@opengeni/api-router 0.26.1 → 0.30.0

package/src/integrations/google-drive.ts

@@ -27,9 +27,12 @@ import {
 import {
   API_INTEGRATION_OAUTH_CREDENTIAL_ROLE,
   ApiIntegrationOAuthConnectionMetadata,
-  IntegrationFeatureMutationResult,
+  IntegrationFacetMutationResult,
 } from "@opengeni/contracts";
-import { GOOGLE_DRIVE_PRESET, providerDomainForPreset } from "@opengeni/capabilities";
+import {
+  GOOGLE_DRIVE_INTEGRATION_DEFINITION,
+  integrationDefinitionProviderDomain,
+} from "@opengeni/capabilities";
 import {
   captureScheduledTaskRestoreState,
   createValidatedScheduledTask,
@@ -42,7 +45,7 @@ import {
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   buildConnectionTokenResolver,
-  configureIntegrationFeature,
+  configureIntegrationFacet,
   appendKnowledgeSourceAclVersion,
   deauthorizeKnowledgeSourceRetrieval,
   ConnectionDisconnectGenerationError,
@@ -58,7 +61,7 @@ import {
   getWorkspaceGrant,
   listKnowledgeSourceSyncTasksForConnection,
   loadConnectionCredentialForBroker,
-  listIntegrationInstanceFeatures,
+  listIntegrationInstanceFacets,
   transitionConnectionState,
   updateConnection,
   updateScheduledTask,
@@ -731,19 +734,19 @@ export async function browseGoogleDrive(
   });
 }
 
-export async function browseGoogleDriveIntegrationSource(
+export async function browseGoogleDriveFacetSource(
   deps: ApiRouteDeps,
   input: {
     workspaceId: string;
     subjectId: string;
     capabilityId: string;
     instanceKey: string;
-    featureKey: string;
+    facetKey: string;
     parentId: string;
     pageToken?: string | undefined;
   },
 ) {
-  const context = await requireGoogleDriveIntegrationFeature(deps, input);
+  const context = await requireGoogleDriveIntegrationFacet(deps, input);
   return await browseGoogleDrive(deps, {
     workspaceId: input.workspaceId,
     subjectId: input.subjectId,
@@ -753,7 +756,7 @@ export async function browseGoogleDriveIntegrationSource(
   });
 }
 
-export async function saveGoogleDriveIntegrationSource(
+export async function saveGoogleDriveFacetSource(
   deps: ApiRouteDeps,
   input: {
     accountId: string;
@@ -761,19 +764,19 @@ export async function saveGoogleDriveIntegrationSource(
     subjectId: string;
     capabilityId: string;
     instanceKey: string;
-    featureKey: string;
+    facetKey: string;
     payload: unknown;
     canManageOrganizationDestination: boolean;
     canManageWorkspaceDestination: boolean;
     canManagePersonalDestination: boolean;
   },
-): Promise<IntegrationFeatureMutationResult> {
+): Promise<IntegrationFacetMutationResult> {
   const parsedPayload = SaveGoogleDriveIntegrationSourceRequest.safeParse(input.payload);
   if (!parsedPayload.success) {
     throw new HTTPException(400, { message: "invalid Google Drive source selection" });
   }
   const payload = parsedPayload.data;
-  const context = await requireGoogleDriveIntegrationFeature(deps, input);
+  const context = await requireGoogleDriveIntegrationFacet(deps, input);
   const documentDestination = googleDriveDocumentDestination(input, payload);
   const verifiedSources = await verifyGoogleDriveSources(deps, {
     workspaceId: input.workspaceId,
@@ -811,16 +814,16 @@ export async function saveGoogleDriveIntegrationSource(
     syncCadence: payload.syncCadence,
     readPolicy: payload.readPolicy,
   });
-  return IntegrationFeatureMutationResult.parse(
-    await configureIntegrationFeature(deps.db, {
+  return IntegrationFacetMutationResult.parse(
+    await configureIntegrationFacet(deps.db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       subjectId: input.subjectId,
       capabilityId: input.capabilityId,
       instanceKey: input.instanceKey,
-      featureKey: input.featureKey,
+      facetKey: input.facetKey,
       displayName:
-        context.feature.binding?.displayName ?? `${input.instanceKey} — Google Drive content`,
+        context.facet.binding?.displayName ?? `${input.instanceKey} — Google Drive content`,
       config,
       ...(payload.expectedVersion !== undefined
         ? { expectedVersion: payload.expectedVersion }
@@ -932,30 +935,30 @@ export async function saveGoogleDriveSource(
   return updated;
 }
 
-async function requireGoogleDriveIntegrationFeature(
+async function requireGoogleDriveIntegrationFacet(
   deps: ApiRouteDeps,
   input: {
     workspaceId: string;
     subjectId: string;
     capabilityId: string;
     instanceKey: string;
-    featureKey: string;
+    facetKey: string;
   },
 ) {
-  const instance = await listIntegrationInstanceFeatures(
+  const instance = await listIntegrationInstanceFacets(
     deps.db,
     input.workspaceId,
     input.subjectId,
     input.capabilityId,
     input.instanceKey,
   );
-  const feature = instance.features.find(
-    (candidate) => candidate.definition.featureKey === input.featureKey,
+  const facet = instance.facets.find(
+    (candidate) => candidate.definition.facetKey === input.facetKey,
   );
   if (
-    !feature ||
-    feature.definition.kind !== "knowledge_source" ||
-    feature.definition.capabilities.provider !== "google-drive"
+    !facet ||
+    facet.definition.kind !== "knowledge_source" ||
+    facet.definition.capabilities.provider !== "google-drive"
   ) {
     throw new HTTPException(404, { message: "Google Drive knowledge source not found" });
   }
@@ -972,7 +975,7 @@ async function requireGoogleDriveIntegrationFeature(
     throw new HTTPException(404, { message: "Google Drive Connection not found" });
   }
   await requireGoogleDriveApiConnection(deps, connection, input.subjectId);
-  return { instance, feature, connection };
+  return { instance, facet, connection };
 }
 
 function googleDriveDocumentDestination(
@@ -1531,7 +1534,9 @@ async function requireGoogleDriveApiConnection(
 ): Promise<GoogleDriveApiConnection> {
   const legacy = GoogleDriveConnectionMetadata.safeParse(connection.metadata);
   const integration = ApiIntegrationOAuthConnectionMetadata.safeParse(connection.metadata);
-  const genericProviderDomain = providerDomainForPreset(GOOGLE_DRIVE_PRESET);
+  const genericProviderDomain = integrationDefinitionProviderDomain(
+    GOOGLE_DRIVE_INTEGRATION_DEFINITION,
+  );
   const authority: GoogleDriveApiConnection | null =
     connection.kind === "oauth2" &&
     connection.subjectId === subjectId &&
@@ -1544,7 +1549,7 @@ async function requireGoogleDriveApiConnection(
           integration.success &&
           integration.data.credentialRole === API_INTEGRATION_OAUTH_CREDENTIAL_ROLE &&
           integration.data.providerFamily === "google" &&
-          integration.data.authorizedPresetIds.includes(GOOGLE_DRIVE_PRESET.id)
+          integration.data.authorizedDefinitionIds.includes(GOOGLE_DRIVE_INTEGRATION_DEFINITION.id)
         ? { kind: "integration", connection, metadata: integration.data }
         : null;
   if (!authority) {

package/src/integrations/provider-oauth.ts

@@ -2,9 +2,9 @@ import { Buffer } from "node:buffer";
 import { createHash, randomBytes } from "node:crypto";
 
 import {
-  providerDomainForPreset,
-  providerPresetById,
-  type OpenApiProviderPreset,
+  integrationDefinitionProviderDomain,
+  integrationDefinitionById,
+  type IntegrationDefinition,
 } from "@opengeni/capabilities";
 import {
   parseIntegrationsOauthClientsJson,
@@ -60,8 +60,8 @@ type ProviderOAuthState = {
   workspaceId: string;
   subjectId: string;
   ownership: ConnectionOwnership;
-  presetId: string;
-  presetFingerprint: string;
+  definitionId: string;
+  definitionFingerprint: string;
   providerDomain: string;
   authorizeScopes: string[];
   encryptedPkceVerifier: string;
@@ -121,8 +121,8 @@ export async function startApiIntegrationProviderOAuth(
     payload: ApiIntegrationOAuthStartRequest;
   },
 ): Promise<OAuthStartResponse> {
-  const preset = requiredPreset(input.payload.presetId);
-  const providerDomain = providerDomainForPreset(preset);
+  const definition = requiredDefinition(input.payload.definitionId);
+  const providerDomain = integrationDefinitionProviderDomain(definition);
   const existing = input.payload.connectionId
     ? await getConnectionMetadata(
         deps.db,
@@ -138,7 +138,7 @@ export async function startApiIntegrationProviderOAuth(
     ? requireProviderOAuthConnection(existing, {
         subjectId: input.subjectId,
         providerDomain,
-        providerFamily: preset.family,
+        providerFamily: definition.provider.id,
       })
     : null;
   const existingOwnership: ConnectionOwnership | null = existing
@@ -158,13 +158,13 @@ export async function startApiIntegrationProviderOAuth(
   const ownership = existingOwnership ?? input.payload.ownership ?? "personal";
   const authorizeScopes = uniqueStrings([
     ...(existing?.grantedScopes ?? []),
-    ...preset.oauth.scopes,
+    ...definition.authentication.scopes,
   ]);
-  const client = providerClientForPreset(deps.settings, preset);
+  const client = providerClientForDefinition(deps.settings, definition);
   const verifier = randomBytes(48).toString("base64url");
   const key = requireEnvironmentEncryption(deps.settings);
   const baseUrl = integrationBaseUrl(deps.settings.publicBaseUrl, input.requestUrl);
-  const redirectUri = `${baseUrl}${providerOAuthCallbackPath(preset)}`;
+  const redirectUri = `${baseUrl}${PROVIDER_OAUTH_CALLBACK_PATH}`;
   const returnPath = safeReturnPath(
     input.payload.returnPath ?? `/workspaces/${input.workspaceId}/capabilities`,
   );
@@ -173,8 +173,8 @@ export async function startApiIntegrationProviderOAuth(
     workspaceId: input.workspaceId,
     subjectId: input.subjectId,
     ownership,
-    presetId: preset.id,
-    presetFingerprint: providerPresetFingerprint(preset),
+    definitionId: definition.id,
+    definitionFingerprint: providerDefinitionFingerprint(definition),
     providerDomain,
     authorizeScopes,
     encryptedPkceVerifier: encryptEnvironmentValue(key, verifier),
@@ -189,7 +189,7 @@ export async function startApiIntegrationProviderOAuth(
         }
       : {}),
   });
-  const authorizationUrl = new URL(preset.oauth.authorizationUrl);
+  const authorizationUrl = new URL(definition.authentication.authorizationUrl);
   authorizationUrl.searchParams.set("response_type", "code");
   authorizationUrl.searchParams.set("client_id", client.clientId);
   authorizationUrl.searchParams.set("redirect_uri", redirectUri);
@@ -201,7 +201,7 @@ export async function startApiIntegrationProviderOAuth(
     createHash("sha256").update(verifier).digest("base64url"),
   );
   authorizationUrl.searchParams.set("prompt", "select_account");
-  if (preset.family === "google") {
+  if (definition.provider.id === "google") {
     authorizationUrl.searchParams.set("access_type", "offline");
     authorizationUrl.searchParams.set("include_granted_scopes", "true");
     authorizationUrl.searchParams.set("prompt", "consent select_account");
@@ -240,16 +240,16 @@ export async function completeApiIntegrationProviderOAuth(
     if (input.error) throw new ProviderOAuthCallbackError("provider_denied");
     if (!input.code) throw new ProviderOAuthCallbackError("missing_code");
 
-    const preset = providerPresetById(state.presetId);
-    if (!preset) throw new ProviderOAuthCallbackError("state_invalid");
+    const definition = integrationDefinitionById(state.definitionId);
+    if (!definition) throw new ProviderOAuthCallbackError("state_invalid");
     if (
-      state.presetFingerprint !== providerPresetFingerprint(preset) ||
-      state.providerDomain !== providerDomainForPreset(preset) ||
-      preset.oauth.scopes.some((scope) => !state!.authorizeScopes.includes(scope))
+      state.definitionFingerprint !== providerDefinitionFingerprint(definition) ||
+      state.providerDomain !== integrationDefinitionProviderDomain(definition) ||
+      definition.authentication.scopes.some((scope) => !state!.authorizeScopes.includes(scope))
     ) {
       throw new ProviderOAuthCallbackError("state_invalid");
     }
-    const client = providerClientForPreset(deps.settings, preset);
+    const client = providerClientForDefinition(deps.settings, definition);
     if (
       client.clientId !== state.clientId ||
       client.tokenEndpointAuthMethod !== state.tokenEndpointAuthMethod
@@ -258,17 +258,17 @@ export async function completeApiIntegrationProviderOAuth(
     }
     const key = requireEnvironmentEncryption(deps.settings);
     const verifier = decryptEnvironmentValue(key, state.encryptedPkceVerifier);
-    const redirectUri = `${apiBaseUrl}${providerOAuthCallbackPath(preset)}`;
-    const token = await exchangeProviderAuthorizationCode(deps, preset, client, {
+    const redirectUri = `${apiBaseUrl}${PROVIDER_OAUTH_CALLBACK_PATH}`;
+    const token = await exchangeProviderAuthorizationCode(deps, definition, client, {
       code: input.code,
       verifier,
       redirectUri,
     });
-    if (!providerScopesInclude(preset, token.scopes, state.authorizeScopes)) {
+    if (!providerScopesInclude(definition, token.scopes, state.authorizeScopes)) {
       throw new ProviderOAuthCallbackError("scope_not_granted");
     }
     const grantedScopes = token.scopes.length > 0 ? token.scopes : state.authorizeScopes;
-    const identity = await verifyProviderIdentity(deps, preset, token);
+    const identity = await verifyProviderIdentity(deps, definition, token);
     if (
       state.expectedProviderPrincipalId &&
       state.expectedProviderPrincipalId !== identity.principalId
@@ -287,7 +287,7 @@ export async function completeApiIntegrationProviderOAuth(
       ? requireProviderOAuthConnection(existing, {
           subjectId: state.subjectId,
           providerDomain: state.providerDomain,
-          providerFamily: preset.family,
+          providerFamily: definition.provider.id,
         })
       : null;
     if (existingMetadata && existingMetadata.providerPrincipalId !== identity.principalId) {
@@ -315,7 +315,7 @@ export async function completeApiIntegrationProviderOAuth(
         token_type: token.tokenType,
         ...(token.expiresAt ? { expires_at: token.expiresAt.toISOString() } : {}),
         scope: grantedScopes.join(" "),
-        token_endpoint: preset.oauth.tokenUrl,
+        token_endpoint: definition.authentication.tokenUrl,
         client_id: client.clientId,
         ...(client.clientSecret
           ? {
@@ -329,13 +329,13 @@ export async function completeApiIntegrationProviderOAuth(
     const metadata = ApiIntegrationOAuthConnectionMetadata.parse({
       ...(existing?.metadata ?? {}),
       credentialRole: API_INTEGRATION_OAUTH_CREDENTIAL_ROLE,
-      providerFamily: preset.family,
+      providerFamily: definition.provider.id,
       providerPrincipalId: identity.principalId,
       providerEmail: identity.email,
       providerDisplayName: identity.displayName,
-      authorizedPresetIds: uniqueStrings([
-        ...(existingMetadata?.authorizedPresetIds ?? []),
-        preset.id,
+      authorizedDefinitionIds: uniqueStrings([
+        ...(existingMetadata?.authorizedDefinitionIds ?? []),
+        definition.id,
       ]),
       verifiedAt: new Date().toISOString(),
     });
@@ -354,7 +354,7 @@ export async function completeApiIntegrationProviderOAuth(
       createdBySubjectId: state.subjectId,
       updatedBySubjectId: state.subjectId,
       credentialRole: API_INTEGRATION_OAUTH_CREDENTIAL_ROLE,
-      providerFamily: preset.family,
+      providerFamily: definition.provider.id,
       providerPrincipalId: identity.principalId,
       ...(state.connectionId
         ? {
@@ -366,7 +366,7 @@ export async function completeApiIntegrationProviderOAuth(
     if (!connection) throw new ProviderOAuthCallbackError("connection_conflict");
     return {
       redirectTo: providerOAuthReturnUrl(returnBaseUrl, state.returnPath, "success", {
-        presetId: preset.id,
+        definitionId: definition.id,
         connectionId: connection.id,
         providerDomain: connection.providerDomain,
         ownership: state.ownership,
@@ -379,7 +379,7 @@ export async function completeApiIntegrationProviderOAuth(
         state?.returnPath ?? "/integrations",
         "error",
         {
-          ...(state?.presetId ? { presetId: state.presetId } : {}),
+          ...(state?.definitionId ? { definitionId: state.definitionId } : {}),
           reason: providerOAuthFailureReason(error),
         },
       ),
@@ -387,39 +387,18 @@ export async function completeApiIntegrationProviderOAuth(
   }
 }
 
-function requiredPreset(id: string): OpenApiProviderPreset {
-  const preset = providerPresetById(id);
-  if (!preset) throw new HTTPException(404, { message: "Unknown Integration preset" });
-  return preset;
+function requiredDefinition(id: string): IntegrationDefinition {
+  const definition = integrationDefinitionById(id);
+  if (!definition) throw new HTTPException(404, { message: "Unknown Integration definition" });
+  return definition;
 }
 
-export function isApiIntegrationProviderOAuthState(
-  value: string | undefined,
+function providerClientForDefinition(
   settings: Settings,
-): boolean {
-  try {
-    readProviderOAuthState(value, settings);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function providerOAuthCallbackPath(preset: OpenApiProviderPreset): string {
-  // The existing Google OAuth client is already registered against this
-  // loopback callback. Keep that stable while the handler below distinguishes
-  // legacy Drive state from the protocol-neutral provider state.
-  return preset.family === "google"
-    ? "/v1/integrations/google-drive/callback"
-    : PROVIDER_OAUTH_CALLBACK_PATH;
-}
-
-function providerClientForPreset(
-  settings: Settings,
-  preset: OpenApiProviderPreset,
+  definition: IntegrationDefinition,
 ): ProviderOAuthClient {
   const configured = parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
-  const candidates = providerClientKeys(preset);
+  const candidates = providerClientKeys(definition);
   let entry: IntegrationOAuthClientConfig | undefined;
   for (const candidate of candidates) {
     entry = configured[candidate] ?? configured[candidate.replace(/\/+$/, "")];
@@ -433,7 +412,7 @@ function providerClientForPreset(
   }
   if (
     !entry &&
-    preset.family === "google" &&
+    definition.provider.id === "google" &&
     settings.googleDriveClientId?.trim() &&
     settings.googleDriveClientSecret?.trim()
   ) {
@@ -445,7 +424,7 @@ function providerClientForPreset(
   }
   if (!entry) {
     throw new HTTPException(503, {
-      message: `${preset.name} requires an operator OAuth client configuration`,
+      message: `${definition.name} requires an operator OAuth client configuration`,
     });
   }
   return {
@@ -455,15 +434,15 @@ function providerClientForPreset(
   };
 }
 
-function providerClientKeys(preset: OpenApiProviderPreset): string[] {
-  const authorization = new URL(preset.oauth.authorizationUrl);
-  const token = new URL(preset.oauth.tokenUrl);
+function providerClientKeys(definition: IntegrationDefinition): string[] {
+  const authorization = new URL(definition.authentication.authorizationUrl);
+  const token = new URL(definition.authentication.tokenUrl);
   return uniqueStrings([
-    preset.oauth.authorizationUrl,
+    definition.authentication.authorizationUrl,
     authorization.origin,
-    preset.oauth.tokenUrl,
+    definition.authentication.tokenUrl,
     token.origin,
-    ...(preset.family === "google"
+    ...(definition.provider.id === "google"
       ? ["https://accounts.google.com"]
       : [
           "https://login.microsoftonline.com/common/v2.0",
@@ -473,16 +452,16 @@ function providerClientKeys(preset: OpenApiProviderPreset): string[] {
   ]);
 }
 
-function providerPresetFingerprint(preset: OpenApiProviderPreset): string {
+function providerDefinitionFingerprint(definition: IntegrationDefinition): string {
   return createHash("sha256")
     .update(
       JSON.stringify({
-        id: preset.id,
-        family: preset.family,
-        baseUrl: preset.baseUrl,
-        authorizationUrl: preset.oauth.authorizationUrl,
-        tokenUrl: preset.oauth.tokenUrl,
-        scopes: [...preset.oauth.scopes],
+        id: definition.id,
+        provider: definition.provider,
+        baseUrl: definition.baseUrl,
+        authorizationUrl: definition.authentication.authorizationUrl,
+        tokenUrl: definition.authentication.tokenUrl,
+        scopes: [...definition.authentication.scopes],
       }),
     )
     .digest("hex");
@@ -524,8 +503,8 @@ function readProviderOAuthState(raw: string | undefined, settings: Settings): Pr
     workspaceId: requiredStateString(payload.workspaceId),
     subjectId: requiredStateString(payload.subjectId),
     ownership,
-    presetId: requiredStateString(payload.presetId),
-    presetFingerprint: requiredStateString(payload.presetFingerprint),
+    definitionId: requiredStateString(payload.definitionId),
+    definitionFingerprint: requiredStateString(payload.definitionFingerprint),
     providerDomain: requiredStateString(payload.providerDomain),
     authorizeScopes,
     encryptedPkceVerifier: requiredStateString(payload.encryptedPkceVerifier),
@@ -543,7 +522,7 @@ function readProviderOAuthState(raw: string | undefined, settings: Settings): Pr
 
 async function exchangeProviderAuthorizationCode(
   deps: ApiRouteDeps,
-  preset: OpenApiProviderPreset,
+  definition: IntegrationDefinition,
   client: ProviderOAuthClient,
   input: { code: string; verifier: string; redirectUri: string },
 ): Promise<ProviderToken> {
@@ -565,7 +544,7 @@ async function exchangeProviderAuthorizationCode(
   } else {
     body.set("client_id", client.clientId);
   }
-  const response = await providerFetch(deps, preset.oauth.tokenUrl, {
+  const response = await providerFetch(deps, definition.authentication.tokenUrl, {
     method: "POST",
     headers,
     body,
@@ -577,7 +556,7 @@ async function exchangeProviderAuthorizationCode(
   const payload = await readResponseJsonBounded<Record<string, unknown>>(
     response,
     OAUTH_MAX_RESPONSE_BYTES,
-    `${preset.name} OAuth token response`,
+    `${definition.name} OAuth token response`,
   ).catch(() => {
     throw new ProviderOAuthCallbackError("token_exchange_failed");
   });
@@ -597,10 +576,10 @@ async function exchangeProviderAuthorizationCode(
 
 async function verifyProviderIdentity(
   deps: ApiRouteDeps,
-  preset: OpenApiProviderPreset,
+  definition: IntegrationDefinition,
   token: ProviderToken,
 ): Promise<ProviderIdentity> {
-  const url = preset.family === "google" ? GOOGLE_USERINFO_URL : MICROSOFT_USERINFO_URL;
+  const url = definition.provider.id === "google" ? GOOGLE_USERINFO_URL : MICROSOFT_USERINFO_URL;
   const response = await providerFetch(deps, url, {
     headers: {
       accept: "application/json",
@@ -614,11 +593,11 @@ async function verifyProviderIdentity(
   const payload = await readResponseJsonBounded<Record<string, unknown>>(
     response,
     OAUTH_MAX_RESPONSE_BYTES,
-    `${preset.name} identity response`,
+    `${definition.name} identity response`,
   ).catch(() => {
     throw new ProviderOAuthCallbackError("identity_verification_failed");
   });
-  if (preset.family === "google") {
+  if (definition.provider.id === "google") {
     const principalId = optionalString(payload.sub);
     if (!principalId) throw new ProviderOAuthCallbackError("identity_verification_failed");
     return {
@@ -683,7 +662,7 @@ function requireProviderOAuthConnection(
   input: {
     subjectId: string;
     providerDomain: string;
-    providerFamily: OpenApiProviderPreset["family"];
+    providerFamily: IntegrationDefinition["provider"]["id"];
   },
 ) {
   const metadata = ApiIntegrationOAuthConnectionMetadata.safeParse(connection.metadata);
@@ -695,22 +674,22 @@ function requireProviderOAuthConnection(
     metadata.data.providerFamily !== input.providerFamily
   ) {
     throw new HTTPException(422, {
-      message: "Connection is not compatible with this Integration preset",
+      message: "Connection is not compatible with this Integration definition",
     });
   }
   return metadata.data;
 }
 
 function providerScopesInclude(
-  preset: OpenApiProviderPreset,
+  definition: IntegrationDefinition,
   returnedScopes: string[],
   fallbackScopes: string[],
 ): boolean {
   const effective = returnedScopes.length > 0 ? returnedScopes : fallbackScopes;
   const normalize = (value: string) =>
-    preset.family === "microsoft" ? value.toLowerCase() : value;
+    definition.provider.id === "microsoft" ? value.toLowerCase() : value;
   const granted = new Set(effective.map(normalize));
-  return preset.oauth.scopes.every((scope) => granted.has(normalize(scope)));
+  return definition.authentication.scopes.every((scope) => granted.has(normalize(scope)));
 }
 
 function providerOAuthReturnUrl(