@owox/backend 0.37.0 → 0.39.0

package/dist/src/plugin-host/use-cases/list-installations.service.js

@@ -13,6 +13,7 @@ exports.ListInstallationsService = void 0;
 const common_1 = require("@nestjs/common");
 const plugin_presentation_mapper_1 = require("../mappers/plugin-presentation.mapper");
 const plugin_installation_service_1 = require("../services/plugin-installation.service");
+const plugin_publication_service_1 = require("../services/plugin-publication.service");
 const plugin_version_service_1 = require("../services/plugin-version.service");
 const plugin_service_1 = require("../services/plugin.service");
 let ListInstallationsService = class ListInstallationsService {
@@ -20,11 +21,13 @@ let ListInstallationsService = class ListInstallationsService {
     pluginService;
     versionService;
     mapper;
-    constructor(installations, pluginService, versionService, mapper) {
+    publications;
+    constructor(installations, pluginService, versionService, mapper, publications) {
         this.installations = installations;
         this.pluginService = pluginService;
         this.versionService = versionService;
         this.mapper = mapper;
+        this.publications = publications;
     }
     async run(command) {
         const rows = await this.installations.findByMember(command.context.projectId, command.context.userId);
@@ -35,6 +38,13 @@ let ListInstallationsService = class ListInstallationsService {
         const pluginById = new Map(plugins.map(plugin => [plugin.id, plugin]));
         const versions = await this.versionService.findByIds(plugins.map(plugin => plugin.currentVersionId).filter(id => id !== null));
         const versionById = new Map(versions.map(version => [version.id, version]));
+        const listed = await this.publications.findVisibleTo(command.context.projectId, command.context.userId);
+        const scopesByPlugin = new Map();
+        for (const publication of listed) {
+            const scopes = scopesByPlugin.get(publication.pluginId) ?? new Set();
+            scopes.add(publication.scope);
+            scopesByPlugin.set(publication.pluginId, scopes);
+        }
         const entries = [];
         for (const row of visible) {
             const plugin = pluginById.get(row.pluginId);
@@ -43,7 +53,7 @@ let ListInstallationsService = class ListInstallationsService {
             }
             entries.push({
                 ...this.mapper.toMemberDto(plugin, plugin.currentVersionId ? (versionById.get(plugin.currentVersionId) ?? null) : null, {
-                    scopes: [],
+                    scopes: [...(scopesByPlugin.get(plugin.id) ?? [])],
                     installationState: row.uninstalledAt === null ? 'installed' : 'uninstalled',
                 }),
                 installationId: row.id,
@@ -60,6 +70,7 @@ exports.ListInstallationsService = ListInstallationsService = __decorate([
     __metadata("design:paramtypes", [plugin_installation_service_1.PluginInstallationService,
         plugin_service_1.PluginService,
         plugin_version_service_1.PluginVersionService,
-        plugin_presentation_mapper_1.PluginPresentationMapper])
+        plugin_presentation_mapper_1.PluginPresentationMapper,
+        plugin_publication_service_1.PluginPublicationService])
 ], ListInstallationsService);
 //# sourceMappingURL=list-installations.service.js.map

package/dist/src/plugin-host/use-cases/list-plugin-history.service.d.ts

@@ -0,0 +1,25 @@
+import { IdpProjectionsFacade } from '../../idp/facades/idp-projections.facade';
+import { ListPluginHistoryCommand } from '../dto/domain/list-plugin-history.command';
+import { PluginHistoryPageDto } from '../dto/domain/plugin-history.dto';
+import { PluginPresentationMapper } from '../mappers/plugin-presentation.mapper';
+import { PluginAuditService } from '../services/plugin-audit.service';
+import { PluginInstallationService } from '../services/plugin-installation.service';
+import { PluginPublicationService } from '../services/plugin-publication.service';
+import { PluginVersionService } from '../services/plugin-version.service';
+import { PluginService } from '../services/plugin.service';
+export declare class ListPluginHistoryService {
+    private readonly audit;
+    private readonly publications;
+    private readonly installations;
+    private readonly pluginService;
+    private readonly versionService;
+    private readonly mapper;
+    private readonly idpProjections;
+    constructor(audit: PluginAuditService, publications: PluginPublicationService, installations: PluginInstallationService, pluginService: PluginService, versionService: PluginVersionService, mapper: PluginPresentationMapper, idpProjections: IdpProjectionsFacade);
+    run(command: ListPluginHistoryCommand): Promise<PluginHistoryPageDto>;
+    private toItems;
+    private actorOf;
+    private isNameable;
+    private isNoOp;
+    private versionIdAfter;
+}

package/dist/src/plugin-host/use-cases/list-plugin-history.service.js

@@ -0,0 +1,147 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ListPluginHistoryService = void 0;
+const common_1 = require("@nestjs/common");
+const idp_projections_facade_1 = require("../../idp/facades/idp-projections.facade");
+const plugin_audit_action_enum_1 = require("../enums/plugin-audit-action.enum");
+const plugin_publication_scope_enum_1 = require("../enums/plugin-publication-scope.enum");
+const plugin_presentation_mapper_1 = require("../mappers/plugin-presentation.mapper");
+const plugin_audit_service_1 = require("../services/plugin-audit.service");
+const plugin_installation_service_1 = require("../services/plugin-installation.service");
+const plugin_publication_service_1 = require("../services/plugin-publication.service");
+const plugin_version_service_1 = require("../services/plugin-version.service");
+const plugin_service_1 = require("../services/plugin.service");
+const unique = (ids) => [...new Set(ids)];
+const isPublication = (row) => row.action === plugin_audit_action_enum_1.PluginAuditAction.PUBLISH || row.action === plugin_audit_action_enum_1.PluginAuditAction.UNPUBLISH;
+let ListPluginHistoryService = class ListPluginHistoryService {
+    audit;
+    publications;
+    installations;
+    pluginService;
+    versionService;
+    mapper;
+    idpProjections;
+    constructor(audit, publications, installations, pluginService, versionService, mapper, idpProjections) {
+        this.audit = audit;
+        this.publications = publications;
+        this.installations = installations;
+        this.pluginService = pluginService;
+        this.versionService = versionService;
+        this.mapper = mapper;
+        this.idpProjections = idpProjections;
+    }
+    async run(command) {
+        const { projectId, userId } = command.context;
+        if (command.cursor && !(await this.audit.exists(command.cursor))) {
+            throw new common_1.BadRequestException('cursor does not point to a plugin history entry');
+        }
+        const [listed, installed] = await Promise.all([
+            this.publications.findEverVisibleTo(projectId, userId),
+            this.installations.findByMember(projectId, userId),
+        ]);
+        const rows = await this.audit.findHistory({
+            projectId,
+            userId,
+            installations: command.type !== 'publications',
+            publications: command.type !== 'installations',
+            changes: command.type === 'all',
+            deploymentPluginIds: unique(listed
+                .filter(publication => publication.scope === plugin_publication_scope_enum_1.PluginPublicationScope.DEPLOYMENT)
+                .map(publication => publication.pluginId)),
+            relevantPluginIds: unique([...listed, ...installed].map(row => row.pluginId)),
+            afterId: command.cursor,
+            take: command.limit + 1,
+        });
+        const page = rows.slice(0, command.limit);
+        const items = await this.toItems(page, projectId, userId);
+        return {
+            items,
+            nextCursor: rows.length > command.limit ? page[page.length - 1].id : null,
+        };
+    }
+    async toItems(page, projectId, userId) {
+        const plugins = await this.pluginService.findByIds(unique(page.map(row => row.pluginId)));
+        const pluginById = new Map(plugins.map(plugin => [plugin.id, plugin]));
+        const versions = await this.versionService.findByIds(unique([
+            ...plugins.map(plugin => plugin.currentVersionId),
+            ...page.map(row => this.versionIdAfter(row)),
+        ].filter((id) => typeof id === 'string')));
+        const versionById = new Map(versions.map(version => [version.id, version]));
+        const namedIds = unique(page.filter(row => this.isNameable(row, projectId, userId)).map(row => row.userId));
+        const names = await this.idpProjections.getUserProjectionList(namedIds);
+        return page.flatMap(row => {
+            const plugin = pluginById.get(row.pluginId);
+            if (!plugin || this.isNoOp(row)) {
+                return [];
+            }
+            const versionId = this.versionIdAfter(row);
+            return [
+                {
+                    id: row.id,
+                    occurredAt: row.createdAt,
+                    action: row.action,
+                    scope: isPublication(row) ? row.authorityScope : null,
+                    plugin: this.mapper.toHistoryPlugin(plugin, plugin.currentVersionId ? (versionById.get(plugin.currentVersionId) ?? null) : null),
+                    actor: this.actorOf(row, projectId, userId, names),
+                    version: row.action === plugin_audit_action_enum_1.PluginAuditAction.UPDATE && versionId
+                        ? (versionById.get(versionId)?.semver ?? null)
+                        : null,
+                },
+            ];
+        });
+    }
+    actorOf(row, projectId, userId, names) {
+        if (row.action === plugin_audit_action_enum_1.PluginAuditAction.SUSPEND ||
+            row.action === plugin_audit_action_enum_1.PluginAuditAction.RESUME ||
+            (isPublication(row) && row.authorityScope === plugin_publication_scope_enum_1.PluginPublicationScope.DEPLOYMENT)) {
+            return { kind: 'deployment' };
+        }
+        if (row.userId === userId) {
+            return { kind: 'you' };
+        }
+        if (!this.isNameable(row, projectId, userId)) {
+            return null;
+        }
+        const projection = names.getByUserId(row.userId);
+        const name = projection?.fullName || projection?.email;
+        return name ? { kind: 'member', name } : null;
+    }
+    isNameable(row, projectId, userId) {
+        return (row.userId !== null &&
+            row.userId !== userId &&
+            row.projectId === projectId &&
+            row.authorityScope !== plugin_publication_scope_enum_1.PluginPublicationScope.DEPLOYMENT &&
+            row.action !== plugin_audit_action_enum_1.PluginAuditAction.SUSPEND &&
+            row.action !== plugin_audit_action_enum_1.PluginAuditAction.RESUME);
+    }
+    isNoOp(row) {
+        const uninstalled = row.beforeState?.uninstalled;
+        return ((row.action === plugin_audit_action_enum_1.PluginAuditAction.RESTORE && uninstalled === false) ||
+            (row.action === plugin_audit_action_enum_1.PluginAuditAction.UNINSTALL && uninstalled === true));
+    }
+    versionIdAfter(row) {
+        const id = row.afterState?.currentVersionId;
+        return typeof id === 'string' ? id : null;
+    }
+};
+exports.ListPluginHistoryService = ListPluginHistoryService;
+exports.ListPluginHistoryService = ListPluginHistoryService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [plugin_audit_service_1.PluginAuditService,
+        plugin_publication_service_1.PluginPublicationService,
+        plugin_installation_service_1.PluginInstallationService,
+        plugin_service_1.PluginService,
+        plugin_version_service_1.PluginVersionService,
+        plugin_presentation_mapper_1.PluginPresentationMapper,
+        idp_projections_facade_1.IdpProjectionsFacade])
+], ListPluginHistoryService);
+//# sourceMappingURL=list-plugin-history.service.js.map

package/dist/src/plugin-host/use-cases/plugin-publisher-access.d.ts

@@ -0,0 +1,5 @@
+import { AuthorizationContext } from '../../idp/types/auth.types';
+import { Plugin } from '../entities/plugin.entity';
+import { PluginPublicationService } from '../services/plugin-publication.service';
+export declare function managesPublicationOf(publications: PluginPublicationService, pluginId: string, context: AuthorizationContext): Promise<boolean>;
+export declare function visibleRepository(plugin: Plugin, repository: string, isPublisher: boolean): string;

package/dist/src/plugin-host/use-cases/plugin-publisher-access.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.managesPublicationOf = managesPublicationOf;
+exports.visibleRepository = visibleRepository;
+const plugin_publication_scope_enum_1 = require("../enums/plugin-publication-scope.enum");
+async function managesPublicationOf(publications, pluginId, context) {
+    const scopes = [];
+    if (context.roles?.includes('admin')) {
+        scopes.push(plugin_publication_scope_enum_1.PluginPublicationScope.PROJECT);
+    }
+    if (context.userId) {
+        scopes.push(plugin_publication_scope_enum_1.PluginPublicationScope.MEMBER);
+    }
+    for (const scope of scopes) {
+        const rows = await publications.listManageable(scope, {
+            projectId: context.projectId,
+            userId: scope === plugin_publication_scope_enum_1.PluginPublicationScope.MEMBER ? (context.userId ?? undefined) : undefined,
+        });
+        if (rows.some(row => row.pluginId === pluginId)) {
+            return true;
+        }
+    }
+    return false;
+}
+function visibleRepository(plugin, repository, isPublisher) {
+    return plugin.isPrivateRepo && !isPublisher ? `${plugin.repoOwner}/***` : repository;
+}
+//# sourceMappingURL=plugin-publisher-access.js.map

package/dist/src/plugin-host/use-cases/start-plugin-action-execution.service.d.ts

@@ -0,0 +1,12 @@
+import { StartPluginActionExecutionCommand } from '../dto/domain/plugin-action-execution.command';
+import type { StartedPluginActionExecution } from '../dto/domain/plugin-action-execution.dto';
+import { PluginActionStarterService } from '../services/plugin-action-starter.service';
+import { PluginVersionService } from '../services/plugin-version.service';
+import { PluginService } from '../services/plugin.service';
+export declare class StartPluginActionExecutionService {
+    private readonly plugins;
+    private readonly versions;
+    private readonly starter;
+    constructor(plugins: PluginService, versions: PluginVersionService, starter: PluginActionStarterService);
+    run(command: StartPluginActionExecutionCommand): Promise<StartedPluginActionExecution>;
+}

package/dist/src/plugin-host/use-cases/start-plugin-action-execution.service.js

@@ -0,0 +1,64 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StartPluginActionExecutionService = void 0;
+const common_1 = require("@nestjs/common");
+const plugin_action_errors_1 = require("../errors/plugin-action.errors");
+const plugin_action_starter_service_1 = require("../services/plugin-action-starter.service");
+const plugin_version_service_1 = require("../services/plugin-version.service");
+const plugin_service_1 = require("../services/plugin.service");
+let StartPluginActionExecutionService = class StartPluginActionExecutionService {
+    plugins;
+    versions;
+    starter;
+    constructor(plugins, versions, starter) {
+        this.plugins = plugins;
+        this.versions = versions;
+        this.starter = starter;
+    }
+    async run(command) {
+        const { context, action } = command;
+        if (context.executionId) {
+            throw new plugin_action_errors_1.ExecutionTokenNotAllowedError();
+        }
+        const role = context.roles?.[0];
+        if (!context.pluginId || !context.installationId || !role) {
+            throw new common_1.ForbiddenException('Plugin runtime authentication is required');
+        }
+        const plugin = await this.plugins.findById(context.pluginId);
+        const version = plugin?.currentVersionId
+            ? await this.versions.findById(plugin.currentVersionId)
+            : null;
+        if (!version) {
+            throw new plugin_action_errors_1.ActionNotDeclaredError(action);
+        }
+        return this.starter.start({
+            installation: {
+                id: context.installationId,
+                projectId: context.projectId,
+                userId: context.userId,
+            },
+            version,
+            action,
+            input: command.input,
+            role,
+            trigger: 'frontend',
+        });
+    }
+};
+exports.StartPluginActionExecutionService = StartPluginActionExecutionService;
+exports.StartPluginActionExecutionService = StartPluginActionExecutionService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [plugin_service_1.PluginService,
+        plugin_version_service_1.PluginVersionService,
+        plugin_action_starter_service_1.PluginActionStarterService])
+], StartPluginActionExecutionService);
+//# sourceMappingURL=start-plugin-action-execution.service.js.map

package/dist/src/plugin-host/use-cases/sync-plugin-releases.service.d.ts

@@ -1,21 +1,19 @@
 import { PluginHostConfigService } from '../config/plugin-host.config';
 import { PluginSyncResultDto, SyncPluginReleasesCommand } from '../dto/domain/plugin-sync.dto';
 import { GithubApiService } from '../services/github-api.service';
-import { ExternalCredentialDefinitionSyncService } from '../services/external-credential-definition-sync.service';
 import { PluginService } from '../services/plugin.service';
 import { PluginVersionService } from '../services/plugin-version.service';
 import { PluginCredentialBindingReconciliationService } from '../services/plugin-credential-binding-reconciliation.service';
-import { RemoteUrlValidatorService } from '../services/remote-url-validator.service';
+import { ReleaseCandidateRulesService } from '../services/release-candidate-rules.service';
 export declare class SyncPluginReleasesService {
     private readonly githubApi;
-    private readonly remoteUrlValidator;
+    private readonly candidateRules;
     private readonly pluginService;
     private readonly versionService;
     private readonly config;
     private readonly credentialBindingReconciliation;
-    private readonly externalCredentialDefinitions?;
     private readonly logger;
-    constructor(githubApi: GithubApiService, remoteUrlValidator: RemoteUrlValidatorService, pluginService: PluginService, versionService: PluginVersionService, config: PluginHostConfigService, credentialBindingReconciliation: PluginCredentialBindingReconciliationService, externalCredentialDefinitions?: ExternalCredentialDefinitionSyncService | undefined);
+    constructor(githubApi: GithubApiService, candidateRules: ReleaseCandidateRulesService, pluginService: PluginService, versionService: PluginVersionService, config: PluginHostConfigService, credentialBindingReconciliation: PluginCredentialBindingReconciliationService);
     run(command: SyncPluginReleasesCommand): Promise<PluginSyncResultDto>;
     private findOrCreatePlugin;
     private selectCandidates;

package/dist/src/plugin-host/use-cases/sync-plugin-releases.service.js

@@ -8,9 +8,6 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
 var SyncPluginReleasesService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SyncPluginReleasesService = void 0;
@@ -20,31 +17,27 @@ const plugin_host_config_1 = require("../config/plugin-host.config");
 const release_rejection_code_enum_1 = require("../enums/release-rejection-code.enum");
 const plugin_host_errors_1 = require("../errors/plugin-host.errors");
 const github_api_service_1 = require("../services/github-api.service");
-const external_credential_definition_sync_service_1 = require("../services/external-credential-definition-sync.service");
 const plugin_service_1 = require("../services/plugin.service");
 const plugin_version_service_1 = require("../services/plugin-version.service");
 const plugin_credential_binding_reconciliation_service_1 = require("../services/plugin-credential-binding-reconciliation.service");
-const remote_url_validator_service_1 = require("../services/remote-url-validator.service");
+const release_candidate_rules_service_1 = require("../services/release-candidate-rules.service");
 const github_repo_locator_util_1 = require("../utils/github-repo-locator.util");
-const plugin_manifest_util_1 = require("../utils/plugin-manifest.util");
 const semver_util_1 = require("../utils/semver.util");
 let SyncPluginReleasesService = SyncPluginReleasesService_1 = class SyncPluginReleasesService {
     githubApi;
-    remoteUrlValidator;
+    candidateRules;
     pluginService;
     versionService;
     config;
     credentialBindingReconciliation;
-    externalCredentialDefinitions;
     logger = new common_1.Logger(SyncPluginReleasesService_1.name);
-    constructor(githubApi, remoteUrlValidator, pluginService, versionService, config, credentialBindingReconciliation, externalCredentialDefinitions) {
+    constructor(githubApi, candidateRules, pluginService, versionService, config, credentialBindingReconciliation) {
         this.githubApi = githubApi;
-        this.remoteUrlValidator = remoteUrlValidator;
+        this.candidateRules = candidateRules;
         this.pluginService = pluginService;
         this.versionService = versionService;
         this.config = config;
         this.credentialBindingReconciliation = credentialBindingReconciliation;
-        this.externalCredentialDefinitions = externalCredentialDefinitions;
     }
     async run(command) {
         const ref = (0, github_repo_locator_util_1.parseGithubRepoLocator)(command.repoLocator);
@@ -126,45 +119,12 @@ let SyncPluginReleasesService = SyncPluginReleasesService_1 = class SyncPluginRe
             into.rejections.push(this.rejection(release, release_rejection_code_enum_1.ReleaseRejectionCode.VERSION_CONFLICT, `Version ${semver} is already recorded from commit ${recorded.commitSha} (release ${recorded.githubReleaseId}); refusing to replace it with commit ${commitSha} (release ${release.githubReleaseId})`));
             return false;
         }
-        const manifestSource = await this.githubApi.getFileAtCommit(ref, 'plugin.json', commitSha);
-        const manifest = (0, plugin_manifest_util_1.parsePluginManifest)(manifestSource);
-        if (!manifest.ok) {
-            into.rejections.push(this.rejection(release, manifest.code, manifest.detail));
-            return false;
-        }
-        const baseline = (await this.versionService.findAllByPluginId(pluginId))
-            .filter(version => (0, semver_util_1.sameCompatibilityLine)(version.semver, semver))
-            .reduce((highest, version) => (!highest || (0, semver_util_1.compareSemver)(version.semver, highest.semver) > 0 ? { semver: version.semver, collections: version.collections ?? [] } : highest), undefined);
-        if (baseline) {
-            const incompatibility = (0, plugin_manifest_util_1.findIncompatibleCollectionChange)(baseline.collections ?? [], manifest.manifest.collections);
-            if (incompatibility) {
-                const escape = (0, semver_util_1.majorOf)(semver) === 0
-                    ? 'bump the minor version to ship this breaking change while below 1.0.0'
-                    : 'publish a new major version to ship this breaking change';
-                into.rejections.push(this.rejection(release, release_rejection_code_enum_1.ReleaseRejectionCode.COLLECTIONS_INCOMPATIBLE, `${incompatibility} within the ${baseline.semver} compatibility line; ${escape}`));
-                return false;
-            }
-        }
-        const delivery = await this.remoteUrlValidator.validate(manifest.manifest.delivery.url);
-        if (!delivery.ok) {
-            into.rejections.push(this.rejection(release, delivery.code, delivery.detail));
-            return false;
-        }
-        let credentialRequirements = manifest.manifest.credentials;
-        try {
-            if (manifest.manifest.credentials.some(requirement => externalLocator(requirement))) {
-                if (!this.externalCredentialDefinitions) {
-                    throw new Error('External Credential definitions are not available');
-                }
-                credentialRequirements = await this.externalCredentialDefinitions.resolveRequirements(manifest.manifest.credentials);
-            }
-        }
-        catch (error) {
-            if (!(error instanceof external_credential_definition_sync_service_1.ExternalCredentialRequirementError))
-                throw error;
-            into.rejections.push(this.rejection(release, release_rejection_code_enum_1.ReleaseRejectionCode.MANIFEST_SCHEMA, (0, internal_helpers_1.castError)(error).message));
+        const verdict = await this.candidateRules.firstFailure({ pluginId, ref, commitSha, semver });
+        if (!verdict.ok) {
+            into.rejections.push(this.rejection(release, verdict.code, verdict.detail));
             return false;
         }
+        const { manifest, credentialRequirements } = verdict;
         try {
             const inserted = await this.versionService.insertVersionForLease({
                 pluginId,
@@ -172,11 +132,12 @@ let SyncPluginReleasesService = SyncPluginReleasesService_1 = class SyncPluginRe
                 commitSha,
                 githubReleaseId: release.githubReleaseId,
                 tagName: release.tagName,
-                displayName: manifest.manifest.name,
-                description: manifest.manifest.description,
-                deliveryUrl: manifest.manifest.delivery.url,
-                collections: manifest.manifest.collections,
+                displayName: manifest.name,
+                description: manifest.description,
+                deliveryUrl: manifest.delivery.url,
+                collections: manifest.collections,
                 credentialRequirements,
+                backend: manifest.backend ?? null,
                 releasePublishedAt: release.publishedAt,
             }, syncLeaseId);
             if (!inserted)
@@ -266,16 +227,11 @@ let SyncPluginReleasesService = SyncPluginReleasesService_1 = class SyncPluginRe
 exports.SyncPluginReleasesService = SyncPluginReleasesService;
 exports.SyncPluginReleasesService = SyncPluginReleasesService = SyncPluginReleasesService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __param(6, (0, common_1.Optional)()),
     __metadata("design:paramtypes", [github_api_service_1.GithubApiService,
-        remote_url_validator_service_1.RemoteUrlValidatorService,
+        release_candidate_rules_service_1.ReleaseCandidateRulesService,
         plugin_service_1.PluginService,
         plugin_version_service_1.PluginVersionService,
         plugin_host_config_1.PluginHostConfigService,
-        plugin_credential_binding_reconciliation_service_1.PluginCredentialBindingReconciliationService,
-        external_credential_definition_sync_service_1.ExternalCredentialDefinitionSyncService])
+        plugin_credential_binding_reconciliation_service_1.PluginCredentialBindingReconciliationService])
 ], SyncPluginReleasesService);
-function externalLocator(requirement) {
-    return (typeof requirement === 'string' ? requirement : requirement.id).startsWith('@');
-}
 //# sourceMappingURL=sync-plugin-releases.service.js.map

package/dist/src/plugin-host/use-cases/uninstall-plugin.service.js

@@ -35,7 +35,8 @@ let UninstallPluginService = class UninstallPluginService {
         if (!installation) {
             throw new common_1.NotFoundException('You do not have this plugin installed');
         }
-        if (installation.uninstalledAt === null) {
+        const wasUninstalled = installation.uninstalledAt !== null;
+        if (!wasUninstalled) {
             await this.installations.uninstall(installation.id);
         }
         await this.credentialBindings.deactivateConsumer('plugin-installation', installation.id, command.context.projectId);
@@ -45,6 +46,7 @@ let UninstallPluginService = class UninstallPluginService {
             authorityScope: plugin_publication_scope_enum_1.PluginPublicationScope.MEMBER,
             projectId: command.context.projectId,
             userId: command.context.userId,
+            beforeState: { uninstalled: wasUninstalled },
         });
     }
 };

package/dist/src/plugin-host/use-cases/update-plugin.service.d.ts

@@ -17,6 +17,5 @@ export declare class UpdatePluginService {
     constructor(pluginService: PluginService, authorization: PublicationAuthorizationService, schedule: PluginUpdateScheduleService, check: RunPluginUpdateCheckService, versionService: PluginVersionService, publications: PluginPublicationService, installations: PluginInstallationService);
     run(command: UpdatePluginCommand): Promise<PluginUpdateResultDto>;
     private resolvePlugin;
-    private managesPublicationOf;
     private mayReach;
 }

package/dist/src/plugin-host/use-cases/update-plugin.service.js

@@ -11,7 +11,6 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpdatePluginService = void 0;
 const common_1 = require("@nestjs/common");
-const plugin_publication_scope_enum_1 = require("../enums/plugin-publication-scope.enum");
 const plugin_service_1 = require("../services/plugin.service");
 const plugin_installation_service_1 = require("../services/plugin-installation.service");
 const plugin_publication_service_1 = require("../services/plugin-publication.service");
@@ -20,6 +19,7 @@ const plugin_version_service_1 = require("../services/plugin-version.service");
 const publication_authorization_service_1 = require("../services/publication-authorization.service");
 const github_repo_locator_util_1 = require("../utils/github-repo-locator.util");
 const plugin_publisher_diagnostics_1 = require("./plugin-publisher-diagnostics");
+const plugin_publisher_access_1 = require("./plugin-publisher-access");
 const run_plugin_update_check_service_1 = require("./run-plugin-update-check.service");
 let UpdatePluginService = class UpdatePluginService {
     pluginService;
@@ -47,7 +47,7 @@ let UpdatePluginService = class UpdatePluginService {
             apiKeyId: command.context.apiKeyId ?? null,
         });
         const isPublisher = this.authorization.isDeploymentPublisher(command.context);
-        const managesPublication = isPublisher || (await this.managesPublicationOf(plugin.id, command.context));
+        const managesPublication = isPublisher || (await (0, plugin_publisher_access_1.managesPublicationOf)(this.publications, plugin.id, command.context));
         let diagnostics = null;
         if (managesPublication) {
             const version = result.currentVersionId
@@ -59,7 +59,7 @@ let UpdatePluginService = class UpdatePluginService {
         const scheduled = await this.pluginService.findById(plugin.id);
         return {
             pluginId: result.pluginId,
-            repository: visibleRepository(scheduled ?? plugin, result.repository, isPublisher),
+            repository: (0, plugin_publisher_access_1.visibleRepository)(scheduled ?? plugin, result.repository, isPublisher),
             currentVersionId: result.currentVersionId,
             currentSemver: result.currentSemver,
             outcome: result.outcome,
@@ -86,25 +86,6 @@ let UpdatePluginService = class UpdatePluginService {
         }
         throw new common_1.NotFoundException('A plugin id or repository is required');
     }
-    async managesPublicationOf(pluginId, context) {
-        const scopes = [];
-        if (context.roles?.includes('admin')) {
-            scopes.push(plugin_publication_scope_enum_1.PluginPublicationScope.PROJECT);
-        }
-        if (context.userId) {
-            scopes.push(plugin_publication_scope_enum_1.PluginPublicationScope.MEMBER);
-        }
-        for (const scope of scopes) {
-            const rows = await this.publications.listManageable(scope, {
-                projectId: context.projectId,
-                userId: scope === plugin_publication_scope_enum_1.PluginPublicationScope.MEMBER ? (context.userId ?? undefined) : undefined,
-            });
-            if (rows.some(row => row.pluginId === pluginId)) {
-                return true;
-            }
-        }
-        return false;
-    }
     async mayReach(pluginId, context) {
         if (this.authorization.isDeploymentPublisher(context)) {
             return true;
@@ -128,7 +109,4 @@ exports.UpdatePluginService = UpdatePluginService = __decorate([
         plugin_publication_service_1.PluginPublicationService,
         plugin_installation_service_1.PluginInstallationService])
 ], UpdatePluginService);
-function visibleRepository(plugin, repository, isPublisher) {
-    return plugin.isPrivateRepo && !isPublisher ? `${plugin.repoOwner}/***` : repository;
-}
 //# sourceMappingURL=update-plugin.service.js.map

package/dist/src/plugin-host/utils/action-input-schema.util.d.ts

@@ -0,0 +1,14 @@
+export declare const ACTION_INPUT_AJV: {
+    readonly options: {
+        readonly strict: true;
+        readonly allErrors: true;
+        readonly logger: false;
+        readonly inlineRefs: false;
+        readonly ownProperties: true;
+    };
+    readonly metaSchema: "https://json-schema.org/draft/2020-12/schema";
+    readonly refusedKeywords: readonly ["pattern", "patternProperties", "format", "uniqueItems"];
+};
+type JsonObject = Record<string, unknown>;
+export declare function assertBoundedSchema(root: JsonObject): void;
+export {};