@owox/backend 0.37.0 → 0.39.0

package/dist/src/plugin-host/services/plugin-action-starter.service.js

@@ -0,0 +1,81 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PluginActionStarterService = void 0;
+const common_1 = require("@nestjs/common");
+const plugin_action_limits_1 = require("../constants/plugin-action-limits");
+const plugin_action_execution_status_enum_1 = require("../enums/plugin-action-execution-status.enum");
+const plugin_action_errors_1 = require("../errors/plugin-action.errors");
+const execution_token_util_1 = require("../utils/execution-token.util");
+const json_shape_util_1 = require("../utils/json-shape.util");
+const plugin_manifest_util_1 = require("../utils/plugin-manifest.util");
+const action_input_validator_service_1 = require("./action-input-validator.service");
+const plugin_action_dispatcher_service_1 = require("./plugin-action-dispatcher.service");
+const plugin_action_execution_service_1 = require("./plugin-action-execution.service");
+let PluginActionStarterService = class PluginActionStarterService {
+    validator;
+    executions;
+    dispatcher;
+    constructor(validator, executions, dispatcher) {
+        this.validator = validator;
+        this.executions = executions;
+        this.dispatcher = dispatcher;
+    }
+    async start(request) {
+        const { installation, version, action } = request;
+        if (!version.backend || !Object.hasOwn(version.backend.actions, action)) {
+            throw new plugin_action_errors_1.ActionNotDeclaredError(action);
+        }
+        const declaration = version.backend.actions[action];
+        const input = request.input ?? null;
+        const shapeProblem = (0, json_shape_util_1.findJsonShapeProblem)(input);
+        if (shapeProblem) {
+            throw new plugin_action_errors_1.ActionInputInvalidError([{ instancePath: '', message: shapeProblem }]);
+        }
+        const inputBytes = input === null ? 0 : Buffer.byteLength(JSON.stringify(input));
+        if (inputBytes > plugin_action_limits_1.PLUGIN_ACTION_LIMITS.maxInputBytes) {
+            throw new plugin_action_errors_1.ActionInputTooLargeError();
+        }
+        await this.executions.assertWithinStartLimits(installation.id, Date.now());
+        if (declaration.input) {
+            const errors = await this.validator.validate(version.id, action, declaration.input, input);
+            if (errors.length > 0) {
+                throw new plugin_action_errors_1.ActionInputInvalidError(errors);
+            }
+        }
+        const backendUrl = (0, plugin_manifest_util_1.resolveBackendUrl)(version.backend, version.deliveryUrl);
+        const { token, tokenHash } = (0, execution_token_util_1.createExecutionToken)();
+        const execution = await this.executions.insertRunning({
+            pluginId: version.pluginId,
+            pluginVersionId: version.id,
+            installationId: installation.id,
+            projectId: installation.projectId,
+            userId: installation.userId,
+            action,
+            input,
+            inputBytes,
+            role: request.role,
+            timeoutSeconds: declaration.timeoutSeconds,
+            tokenHash,
+            trigger: request.trigger,
+        });
+        void this.dispatcher.dispatch(execution, backendUrl, token, declaration.timeoutSeconds);
+        return { id: execution.id, status: plugin_action_execution_status_enum_1.PluginActionExecutionStatus.RUNNING };
+    }
+};
+exports.PluginActionStarterService = PluginActionStarterService;
+exports.PluginActionStarterService = PluginActionStarterService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [action_input_validator_service_1.ActionInputValidatorService,
+        plugin_action_execution_service_1.PluginActionExecutionService,
+        plugin_action_dispatcher_service_1.PluginActionDispatcherService])
+], PluginActionStarterService);
+//# sourceMappingURL=plugin-action-starter.service.js.map

package/dist/src/plugin-host/services/plugin-audit.service.d.ts

@@ -3,6 +3,17 @@ import { OwoxEventDispatcher } from '../../common/event-dispatcher/owox-event-di
 import { PluginAuditEvent } from '../entities/plugin-audit-event.entity';
 import { PluginAuditAction } from '../enums/plugin-audit-action.enum';
 import { PluginPublicationScope } from '../enums/plugin-publication-scope.enum';
+export interface PluginHistoryQuery {
+    readonly projectId: string;
+    readonly userId: string;
+    readonly installations: boolean;
+    readonly publications: boolean;
+    readonly changes: boolean;
+    readonly deploymentPluginIds: readonly string[];
+    readonly relevantPluginIds: readonly string[];
+    readonly afterId: string | null;
+    readonly take: number;
+}
 export interface PluginAuditRecord {
     readonly pluginId: string;
     readonly action: PluginAuditAction;
@@ -19,4 +30,6 @@ export declare class PluginAuditService {
     private readonly logger;
     constructor(repository: Repository<PluginAuditEvent>, eventDispatcher: OwoxEventDispatcher);
     record(entry: PluginAuditRecord): Promise<void>;
+    exists(id: string): Promise<boolean>;
+    findHistory(query: PluginHistoryQuery): Promise<PluginAuditEvent[]>;
 }

package/dist/src/plugin-host/services/plugin-audit.service.js

@@ -19,7 +19,20 @@ const typeorm_1 = require("@nestjs/typeorm");
 const typeorm_2 = require("typeorm");
 const owox_event_dispatcher_1 = require("../../common/event-dispatcher/owox-event-dispatcher");
 const plugin_audit_event_entity_1 = require("../entities/plugin-audit-event.entity");
+const plugin_audit_action_enum_1 = require("../enums/plugin-audit-action.enum");
+const plugin_publication_scope_enum_1 = require("../enums/plugin-publication-scope.enum");
 const plugin_lifecycle_event_1 = require("../events/plugin-lifecycle.event");
+const INSTALLATION_ACTIONS = [
+    plugin_audit_action_enum_1.PluginAuditAction.INSTALL,
+    plugin_audit_action_enum_1.PluginAuditAction.RESTORE,
+    plugin_audit_action_enum_1.PluginAuditAction.UNINSTALL,
+];
+const PUBLICATION_ACTIONS = [plugin_audit_action_enum_1.PluginAuditAction.PUBLISH, plugin_audit_action_enum_1.PluginAuditAction.UNPUBLISH];
+const CHANGE_ACTIONS = [
+    plugin_audit_action_enum_1.PluginAuditAction.UPDATE,
+    plugin_audit_action_enum_1.PluginAuditAction.SUSPEND,
+    plugin_audit_action_enum_1.PluginAuditAction.RESUME,
+];
 let PluginAuditService = PluginAuditService_1 = class PluginAuditService {
     repository;
     eventDispatcher;
@@ -53,6 +66,71 @@ let PluginAuditService = PluginAuditService_1 = class PluginAuditService {
             this.logger.warn(`Audit event for plugin ${entry.pluginId} was not published: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
+    exists(id) {
+        return this.repository.existsBy({ id });
+    }
+    findHistory(query) {
+        const builder = this.repository
+            .createQueryBuilder('event')
+            .where(new typeorm_2.Brackets(visible => {
+            if (query.installations) {
+                visible.orWhere(new typeorm_2.Brackets(own => own
+                    .where('event.action IN (:...installationActions)', {
+                    installationActions: INSTALLATION_ACTIONS,
+                })
+                    .andWhere('event.projectId = :projectId')
+                    .andWhere('event.userId = :userId')));
+            }
+            if (query.publications) {
+                visible.orWhere(new typeorm_2.Brackets(project => project
+                    .where('event.action IN (:...publicationActions)')
+                    .andWhere('event.authorityScope = :projectScope', {
+                    projectScope: plugin_publication_scope_enum_1.PluginPublicationScope.PROJECT,
+                })
+                    .andWhere('event.projectId = :projectId')));
+                visible.orWhere(new typeorm_2.Brackets(member => member
+                    .where('event.action IN (:...publicationActions)')
+                    .andWhere('event.authorityScope = :memberScope', {
+                    memberScope: plugin_publication_scope_enum_1.PluginPublicationScope.MEMBER,
+                })
+                    .andWhere('event.projectId = :projectId')
+                    .andWhere('event.userId = :userId')));
+                if (query.deploymentPluginIds.length > 0) {
+                    visible.orWhere(new typeorm_2.Brackets(deployment => deployment
+                        .where('event.action IN (:...publicationActions)')
+                        .andWhere('event.authorityScope = :deploymentScope', {
+                        deploymentScope: plugin_publication_scope_enum_1.PluginPublicationScope.DEPLOYMENT,
+                    })
+                        .andWhere('event.pluginId IN (:...deploymentPluginIds)', {
+                        deploymentPluginIds: query.deploymentPluginIds,
+                    })));
+                }
+            }
+            if (query.changes && query.relevantPluginIds.length > 0) {
+                visible.orWhere(new typeorm_2.Brackets(change => change
+                    .where('event.action IN (:...changeActions)', { changeActions: CHANGE_ACTIONS })
+                    .andWhere('event.pluginId IN (:...relevantPluginIds)', {
+                    relevantPluginIds: query.relevantPluginIds,
+                })));
+            }
+        }))
+            .setParameters({
+            projectId: query.projectId,
+            userId: query.userId,
+            publicationActions: PUBLICATION_ACTIONS,
+        });
+        if (query.afterId) {
+            const anchor = '(SELECT anchor.createdAt FROM plugin_audit_event anchor WHERE anchor.id = :afterId)';
+            builder.andWhere(new typeorm_2.Brackets(after => after
+                .where(`event.createdAt < ${anchor}`)
+                .orWhere(new typeorm_2.Brackets(tie => tie.where(`event.createdAt = ${anchor}`).andWhere('event.id < :afterId')))), { afterId: query.afterId });
+        }
+        return builder
+            .orderBy('event.createdAt', 'DESC')
+            .addOrderBy('event.id', 'DESC')
+            .limit(query.take)
+            .getMany();
+    }
 };
 exports.PluginAuditService = PluginAuditService;
 exports.PluginAuditService = PluginAuditService = PluginAuditService_1 = __decorate([

package/dist/src/plugin-host/services/plugin-publication.service.d.ts

@@ -22,8 +22,12 @@ export declare class PluginPublicationService {
     addToAudience(publicationId: string, projectIds: string[]): Promise<void>;
     removeFromAudience(publicationId: string, projectIds?: string[]): Promise<void>;
     findVisibleTo(projectId: string, userId: string): Promise<PluginPublication[]>;
+    findEverVisibleTo(projectId: string, userId: string): Promise<PluginPublication[]>;
+    private visibleTo;
+    findDeploymentPluginIdByRepo(projectId: string, owner: string, name: string): Promise<string | null>;
     listManageable(scope: PluginPublicationScope, filters: {
         projectId?: string;
         userId?: string;
     }): Promise<PluginPublication[]>;
+    private deploymentVisibleToProject;
 }

package/dist/src/plugin-host/services/plugin-publication.service.js

@@ -18,6 +18,7 @@ const typeorm_1 = require("@nestjs/typeorm");
 const typeorm_2 = require("typeorm");
 const plugin_publication_project_entity_1 = require("../entities/plugin-publication-project.entity");
 const plugin_publication_entity_1 = require("../entities/plugin-publication.entity");
+const plugin_entity_1 = require("../entities/plugin.entity");
 const plugin_publication_scope_enum_1 = require("../enums/plugin-publication-scope.enum");
 let PluginPublicationService = class PluginPublicationService {
     publications;
@@ -64,27 +65,15 @@ let PluginPublicationService = class PluginPublicationService {
         await this.audiences.update(projectIds ? { publicationId, projectId: (0, typeorm_2.In)(projectIds) } : { publicationId }, { isActive: false });
     }
     findVisibleTo(projectId, userId) {
-        return this.publications
-            .createQueryBuilder('publication')
-            .where('publication.isActive = :isActive', { isActive: true })
-            .andWhere(new typeorm_2.Brackets(scopes => {
+        return this.visibleTo(projectId, userId, true).getMany();
+    }
+    findEverVisibleTo(projectId, userId) {
+        return this.visibleTo(projectId, userId, false).getMany();
+    }
+    visibleTo(projectId, userId, activeOnly) {
+        const query = this.publications.createQueryBuilder('publication').where(new typeorm_2.Brackets(scopes => {
             scopes
-                .where(new typeorm_2.Brackets(deployment => {
-                deployment
-                    .where('publication.scope = :deploymentScope', {
-                    deploymentScope: plugin_publication_scope_enum_1.PluginPublicationScope.DEPLOYMENT,
-                })
-                    .andWhere(new typeorm_2.Brackets(audience => {
-                    audience
-                        .where('publication.allProjects = :isActive', { isActive: true })
-                        .orWhere(`EXISTS (
-                            SELECT 1 FROM plugin_publication_project audience_row
-                            WHERE audience_row.publicationId = publication.id
-                              AND audience_row.projectId = :projectId
-                              AND audience_row.isActive = :isActive
-                          )`);
-                }));
-            }))
+                .where(this.deploymentVisibleToProject(projectId, activeOnly))
                 .orWhere(new typeorm_2.Brackets(project => {
                 project
                     .where('publication.scope = :projectScope', {
@@ -100,9 +89,25 @@ let PluginPublicationService = class PluginPublicationService {
                     .andWhere('publication.projectId = :projectId')
                     .andWhere('publication.userId = :userId');
             }));
-        }))
-            .setParameters({ projectId, userId })
-            .getMany();
+        }));
+        if (activeOnly) {
+            query.andWhere('publication.isActive = :isActive', { isActive: true });
+        }
+        return query.setParameters({ projectId, userId });
+    }
+    async findDeploymentPluginIdByRepo(projectId, owner, name) {
+        const publication = await this.publications
+            .createQueryBuilder('publication')
+            .innerJoin(plugin_entity_1.Plugin, 'plugin', 'plugin.id = publication.pluginId')
+            .where('publication.isActive = :isActive', { isActive: true })
+            .andWhere(this.deploymentVisibleToProject(projectId))
+            .andWhere('LOWER(plugin.repoOwner) = :owner', { owner: owner.toLowerCase() })
+            .andWhere('LOWER(plugin.repoName) = :name', { name: name.toLowerCase() })
+            .andWhere('plugin.isPrivateRepo = :isPrivate', { isPrivate: false })
+            .orderBy('plugin.modifiedAt', 'DESC')
+            .addOrderBy('plugin.id', 'ASC')
+            .getOne();
+        return publication?.pluginId ?? null;
     }
     listManageable(scope, filters) {
         return this.publications.findBy({
@@ -111,6 +116,29 @@ let PluginPublicationService = class PluginPublicationService {
             ...(filters.userId ? { userId: filters.userId } : {}),
         });
     }
+    deploymentVisibleToProject(projectId, activeAudienceOnly = true) {
+        const activeAudience = activeAudienceOnly
+            ? 'AND audience_row.isActive = :deploymentAudienceActive'
+            : '';
+        return new typeorm_2.Brackets(deployment => {
+            deployment
+                .where('publication.scope = :deploymentScope', {
+                deploymentScope: plugin_publication_scope_enum_1.PluginPublicationScope.DEPLOYMENT,
+            })
+                .andWhere(new typeorm_2.Brackets(audience => {
+                audience
+                    .where('publication.allProjects = :deploymentAllProjects', {
+                    deploymentAllProjects: true,
+                })
+                    .orWhere(`EXISTS (
+                SELECT 1 FROM plugin_publication_project audience_row
+                WHERE audience_row.publicationId = publication.id
+                  AND audience_row.projectId = :deploymentProjectId
+                  ${activeAudience}
+              )`, { deploymentProjectId: projectId, deploymentAudienceActive: true });
+            }));
+        });
+    }
 };
 exports.PluginPublicationService = PluginPublicationService;
 exports.PluginPublicationService = PluginPublicationService = __decorate([

package/dist/src/plugin-host/services/plugin-runtime-authorizer.service.d.ts

@@ -1,7 +1,10 @@
-import { PluginRuntimeAuthorizerPort, PluginRuntimeIdentity } from '../../idp/ports/plugin-runtime-authorizer.port';
+import { PluginExecutionIdentity, PluginRuntimeAuthorizerPort, PluginRuntimeIdentity } from '../../idp/ports/plugin-runtime-authorizer.port';
 import { PluginInstallationLookupPort } from '../facades/plugin-installation-lookup.facade';
+import { PluginActionExecutionService } from './plugin-action-execution.service';
 export declare class PluginRuntimeAuthorizerService implements PluginRuntimeAuthorizerPort {
     private readonly installations;
-    constructor(installations: PluginInstallationLookupPort);
+    private readonly executions;
+    constructor(installations: PluginInstallationLookupPort, executions: PluginActionExecutionService);
     assertActiveInstallation(identity: PluginRuntimeIdentity): Promise<void>;
+    resolveExecutionToken(token: string): Promise<PluginExecutionIdentity | null>;
 }

package/dist/src/plugin-host/services/plugin-runtime-authorizer.service.js

@@ -16,27 +16,55 @@ exports.PluginRuntimeAuthorizerService = void 0;
 const common_1 = require("@nestjs/common");
 const idp_protocol_1 = require("@owox/idp-protocol");
 const plugin_installation_lookup_facade_1 = require("../facades/plugin-installation-lookup.facade");
+const plugin_host_errors_1 = require("../errors/plugin-host.errors");
+const execution_token_util_1 = require("../utils/execution-token.util");
+const plugin_action_execution_service_1 = require("./plugin-action-execution.service");
 let PluginRuntimeAuthorizerService = class PluginRuntimeAuthorizerService {
     installations;
-    constructor(installations) {
+    executions;
+    constructor(installations, executions) {
         this.installations = installations;
+        this.executions = executions;
     }
     async assertActiveInstallation(identity) {
         const installation = await this.installations.findSnapshot(identity.installationId);
         if (!installation ||
             !installation.isActive ||
-            installation.isSuspended ||
             installation.pluginId !== identity.pluginId ||
             installation.projectId !== identity.projectId ||
             installation.userId !== identity.userId) {
             throw new idp_protocol_1.AuthorizationError('Plugin runtime access denied');
         }
+        if (installation.isSuspended) {
+            throw new plugin_host_errors_1.PluginSuspendedError(installation.pluginId);
+        }
+    }
+    async resolveExecutionToken(token) {
+        if (!token) {
+            return null;
+        }
+        const execution = await this.executions.findRunningByTokenHash((0, execution_token_util_1.hashExecutionToken)(token), new Date());
+        if (!execution) {
+            return null;
+        }
+        const role = idp_protocol_1.RoleEnum.safeParse(execution.role);
+        if (!role.success) {
+            return null;
+        }
+        return {
+            executionId: execution.id,
+            pluginId: execution.pluginId,
+            installationId: execution.installationId,
+            projectId: execution.projectId,
+            userId: execution.userId,
+            role: role.data,
+        };
     }
 };
 exports.PluginRuntimeAuthorizerService = PluginRuntimeAuthorizerService;
 exports.PluginRuntimeAuthorizerService = PluginRuntimeAuthorizerService = __decorate([
     (0, common_1.Injectable)(),
     __param(0, (0, common_1.Inject)(plugin_installation_lookup_facade_1.PLUGIN_INSTALLATION_LOOKUP)),
-    __metadata("design:paramtypes", [Object])
+    __metadata("design:paramtypes", [Object, plugin_action_execution_service_1.PluginActionExecutionService])
 ], PluginRuntimeAuthorizerService);
 //# sourceMappingURL=plugin-runtime-authorizer.service.js.map

package/dist/src/plugin-host/services/plugin-version.service.d.ts

@@ -1,7 +1,7 @@
 import { DataSource, Repository } from 'typeorm';
 import { PluginVersion } from '../entities/plugin-version.entity';
 import { Plugin } from '../entities/plugin.entity';
-import type { PluginCollectionDeclaration } from '../utils/plugin-manifest.util';
+import type { PluginBackendDeclaration, PluginCollectionDeclaration } from '../utils/plugin-manifest.util';
 import type { StoredCredentialRequirement } from '../../data-marts/credentials/credential.types';
 export interface InsertPluginVersionInput {
     readonly pluginId: string;
@@ -14,6 +14,7 @@ export interface InsertPluginVersionInput {
     readonly deliveryUrl: string;
     readonly collections: readonly PluginCollectionDeclaration[];
     readonly credentialRequirements: readonly StoredCredentialRequirement[];
+    readonly backend: PluginBackendDeclaration | null;
     readonly releasePublishedAt: Date | null;
 }
 export declare class PluginVersionService {

package/dist/src/plugin-host/services/release-candidate-rules.service.d.ts

@@ -0,0 +1,51 @@
+import type { StoredCredentialRequirement } from '../../data-marts/credentials/credential.types';
+import { ReleaseRejectionCode } from '../enums/release-rejection-code.enum';
+import { GithubRepoRef } from '../utils/github-repo-locator.util';
+import { PluginManifest } from '../utils/plugin-manifest.util';
+import { ActionInputValidatorService } from './action-input-validator.service';
+import { ExternalCredentialDefinitionSyncService } from './external-credential-definition-sync.service';
+import { GithubApiService } from './github-api.service';
+import { PluginVersionService } from './plugin-version.service';
+import { RemoteUrlValidatorService } from './remote-url-validator.service';
+export interface ReleaseCandidate {
+    readonly pluginId: string;
+    readonly ref: GithubRepoRef;
+    readonly commitSha: string;
+    readonly semver: string | null;
+}
+export interface ReleaseCandidateIssue {
+    readonly code: ReleaseRejectionCode;
+    readonly detail: string;
+}
+type Rejection = {
+    readonly ok: false;
+} & ReleaseCandidateIssue;
+export type ReleaseCandidateVerdict = {
+    readonly ok: true;
+    readonly manifest: PluginManifest;
+    readonly credentialRequirements: readonly StoredCredentialRequirement[];
+} | Rejection;
+export interface ReleaseCandidateReport {
+    readonly issues: readonly ReleaseCandidateIssue[];
+    readonly baselineSemver: string | null;
+    readonly collectionsEvaluated: boolean;
+}
+export declare class ReleaseCandidateRulesService {
+    private readonly githubApi;
+    private readonly remoteUrlValidator;
+    private readonly versionService;
+    private readonly inputValidator;
+    private readonly externalCredentialDefinitions?;
+    constructor(githubApi: GithubApiService, remoteUrlValidator: RemoteUrlValidatorService, versionService: PluginVersionService, inputValidator: ActionInputValidatorService, externalCredentialDefinitions?: ExternalCredentialDefinitionSyncService | undefined);
+    firstFailure(candidate: ReleaseCandidate): Promise<ReleaseCandidateVerdict>;
+    collectAll(candidate: ReleaseCandidate): Promise<ReleaseCandidateReport>;
+    private fetchManifest;
+    private findBaseline;
+    private checkCollections;
+    private checkActions;
+    private checkBackendOrigin;
+    private lineIssue;
+    private checkBackendUrl;
+    private resolveCredentialRequirements;
+}
+export {};

package/dist/src/plugin-host/services/release-candidate-rules.service.js

@@ -0,0 +1,198 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReleaseCandidateRulesService = void 0;
+const common_1 = require("@nestjs/common");
+const internal_helpers_1 = require("@owox/internal-helpers");
+const release_rejection_code_enum_1 = require("../enums/release-rejection-code.enum");
+const plugin_manifest_util_1 = require("../utils/plugin-manifest.util");
+const semver_util_1 = require("../utils/semver.util");
+const action_input_validator_service_1 = require("./action-input-validator.service");
+const external_credential_definition_sync_service_1 = require("./external-credential-definition-sync.service");
+const github_api_service_1 = require("./github-api.service");
+const plugin_version_service_1 = require("./plugin-version.service");
+const remote_url_validator_service_1 = require("./remote-url-validator.service");
+let ReleaseCandidateRulesService = class ReleaseCandidateRulesService {
+    githubApi;
+    remoteUrlValidator;
+    versionService;
+    inputValidator;
+    externalCredentialDefinitions;
+    constructor(githubApi, remoteUrlValidator, versionService, inputValidator, externalCredentialDefinitions) {
+        this.githubApi = githubApi;
+        this.remoteUrlValidator = remoteUrlValidator;
+        this.versionService = versionService;
+        this.inputValidator = inputValidator;
+        this.externalCredentialDefinitions = externalCredentialDefinitions;
+    }
+    async firstFailure(candidate) {
+        const parsed = await this.fetchManifest(candidate);
+        if (!parsed.ok)
+            return parsed;
+        const { manifest } = parsed;
+        const baseline = await this.findBaseline(candidate);
+        const collections = baseline && this.checkCollections(baseline, manifest);
+        if (collections)
+            return { ok: false, ...collections };
+        const actions = baseline && this.checkActions(baseline, manifest);
+        if (actions)
+            return { ok: false, ...actions };
+        const backendOrigin = baseline && this.checkBackendOrigin(baseline, manifest);
+        if (backendOrigin)
+            return { ok: false, ...backendOrigin };
+        const delivery = await this.remoteUrlValidator.validate(manifest.delivery.url);
+        if (!delivery.ok)
+            return delivery;
+        const backendUrl = await this.checkBackendUrl(manifest);
+        if (backendUrl)
+            return { ok: false, ...backendUrl };
+        const credentials = await this.resolveCredentialRequirements(manifest, 'resolve');
+        if (!credentials.ok)
+            return credentials;
+        return { ok: true, manifest, credentialRequirements: credentials.requirements };
+    }
+    async collectAll(candidate) {
+        const parsed = await this.fetchManifest(candidate);
+        const baseline = await this.findBaseline(candidate);
+        const baselineSemver = baseline?.semver ?? null;
+        if (!parsed.ok) {
+            return {
+                issues: [{ code: parsed.code, detail: parsed.detail }],
+                baselineSemver,
+                collectionsEvaluated: false,
+            };
+        }
+        const { manifest } = parsed;
+        const issues = [];
+        const collections = baseline && this.checkCollections(baseline, manifest);
+        if (collections)
+            issues.push(collections);
+        const actions = baseline && this.checkActions(baseline, manifest);
+        if (actions)
+            issues.push(actions);
+        const backendOrigin = baseline && this.checkBackendOrigin(baseline, manifest);
+        if (backendOrigin)
+            issues.push(backendOrigin);
+        const delivery = await this.remoteUrlValidator.validate(manifest.delivery.url);
+        if (!delivery.ok)
+            issues.push({ code: delivery.code, detail: delivery.detail });
+        const backendUrl = await this.checkBackendUrl(manifest);
+        if (backendUrl)
+            issues.push(backendUrl);
+        const credentials = await this.resolveCredentialRequirements(manifest, 'preview');
+        if (!credentials.ok)
+            issues.push({ code: credentials.code, detail: credentials.detail });
+        return {
+            issues,
+            baselineSemver,
+            collectionsEvaluated: baseline !== undefined,
+        };
+    }
+    async fetchManifest({ ref, commitSha }) {
+        const parsed = (0, plugin_manifest_util_1.parsePluginManifest)(await this.githubApi.getFileAtCommit(ref, 'plugin.json', commitSha));
+        if (!parsed.ok)
+            return parsed;
+        const refusal = await this.inputValidator.compile((0, plugin_manifest_util_1.listActionInputSchemas)(parsed.manifest.backend));
+        return refusal
+            ? { ok: false, code: release_rejection_code_enum_1.ReleaseRejectionCode.ACTION_INPUT_UNSUPPORTED, detail: refusal }
+            : parsed;
+    }
+    async findBaseline({ pluginId, semver, }) {
+        if (semver === null)
+            return undefined;
+        return (await this.versionService.findAllByPluginId(pluginId))
+            .filter(version => (0, semver_util_1.sameCompatibilityLine)(version.semver, semver))
+            .reduce((highest, version) => (!highest || (0, semver_util_1.compareSemver)(version.semver, highest.semver) > 0 ? version : highest), undefined);
+    }
+    checkCollections(baseline, manifest) {
+        const incompatibility = (0, plugin_manifest_util_1.findIncompatibleCollectionChange)(baseline.collections ?? [], manifest.collections);
+        return incompatibility
+            ? this.lineIssue(release_rejection_code_enum_1.ReleaseRejectionCode.COLLECTIONS_INCOMPATIBLE, incompatibility, baseline)
+            : null;
+    }
+    checkActions(baseline, manifest) {
+        const incompatibility = (0, plugin_manifest_util_1.findIncompatibleActionChange)(baseline.backend, manifest.backend);
+        return incompatibility
+            ? this.lineIssue(release_rejection_code_enum_1.ReleaseRejectionCode.ACTIONS_INCOMPATIBLE, incompatibility, baseline)
+            : null;
+    }
+    checkBackendOrigin(baseline, manifest) {
+        if (!manifest.backend)
+            return null;
+        const origin = new URL((0, plugin_manifest_util_1.resolveBackendUrl)(manifest.backend, manifest.delivery.url)).origin;
+        const baselineOrigin = baseline.backend && new URL((0, plugin_manifest_util_1.resolveBackendUrl)(baseline.backend, baseline.deliveryUrl)).origin;
+        if (origin === baselineOrigin)
+            return null;
+        const change = baselineOrigin
+            ? `The backend cannot move from ${baselineOrigin} to ${origin}`
+            : `A backend on ${origin} cannot be added`;
+        return this.lineIssue(release_rejection_code_enum_1.ReleaseRejectionCode.BACKEND_ORIGIN_CHANGED, change, baseline);
+    }
+    lineIssue(code, incompatibility, baseline) {
+        const escape = (0, semver_util_1.majorOf)(baseline.semver) === 0
+            ? 'bump the minor version to ship this breaking change while below 1.0.0'
+            : 'publish a new major version to ship this breaking change';
+        return {
+            code,
+            detail: `${incompatibility} within the ${baseline.semver} compatibility line; ${escape}`,
+        };
+    }
+    async checkBackendUrl(manifest) {
+        if (!manifest.backend)
+            return null;
+        const checked = await this.remoteUrlValidator.checkPublicHttps((0, plugin_manifest_util_1.resolveBackendUrl)(manifest.backend, manifest.delivery.url));
+        return checked.ok ? null : { code: checked.code, detail: `backend.url: ${checked.detail}` };
+    }
+    async resolveCredentialRequirements(manifest, mode) {
+        if (!manifest.credentials.some(externalLocator)) {
+            return { ok: true, requirements: manifest.credentials };
+        }
+        if (!this.externalCredentialDefinitions) {
+            throw new Error('External Credential definitions are not available');
+        }
+        try {
+            if (mode === 'preview') {
+                await this.externalCredentialDefinitions.previewRequirements(manifest.credentials);
+                return { ok: true, requirements: manifest.credentials };
+            }
+            return {
+                ok: true,
+                requirements: await this.externalCredentialDefinitions.resolveRequirements(manifest.credentials),
+            };
+        }
+        catch (error) {
+            if (!(error instanceof external_credential_definition_sync_service_1.ExternalCredentialRequirementError))
+                throw error;
+            return {
+                ok: false,
+                code: release_rejection_code_enum_1.ReleaseRejectionCode.MANIFEST_SCHEMA,
+                detail: (0, internal_helpers_1.castError)(error).message,
+            };
+        }
+    }
+};
+exports.ReleaseCandidateRulesService = ReleaseCandidateRulesService;
+exports.ReleaseCandidateRulesService = ReleaseCandidateRulesService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(4, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [github_api_service_1.GithubApiService,
+        remote_url_validator_service_1.RemoteUrlValidatorService,
+        plugin_version_service_1.PluginVersionService,
+        action_input_validator_service_1.ActionInputValidatorService,
+        external_credential_definition_sync_service_1.ExternalCredentialDefinitionSyncService])
+], ReleaseCandidateRulesService);
+function externalLocator(requirement) {
+    return (typeof requirement === 'string' ? requirement : requirement.id).startsWith('@');
+}
+//# sourceMappingURL=release-candidate-rules.service.js.map