    view(source) {
+        return {
+            appId: String(source.config.appId),
+            workspaceId: String(source.config.workspaceId),
+            manageSubscriptions: false,
+            verificationTokenConfigured: false,
+            encryptKeyConfigured: false,
+            signingSecretConfigured: true,
+            verifiedAt: typeof source.state.verifiedAt === "number" ? new Date(source.state.verifiedAt).toISOString() : null,
+        };
+    },
+    ready: (source) => typeof source.state.verifiedAt === "number",
+    async receive(source, bytes, headers, now) {
+        const timestamp = headers.get("x-slack-request-timestamp") ?? "";
+        const signature = headers.get("x-slack-signature") ?? "";
+        const failure = await verifySlackSignature({
+            timestamp,
+            signature,
+            rawBody: bytes,
+            signingSecret: String(source.secrets.signingSecret),
+            now,
+        });
+        if (failure)
+            throw new TypeError("Invalid Slack signature or timestamp.");
+        const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        if (!isJsonObject(payload))
+            throw new TypeError("Invalid Slack envelope.");
+        if (payload.type === "url_verification") {
+            if (typeof payload.challenge !== "string" || !payload.challenge || payload.challenge.length > 1024)
+                throw new TypeError("Invalid Slack challenge.");
+            return { response: Response.json({ challenge: payload.challenge }), state: { ...source.state, verifiedAt: now } };
+        }
+        const ignored = () => ({ response: Response.json({}), state: source.state });
+        if (payload.type !== "event_callback" ||
+            payload.api_app_id !== source.config.appId ||
+            payload.team_id !== source.config.workspaceId)
+            return ignored();
+        if (!Array.isArray(payload.authorizations) ||
+            !payload.authorizations.some((authorization) => isJsonObject(authorization) &&
+                authorization.is_bot === true &&
+                authorization.user_id === source.config.accountId &&
+                authorization.team_id === source.config.workspaceId))
+            return ignored();
+        const event = payload.event;
+        if (!isJsonObject(event) ||
+            event.bot_id != null ||
+            event.subtype != null ||
+            event.user === source.config.accountId ||
+            payload.is_ext_shared_channel === true)
+            return ignored();
+        const type = event.type === "app_mention"
+            ? "app_mention"
+            : event.type === "message" && event.channel_type === "im"
+                ? "message.im"
+                : undefined;
+        if (type == null)
+            return ignored();
+        if (typeof payload.event_id !== "string" ||
+            !payload.event_id ||
+            typeof event.channel !== "string" ||
+            typeof event.user !== "string" ||
+            typeof event.text !== "string" ||
+            typeof event.ts !== "string")
+            throw new TypeError("Incomplete Slack event.");
+        return {
+            event: {
+                id: payload.event_id,
+                type,
+                payload: {
+                    event: type,
+                    deliveryId: payload.event_id,
+                    appId: payload.api_app_id,
+                    teamId: payload.team_id,
+                    channel: event.channel,
+                    user: event.user,
+                    text: event.text,
+                    ts: event.ts,
+                    threadTs: typeof event.thread_ts === "string" ? event.thread_ts : null,
+                    body: event,
+                },
+            },
+        };
+    },
+    matches(config, event) {
+        return (Array.isArray(config.eventTypes) &&
+            config.eventTypes.includes(event.type) &&
+            (!Array.isArray(config.channelIds) ||
+                config.channelIds.length === 0 ||
+                config.channelIds.includes(event.payload.channel)));
+    },
+    resources: { triggerId: "slackbot.on_event", requests: () => [] },
+};

package/src/triggers/sources/zoom.d.ts

@@ -0,0 +1,3 @@
+import type { CreateEventSource, EventSource, UpdateEventSource } from "./configuration.ts";
+import type { EventSourceDefinition } from "./definition.ts";
+export declare const zoomApplication: EventSourceDefinition<CreateEventSource, UpdateEventSource, Pick<EventSource, "appId" | "manageSubscriptions" | "verificationTokenConfigured" | "encryptKeyConfigured" | "signingSecretConfigured" | "verifiedAt">>;

package/src/triggers/sources/zoom.js

@@ -0,0 +1,113 @@
+import { isJsonObject } from "../common/json.js";
+import { SourceIdentityError } from "./definition.js";
+import { verifySourceHmac } from "./signature.js";
+const encoder = new TextEncoder();
+export const zoomApplication = {
+    kind: "zoom",
+    provider: "zoom",
+    applicationIngress: true,
+    maximumBodyBytes: 64 * 1024,
+    initialize(input, accountId) {
+        if (input.kind !== "zoom" || !accountId)
+            throw new SourceIdentityError("Connector must provide the verified Zoom connection identity.");
+        if (input.eventTypes.length !== 1 || input.eventTypes[0] !== "recording.completed")
+            throw new SourceIdentityError("Only completed Zoom cloud recordings are supported.");
+        return {
+            identity: JSON.stringify([input.teamId, input.connectionId, input.appId, accountId]),
+            eventTypes: input.eventTypes,
+            config: { appId: input.appId, accountId },
+            secrets: { signingSecret: input.signingSecret },
+            state: {},
+        };
+    },
+    async verifyIdentity(source, read) {
+        const identity = await read(source.config);
+        if (!isJsonObject(identity) ||
+            identity.accountId !== source.config.accountId ||
+            typeof identity.userId !== "string" ||
+            !identity.userId ||
+            typeof identity.zoomAccountId !== "string" ||
+            !identity.zoomAccountId)
+            throw new SourceIdentityError("Zoom did not return the connected user and account identity.");
+        if (source.config.userId != null &&
+            (source.config.userId !== identity.userId || source.config.zoomAccountId !== identity.zoomAccountId))
+            throw new SourceIdentityError("The Zoom user or account changed. Recreate the event source.");
+        return { ...source, config: { ...source.config, userId: identity.userId, zoomAccountId: identity.zoomAccountId } };
+    },
+    update(source, input) {
+        if (input.verificationToken != null || input.encryptKey != null)
+            throw new SourceIdentityError("Zoom uses the Webhook Secret Token.");
+        if (input.eventTypes.length !== 1 || input.eventTypes[0] !== "recording.completed")
+            throw new SourceIdentityError("Only completed Zoom cloud recordings are supported.");
+        const signingSecret = input.signingSecret ?? source.secrets.signingSecret;
+        return {
+            ...source,
+            eventTypes: input.eventTypes,
+            secrets: { signingSecret },
+            state: signingSecret === source.secrets.signingSecret ? source.state : {},
+        };
+    },
+    view(source) {
+        return {
+            appId: String(source.config.appId),
+            manageSubscriptions: false,
+            verificationTokenConfigured: false,
+            encryptKeyConfigured: false,
+            signingSecretConfigured: true,
+            verifiedAt: typeof source.state.verifiedAt === "number" ? new Date(source.state.verifiedAt).toISOString() : null,
+        };
+    },
+    ready: (source) => typeof source.state.verifiedAt === "number",
+    async receive(source, bytes, headers, now) {
+        const timestamp = headers.get("x-zm-request-timestamp") ?? "";
+        const signature = headers.get("x-zm-signature") ?? "";
+        if (!/^\d{10}$/.test(timestamp) ||
+            Math.abs(now - Number(timestamp) * 1000) > 300000 ||
+            !signature.startsWith("v0="))
+            throw new TypeError("Invalid Zoom signature or timestamp.");
+        const prefix = encoder.encode(`v0:${timestamp}:`);
+        const signed = new Uint8Array(prefix.length + bytes.length);
+        signed.set(prefix);
+        signed.set(bytes, prefix.length);
+        if (!(await verifySourceHmac(signed, signature.slice(3), String(source.secrets.signingSecret))))
+            throw new TypeError("Invalid Zoom signature.");
+        const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        if (!isJsonObject(payload) || !isJsonObject(payload.payload))
+            throw new TypeError("Invalid Zoom envelope.");
+        if (payload.event === "endpoint.url_validation") {
+            const plainToken = payload.payload.plainToken;
+            if (typeof plainToken !== "string" || !plainToken || plainToken.length > 1024)
+                throw new TypeError("Invalid Zoom challenge.");
+            const key = await crypto.subtle.importKey("raw", encoder.encode(String(source.secrets.signingSecret)), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+            const digest = await crypto.subtle.sign("HMAC", key, encoder.encode(plainToken));
+            const encryptedToken = Array.from(new Uint8Array(digest), (value) => value.toString(16).padStart(2, "0")).join("");
+            return { response: Response.json({ plainToken, encryptedToken }), state: { ...source.state, verifiedAt: now } };
+        }
+        const object = payload.payload.object;
+        if (payload.event !== "recording.completed" ||
+            payload.payload.account_id !== source.config.zoomAccountId ||
+            !isJsonObject(object) ||
+            object.host_id !== source.config.userId)
+            return { response: Response.json({}), state: source.state };
+        if (typeof object.uuid !== "string" || !object.uuid || !Array.isArray(object.recording_files))
+            throw new TypeError("Incomplete Zoom recording.");
+        const files = object.recording_files.filter((file) => isJsonObject(file) && file.status === "completed");
+        if (!files.length)
+            return { response: Response.json({}), state: source.state };
+        return {
+            event: {
+                id: object.uuid,
+                type: "recording.completed",
+                payload: {
+                    event: "recording.completed",
+                    deliveryId: object.uuid,
+                    accountId: payload.payload.account_id,
+                    meetingUuid: object.uuid,
+                    body: { ...object, recording_files: files },
+                },
+            },
+        };
+    },
+    matches: (config, event) => Array.isArray(config.eventTypes) && config.eventTypes.includes(event.type),
+    resources: { triggerId: "zoom.on_recording_ready", requests: () => [] },
+};

package/src/triggers/trigger-runner.d.ts

@@ -2,11 +2,13 @@ import type { CatalogStore } from "../catalog-store.ts";
 import type { ConnectionService } from "../connection-service.ts";
 import type { ActionPolicySnapshot } from "../core/action-policy.ts";
 import type { ProviderHttpDispatchOptions } from "../core/provider-http-dispatch.ts";
+import type { OAuthClientConfigService } from "../oauth/oauth-client-config-service.ts";
 import type { IProviderLoader } from "../providers/provider-loader.ts";
 import type { RuntimeGrant } from "../server/storage/runtime-token-service.ts";
 import type { TriggerRequest } from "./request.ts";
 import type { TriggerSubscription, TriggerStore } from "./store.ts";
 interface TriggerRunnerOptions {
+    oauthClientConfigs?: Pick<OAuthClientConfigService, "getConfig">;
     providerHttpDispatch?: ProviderHttpDispatchOptions;
     catalog: CatalogStore;
     providerLoader: IProviderLoader;

package/src/triggers/trigger-runner.js

@@ -1,10 +1,12 @@
-import { ConnectionError } from "../connection-service.js";
+import { ConnectionError } from "../connection-error.js";
 import { optionalInteger, optionalRecord } from "../core/cast.js";
 import { withProviderHttpDispatch } from "../core/provider-http-dispatch.js";
+import { readOAuthClientConfigMetadata } from "../oauth/oauth-client-config-service.js";
 import { withProviderHttpDispatchResult } from "../providers/provider-runtime.js";
 import { HttpRequestError } from "../server/api/http-utils.js";
 import { mapConnectionErrorStatus } from "../server/api/runtime-api.js";
 import { resolveTriggerConfig } from "./common/config.js";
+import { PermanentIntegrationError } from "./common/integration.js";
 import { validateListenerPage } from "./common/integration.js";
 import { executeResourceSubscription, executeResourceSubscriptionOperation, abandonResourceSubscription, } from "./resources.js";
 import { executeSubscription, executeSubscriptionOperation } from "./subscriptions.js";
@@ -21,17 +23,40 @@ export class TriggerRunner {
         const decision = input.policy.evaluateTrigger(input.triggerId);
         if (!decision.allowed)
             throw new HttpRequestError(decision.code, decision.message, 403);
-        const stateful = input.request.operation !== "read" && input.request.operation !== "options";
-        if (stateful && !input.grant)
+        const stateful = !["read", "options", "source"].includes(input.request.operation);
+        if ((stateful || (input.request.operation === "source" && input.request.request.action === "receive")) &&
+            !input.grant)
             throw new HttpRequestError("trigger_owner_required", "Stateful Trigger operations require a persistent runtime token.", 403);
         const definition = await this.definition(input.service, input.triggerId);
         const target = await this.target(input.service, input.connectionName, input.connectionId, input.signal, input.policy);
+        const permission = this.options.catalog.providers
+            .find((provider) => provider.service === input.service)
+            ?.triggerPermissions?.find((permission) => permission.id === input.triggerId);
+        const alternatives = permission?.providerScopeAlternatives;
+        const cleanup = (input.request.operation === "reconcile" || input.request.operation === "resource") && !input.request.active;
+        if (!cleanup && alternatives && !alternatives.some((scope) => target.scopes.includes(scope)))
+            throw new HttpRequestError("scope_missing", "The Trigger requires additional provider permissions.", 403);
         const request = input.request;
+        if (request.operation === "source") {
+            const { executeSourceOperation } = await import("./sources/operation.js");
+            if (!("source" in definition) || !definition.source)
+                throw new HttpRequestError("invalid_input", "This Trigger has no shared source protocol.");
+            return this.providerOperation(input.service, () => executeSourceOperation(definition, request.request, target.proxy, input.signal));
+        }
         if (request.operation === "receive") {
-            if (definition.snapshot.type !== "integration" || ("eventSource" in definition && definition.eventSource))
+            if (!("receive" in definition) || definition.eventSource)
                 throw new HttpRequestError("invalid_input", "This Trigger has no remote webhook.");
             return this.providerOperation(input.service, () => executeSubscription(this.options.store, definition, { ...target.owner, tokenId: input.grant.tokenId, triggerId: input.triggerId }, request, target.proxy, input.signal));
         }
+        if (request.operation === "resource") {
+            if (!("resources" in definition) || !definition.resources)
+                throw new HttpRequestError("invalid_input", "This Trigger has no shared resource.");
+            const resources = definition.resources;
+            const config = "reconcile" in resources
+                ? request.config
+                : resolveTriggerConfig(definition.snapshot.configInputs, request.config);
+            return this.providerOperation(input.service, () => executeResourceSubscription(this.options.store, resources, { ...target.owner, tokenId: input.grant.tokenId, triggerId: input.triggerId }, { ...request, config }, target.proxy, input.signal));
+        }
         const config = resolveTriggerConfig(definition.snapshot.configInputs, request.config, request.operation === "options");
         const context = { config, connector: target.proxy, now: new Date(), signal: input.signal };
         return this.providerOperation(input.service, async () => {
@@ -43,7 +68,7 @@ export class TriggerRunner {
                     return definition.configOptions({ ...context, field: request.field });
                 }
                 case "read": {
-                    if (definition.snapshot.type === "poll")
+                    if ("poll" in definition)
                         return definition.poll({ ...context, checkpoint: request.checkpoint });
                     const listener = definition.listener;
                     if (!listener)
@@ -53,13 +78,9 @@ export class TriggerRunner {
                     return page;
                 }
                 case "reconcile":
-                    if (definition.snapshot.type !== "integration" || definition.eventSource)
+                    if (!("reconcile" in definition) || definition.eventSource)
                         throw new HttpRequestError("invalid_input", "This Trigger has no remote webhook.");
                     return executeSubscription(this.options.store, definition, { ...target.owner, tokenId: input.grant.tokenId, triggerId: input.triggerId }, { ...request, config }, target.proxy, input.signal);
-                case "resource":
-                    if (!definition.resources)
-                        throw new HttpRequestError("invalid_input", "This Trigger has no shared resource.");
-                    return executeResourceSubscription(this.options.store, definition.resources, { ...target.owner, tokenId: input.grant.tokenId, triggerId: input.triggerId }, { ...request, config }, target.proxy, input.signal);
             }
         });
     }
@@ -70,12 +91,13 @@ export class TriggerRunner {
         record.connectionRevision = target.owner.connectionRevision;
         const definition = await this.definition(record.service, record.triggerId);
         if (record.mode === "resource") {
-            if (!definition.resources)
+            if (!("resources" in definition) || !definition.resources)
                 throw new HttpRequestError("trigger_not_supported", "Resource subscriptions are unavailable.", 501);
-            await this.providerOperation(record.service, () => executeResourceSubscriptionOperation(this.options.store, definition.resources, record, save, { operation: "resource", config: record.config, active: false, requestKey: record.requestKey }, target.proxy, signal));
+            const resources = definition.resources;
+            await this.providerOperation(record.service, () => executeResourceSubscriptionOperation(this.options.store, resources, record, save, { operation: "resource", config: record.config, active: false, requestKey: record.requestKey }, target.proxy, signal));
         }
         else {
-            if (definition.snapshot.type !== "integration")
+            if (!("reconcile" in definition))
                 throw new HttpRequestError("trigger_not_found", "The remote Trigger definition is unavailable.", 404);
             await this.providerOperation(record.service, () => executeSubscriptionOperation(record, save, definition, {
                 operation: "reconcile",
@@ -89,10 +111,9 @@ export class TriggerRunner {
     }
     async abandonResource(record, signal) {
         const definition = await this.definition(record.service, record.triggerId);
-        const resources = definition.resources;
-        if (!resources)
+        if (!("resources" in definition) || !definition.resources)
             throw new HttpRequestError("trigger_not_supported", "Resource subscriptions are unavailable.", 501);
-        await abandonResourceSubscription(this.options.store, resources, record, signal);
+        await abandonResourceSubscription(this.options.store, definition.resources, record, signal);
     }
     async definition(service, triggerId) {
         if (!this.options.catalog.providers.some((provider) => provider.service === service))
@@ -127,7 +148,21 @@ export class TriggerRunner {
             const executor = await this.options.providerLoader.loadProxyExecutor(service);
             if (!executor)
                 throw new HttpRequestError("trigger_not_supported", "The provider has no Trigger transport.", 501);
+            let oauthClientConfig;
+            if (service === "jira" && credential.authType === "oauth2") {
+                oauthClientConfig = readOAuthClientConfigMetadata(service, credential.metadata);
+                if (!oauthClientConfig?.clientSecret) {
+                    const configured = await this.options.oauthClientConfigs?.getConfig(service);
+                    if (oauthClientConfig == null)
+                        oauthClientConfig = configured;
+                    else if (configured?.clientId === oauthClientConfig.clientId)
+                        oauthClientConfig = { ...oauthClientConfig, clientSecret: configured.clientSecret };
+                }
+            }
             const proxy = {
+                authType: credential.authType,
+                oauthClientConfig,
+                providerAccountId: credential.profile.accountId,
                 execute: async (request, requestSignal) => {
                     signal.throwIfAborted();
                     const result = await withProviderHttpDispatch({
@@ -147,6 +182,7 @@ export class TriggerRunner {
             };
             return {
                 proxy,
+                scopes: credential.profile.grantedScopes,
                 owner: {
                     service,
                     connectionId: stored.id,
@@ -175,7 +211,7 @@ export class TriggerRunner {
                 if (error.name === "TransientIntegrationError" || error.name === "TransientPollError")
                     throw new HttpRequestError("proxy_upstream_error", "The Trigger provider is temporarily unavailable.", 503);
                 if (error.name === "PermanentIntegrationError" || error.name === "PermanentPollError")
-                    throw new HttpRequestError("invalid_input", error.message);
+                    throw new HttpRequestError(error instanceof PermanentIntegrationError ? (error.reason ?? "invalid_input") : "invalid_input", error.message);
             }
             throw error;
         }