@oondemand/oon-core-back 0.3.61 → 0.3.62

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.3.61",
+  "version": "0.3.62",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/modules/integrations/routes.js

@@ -91,6 +91,16 @@ function buildIntegrationRouter() {
       requestId: req.requestId || "",
     }));
   }));
+  router.get("/providers/:provider/configuration/:instanceId/webhook", rbac(READ_ROLES), asyncHandler(async (req, res) => {
+    const provider = getIntegrationProvider(req.params.provider);
+    const getWebhookAccess = requireProviderExtension(provider, "getWebhookAccess");
+    res.json({ provider: provider.key, ...await getWebhookAccess(req.params.instanceId) });
+  }));
+  router.post("/providers/:provider/configuration/:instanceId/webhook/rotate", rbac(WRITE_ROLES), asyncHandler(async (req, res) => {
+    const provider = getIntegrationProvider(req.params.provider);
+    const rotateWebhookToken = requireProviderExtension(provider, "rotateWebhookToken");
+    res.json({ provider: provider.key, ...await rotateWebhookToken(req.params.instanceId) });
+  }));
   router.get("/providers/:provider/mappings", rbac(READ_ROLES), asyncHandler(async (req, res) => {
     const provider = getIntegrationProvider(req.params.provider);
     const describe = requireProviderExtension(provider, "describe");

package/src/modules/omie/models.js

@@ -63,6 +63,10 @@ function maskSecret(value) {
   return `${clear.slice(0, 2)}${"•".repeat(Math.min(8, clear.length - 4))}${clear.slice(-2)}`;
 }
 
+function generateWebhookToken() {
+  return crypto.randomBytes(32).toString("base64url");
+}
+
 function normalizeInstanceId(value) {
   const instanceId = String(value || "default").trim().toLowerCase();
   if (!/^[a-z0-9][a-z0-9._-]*$/.test(instanceId)) {
@@ -83,6 +87,7 @@ function configurationSchema() {
     webhookTokenEncrypted: { type: String, default: "", select: false },
     appKeyMasked: { type: String, default: "" },
     credentialsConfigured: { type: Boolean, default: false },
+    webhookConfigured: { type: Boolean, default: false },
     connectionStatus: { type: String, enum: ["not-tested", "ok", "error"], default: "not-tested" },
     lastConnectionError: { type: String, default: "" },
     lastConnectionTestAt: { type: Date, default: null },
@@ -134,6 +139,7 @@ function environmentCredentials(instanceId) {
 function publicConfiguration(document) {
   if (!document) return null;
   const value = typeof document.toObject === "function" ? document.toObject() : { ...document };
+  value.webhookConfigured = Boolean(value.webhookConfigured || value.webhookTokenEncrypted);
   delete value.appKeyEncrypted;
   delete value.appSecretEncrypted;
   delete value.webhookTokenEncrypted;
@@ -142,7 +148,10 @@ function publicConfiguration(document) {
 
 async function listOmieConfigurations() {
   const { Configuration } = getOmieModels();
-  const persisted = await Configuration.find({}).sort({ label: 1, instanceId: 1 }).lean();
+  const persisted = await Configuration.find({})
+    .select("+webhookTokenEncrypted")
+    .sort({ label: 1, instanceId: 1 })
+    .lean();
   if (persisted.length) return persisted.map(publicConfiguration);
   const env = environmentCredentials("default");
   return [{
@@ -153,6 +162,7 @@ async function listOmieConfigurations() {
     baseUrl: env.baseUrl,
     appKeyMasked: maskSecret(env.appKey),
     credentialsConfigured: Boolean(env.appKey && env.appSecret),
+    webhookConfigured: Boolean(env.webhookToken),
     connectionStatus: "not-tested",
     lastConnectionError: "",
     lastConnectionTestAt: null,
@@ -180,6 +190,7 @@ async function saveOmieConfiguration(instanceId, input = {}) {
   const appKey = String(input.appKey || "").trim();
   const appSecret = String(input.appSecret || "").trim();
   const webhookToken = String(input.webhookToken || "").trim();
+  const env = environmentCredentials(normalized);
   if (appKey) {
     update.appKeyEncrypted = encryptSecret(appKey);
     update.appKeyMasked = maskSecret(appKey);
@@ -189,10 +200,12 @@ async function saveOmieConfiguration(instanceId, input = {}) {
   }
   if (appSecret) update.appSecretEncrypted = encryptSecret(appSecret);
   else if (current?.appSecretEncrypted) update.appSecretEncrypted = current.appSecretEncrypted;
-  if (webhookToken) update.webhookTokenEncrypted = encryptSecret(webhookToken);
-  else if (current?.webhookTokenEncrypted) update.webhookTokenEncrypted = current.webhookTokenEncrypted;
 
-  const env = environmentCredentials(normalized);
+  const effectiveWebhookToken = webhookToken
+    || (current?.webhookTokenEncrypted ? decryptSecret(current.webhookTokenEncrypted) : env.webhookToken)
+    || generateWebhookToken();
+  update.webhookTokenEncrypted = encryptSecret(effectiveWebhookToken);
+  update.webhookConfigured = true;
   const effectiveKey = appKey || (current?.appKeyEncrypted ? decryptSecret(current.appKeyEncrypted) : env.appKey);
   const effectiveSecret = appSecret
     || (current?.appSecretEncrypted ? decryptSecret(current.appSecretEncrypted) : env.appSecret);
@@ -238,6 +251,7 @@ async function resolveOmieConfiguration(instanceId = "default", options = {}) {
       webhookToken: options.includeSecrets ? env.webhookToken : undefined,
       appKeyMasked: maskSecret(env.appKey),
       credentialsConfigured: Boolean(env.appKey && env.appSecret),
+      webhookConfigured: Boolean(env.webhookToken),
       connectionStatus: "not-tested",
       source: "environment",
     };
@@ -253,6 +267,57 @@ async function resolveOmieConfiguration(instanceId = "default", options = {}) {
   return result;
 }
 
+async function ensureOmieWebhookAccess(instanceId = "default", options = {}) {
+  const normalized = normalizeInstanceId(instanceId);
+  const rotate = Boolean(options.rotate);
+  const { Configuration } = getOmieModels();
+  const env = environmentCredentials(normalized);
+  const current = await Configuration.findOne({ instanceId: normalized })
+    .select("+appKeyEncrypted +appSecretEncrypted +webhookTokenEncrypted");
+
+  let token = !rotate && current?.webhookTokenEncrypted
+    ? decryptSecret(current.webhookTokenEncrypted)
+    : (!rotate ? env.webhookToken : "");
+  if (!token) token = generateWebhookToken();
+
+  if (!current) {
+    await saveOmieConfiguration(normalized, {
+      label: normalized === "default" ? "Omie" : normalized,
+      active: Boolean(env.appKey && env.appSecret),
+      baseUrl: env.baseUrl,
+      ...(env.appKey ? { appKey: env.appKey } : {}),
+      ...(env.appSecret ? { appSecret: env.appSecret } : {}),
+      webhookToken: token,
+    });
+  } else if (rotate || !current.webhookTokenEncrypted) {
+    await Configuration.updateOne(
+      { instanceId: normalized },
+      {
+        $set: {
+          webhookTokenEncrypted: encryptSecret(token),
+          webhookConfigured: true,
+        },
+      },
+    );
+  } else if (!current.webhookConfigured) {
+    await Configuration.updateOne(
+      { instanceId: normalized },
+      { $set: { webhookConfigured: true } },
+    );
+  }
+
+  return {
+    instanceId: normalized,
+    webhookConfigured: true,
+    rotated: rotate,
+    webhookPath: `/integrations/webhooks/omie/${encodeURIComponent(token)}`,
+  };
+}
+
+async function rotateOmieWebhookToken(instanceId = "default") {
+  return ensureOmieWebhookAccess(instanceId, { rotate: true });
+}
+
 async function updateConnectionStatus(instanceId, result = {}) {
   const normalized = normalizeInstanceId(instanceId);
   const { Configuration } = getOmieModels();
@@ -297,6 +362,8 @@ module.exports = {
   DEFAULT_BASE_URL,
   decryptSecret,
   encryptSecret,
+  ensureOmieWebhookAccess,
+  generateWebhookToken,
   getOmieModels,
   listOmieConfigurations,
   maskSecret,
@@ -304,6 +371,7 @@ module.exports = {
   publicConfiguration,
   resolveInstanceByWebhookToken,
   resolveOmieConfiguration,
+  rotateOmieWebhookToken,
   saveOmieConfiguration,
   updateConnectionStatus,
 };

package/src/modules/omie/provider.js

@@ -8,11 +8,13 @@ const { sanitizeIntegrationError, sanitizeIntegrationValue } = require("../integ
 const { createOmieClient, getPath, resolveTemplate, OmieApiError } = require("./client");
 const { collectOmieDefinitions, describeOmieDefinitions } = require("./definitions");
 const {
+  ensureOmieWebhookAccess,
   getOmieModels,
   listOmieConfigurations,
   normalizeInstanceId,
   resolveInstanceByWebhookToken,
   resolveOmieConfiguration,
+  rotateOmieWebhookToken,
   saveOmieConfiguration,
   updateConnectionStatus,
 } = require("./models");
@@ -450,6 +452,8 @@ function ensureOmieProviderRegistered(config = {}) {
     getConfiguration: listOmieConfigurations,
     saveConfiguration: saveOmieConfiguration,
     testConnection: (instanceId, options) => testOmieConnection(definitions, instanceId, options),
+    getWebhookAccess: (instanceId) => ensureOmieWebhookAccess(instanceId),
+    rotateWebhookToken: (instanceId) => rotateOmieWebhookToken(instanceId),
     executeCall: (callKey, input, options) => runTrackedOperation({
       provider: "omie",
       resource: callKey,