@owox/backend 0.38.0 → 0.39.0

package/dist/src/common/helpers/read-bounded-body.helper.d.ts

@@ -0,0 +1 @@
+export declare function readBoundedBody(response: Response, maxBytes: number): Promise<Buffer | null>;

package/dist/src/common/helpers/read-bounded-body.helper.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBoundedBody = readBoundedBody;
+async function readBoundedBody(response, maxBytes) {
+    const declaredLength = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+        await response.body?.cancel();
+        return null;
+    }
+    if (!response.body)
+        return Buffer.alloc(0);
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            return null;
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks.map(chunk => Buffer.from(chunk)), total);
+}
+//# sourceMappingURL=read-bounded-body.helper.js.map

package/dist/src/common/scheduler/system-tasks/system-trigger-type.d.ts

@@ -1,8 +1,10 @@
 export declare enum SystemTriggerType {
     RETRY_INTERRUPTED_CONNECTOR_RUNS = "RETRY_INTERRUPTED_CONNECTOR_RUNS",
+    REPAIR_BACKFILL_CHAINS = "REPAIR_BACKFILL_CHAINS",
     RUNS_NOTIFICATION = "RUNS_NOTIFICATION",
     SEND_NOTIFICATIONS = "SEND_NOTIFICATIONS",
     SEARCH_INDEX_DRIFT = "SEARCH_INDEX_DRIFT",
     PLUGIN_UPDATE_CHECK = "PLUGIN_UPDATE_CHECK",
-    CREDENTIAL_DEFINITION_UPDATE_CHECK = "CREDENTIAL_DEFINITION_UPDATE_CHECK"
+    CREDENTIAL_DEFINITION_UPDATE_CHECK = "CREDENTIAL_DEFINITION_UPDATE_CHECK",
+    PLUGIN_ACTION_EXECUTION_SWEEP = "PLUGIN_ACTION_EXECUTION_SWEEP"
 }

package/dist/src/common/scheduler/system-tasks/system-trigger-type.js

@@ -4,10 +4,12 @@ exports.SystemTriggerType = void 0;
 var SystemTriggerType;
 (function (SystemTriggerType) {
     SystemTriggerType["RETRY_INTERRUPTED_CONNECTOR_RUNS"] = "RETRY_INTERRUPTED_CONNECTOR_RUNS";
+    SystemTriggerType["REPAIR_BACKFILL_CHAINS"] = "REPAIR_BACKFILL_CHAINS";
     SystemTriggerType["RUNS_NOTIFICATION"] = "RUNS_NOTIFICATION";
     SystemTriggerType["SEND_NOTIFICATIONS"] = "SEND_NOTIFICATIONS";
     SystemTriggerType["SEARCH_INDEX_DRIFT"] = "SEARCH_INDEX_DRIFT";
     SystemTriggerType["PLUGIN_UPDATE_CHECK"] = "PLUGIN_UPDATE_CHECK";
     SystemTriggerType["CREDENTIAL_DEFINITION_UPDATE_CHECK"] = "CREDENTIAL_DEFINITION_UPDATE_CHECK";
+    SystemTriggerType["PLUGIN_ACTION_EXECUTION_SWEEP"] = "PLUGIN_ACTION_EXECUTION_SWEEP";
 })(SystemTriggerType || (exports.SystemTriggerType = SystemTriggerType = {}));
 //# sourceMappingURL=system-trigger-type.js.map

package/dist/src/config/data-source-options.config.d.ts

@@ -11,9 +11,10 @@ export declare class CustomDataSourceLogger implements Logger {
     private readonly logQueryParameters;
     constructor(logger: LoggerService, loggingOptions: LoggerOptions, logQueryParameters?: boolean);
     private checkLoggingOptions;
-    logQuery(query: string, parameters?: unknown[]): void;
-    logQueryError(error: string | Error, query: string, parameters?: unknown[]): void;
-    logQuerySlow(time: number, query: string, parameters?: unknown[]): void;
+    private loggableParameters;
+    logQuery(query: string, queryParameters?: unknown[]): void;
+    logQueryError(error: string | Error, query: string, queryParameters?: unknown[]): void;
+    logQuerySlow(time: number, query: string, queryParameters?: unknown[]): void;
     logSchemaBuild(message: string): void;
     logMigration(message: string): void;
     log(level: LogLevel, message: unknown): void;

package/dist/src/config/data-source-options.config.js

@@ -11,6 +11,7 @@ var DbType;
     DbType["sqlite"] = "sqlite";
     DbType["mysql"] = "mysql";
 })(DbType || (exports.DbType = DbType = {}));
+const REDACTED_PARAMETER_TABLES = ['plugin_action_execution'];
 class CustomDataSourceLogger {
     logger;
     loggingOptions;
@@ -31,22 +32,28 @@ class CustomDataSourceLogger {
             return true;
         return false;
     }
-    logQuery(query, parameters) {
+    loggableParameters(query, parameters) {
+        return REDACTED_PARAMETER_TABLES.some(table => query.includes(table)) ? undefined : parameters;
+    }
+    logQuery(query, queryParameters) {
         if (this.checkLoggingOptions('query')) {
+            const parameters = this.loggableParameters(query, queryParameters);
             const message = this.logQueryParameters && parameters?.length
                 ? `${query} -- Parameters: ${JSON.stringify(parameters)}`
                 : query;
             this.logger.log(message);
         }
     }
-    logQueryError(error, query, parameters) {
+    logQueryError(error, query, queryParameters) {
         if (this.checkLoggingOptions('error')) {
+            const parameters = this.loggableParameters(query, queryParameters);
             const errorMessage = `[QUERY ERROR] ${query}${this.logQueryParameters && parameters?.length ? ` -- Parameters: ${JSON.stringify(parameters)}` : ''}`;
             this.logger.error(errorMessage, String(error));
         }
     }
-    logQuerySlow(time, query, parameters) {
+    logQuerySlow(time, query, queryParameters) {
         if (this.checkLoggingOptions('warn')) {
+            const parameters = this.loggableParameters(query, queryParameters);
             const message = `[SLOW QUERY] (${time}ms): ${query}${this.logQueryParameters && parameters?.length ? ` -- Parameters: ${JSON.stringify(parameters)}` : ''}`;
             this.logger.warn(message);
         }

package/dist/src/config/plugin-collections-body-parser.config.js

@@ -3,13 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PLUGIN_COLLECTIONS_JSON_BODY_LIMIT = void 0;
 exports.registerPluginCollectionsBodyParser = registerPluginCollectionsBodyParser;
 const express_1 = require("express");
+const plugin_action_limits_1 = require("../plugin-host/constants/plugin-action-limits");
 exports.PLUGIN_COLLECTIONS_JSON_BODY_LIMIT = '2mb';
 const PLUGIN_COLLECTIONS_ROUTE = '/api/plugins/runtime/collections';
+const PLUGIN_ACTIONS_ROUTE = '/api/plugins/runtime/actions';
 const configuredApps = new WeakSet();
 function registerPluginCollectionsBodyParser(app) {
     if (configuredApps.has(app))
         return;
     app.use(PLUGIN_COLLECTIONS_ROUTE, (0, express_1.json)({ limit: exports.PLUGIN_COLLECTIONS_JSON_BODY_LIMIT }));
+    app.use(PLUGIN_ACTIONS_ROUTE, (0, express_1.json)({ limit: plugin_action_limits_1.PLUGIN_ACTION_LIMITS.routeBodyLimit }));
     configuredApps.add(app);
 }
 //# sourceMappingURL=plugin-collections-body-parser.config.js.map

package/dist/src/data-marts/credentials/credential.types.d.ts

@@ -16,7 +16,7 @@ export declare const CredentialDefinitionContractSchema: z.ZodObject<{
     displayName: z.ZodString;
     description: z.ZodDefault<z.ZodString>;
     documentationUrl: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
-    auth: z.ZodObject<{
+    auth: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
         type: z.ZodLiteral<"header">;
         label: z.ZodString;
         headerName: z.ZodString;
@@ -31,7 +31,16 @@ export declare const CredentialDefinitionContractSchema: z.ZodObject<{
         label: string;
         headerName: string;
         prefix?: string | undefined;
-    }>;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"google-service-account">;
+        label: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        type: "google-service-account";
+        label: string;
+    }, {
+        type: "google-service-account";
+        label: string;
+    }>]>;
     origins: z.ZodArray<z.ZodString, "many">;
     validation: z.ZodOptional<z.ZodObject<{
         method: z.ZodDefault<z.ZodEnum<["GET", "POST"]>>;
@@ -153,6 +162,9 @@ export declare const CredentialDefinitionContractSchema: z.ZodObject<{
         label: string;
         headerName: string;
         prefix?: string | undefined;
+    } | {
+        type: "google-service-account";
+        label: string;
     };
     displayName: string;
     origins: string[];
@@ -190,6 +202,9 @@ export declare const CredentialDefinitionContractSchema: z.ZodObject<{
         label: string;
         headerName: string;
         prefix?: string | undefined;
+    } | {
+        type: "google-service-account";
+        label: string;
     };
     displayName: string;
     origins: string[];
@@ -227,12 +242,15 @@ export declare const CredentialRequirementSchema: z.ZodUnion<[z.ZodString, z.Zod
     id: z.ZodString;
     optional: z.ZodDefault<z.ZodBoolean>;
     models: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     id: string;
     optional: boolean;
+    scopes?: string[] | undefined;
     models?: string[] | undefined;
 }, {
     id: string;
+    scopes?: string[] | undefined;
     models?: string[] | undefined;
     optional?: boolean | undefined;
 }>]>;
@@ -249,11 +267,17 @@ export interface NormalizedCredentialRequirement {
     readonly definitionId: string | null;
     readonly optional: boolean;
     readonly models: readonly string[];
+    readonly scopes: readonly string[];
 }
 export declare function normalizeCredentialRequirement(requirement: StoredCredentialRequirement): NormalizedCredentialRequirement;
 export interface CredentialSecret {
     readonly value: string;
 }
+export interface CredentialPublicMetadata {
+    readonly clientEmail: string;
+    readonly projectId: string;
+    readonly privateKeyId: string;
+}
 export type CredentialAiModelMappings = Record<string, string>;
 export type CredentialAiModelMappingModes = Record<string, 'recommended' | 'override'>;
 export type CredentialAiModelMappingSources = Record<string, 'catalog' | 'manual'>;

package/dist/src/data-marts/credentials/credential.types.js

@@ -29,17 +29,25 @@ exports.CredentialDocumentationUrlSchema = zod_1.z
     }
 }, 'documentationUrl must be an absolute HTTPS URL without embedded credentials')
     .transform(value => new URL(value).href);
+const CredentialHeaderAuthSchema = zod_1.z.object({
+    type: zod_1.z.literal('header'),
+    label: zod_1.z.string().trim().min(1).max(255),
+    headerName: zod_1.z.string().trim().min(1).max(255),
+    prefix: zod_1.z.string().max(64).optional(),
+});
+const CredentialGoogleServiceAccountAuthSchema = zod_1.z.object({
+    type: zod_1.z.literal('google-service-account'),
+    label: zod_1.z.string().trim().min(1).max(255),
+});
 exports.CredentialDefinitionContractSchema = zod_1.z.object({
     id: zod_1.z.string().trim().min(1).max(255),
     displayName: zod_1.z.string().trim().min(1).max(255),
     description: zod_1.z.string().trim().max(2000).default(''),
     documentationUrl: exports.CredentialDocumentationUrlSchema.optional(),
-    auth: zod_1.z.object({
-        type: zod_1.z.literal('header'),
-        label: zod_1.z.string().trim().min(1).max(255),
-        headerName: zod_1.z.string().trim().min(1).max(255),
-        prefix: zod_1.z.string().max(64).optional(),
-    }),
+    auth: zod_1.z.discriminatedUnion('type', [
+        CredentialHeaderAuthSchema,
+        CredentialGoogleServiceAccountAuthSchema,
+    ]),
     origins: zod_1.z.array(zod_1.z.string().url().startsWith('https://')).min(1).max(20),
     validation: zod_1.z
         .object({
@@ -82,6 +90,7 @@ exports.CredentialRequirementSchema = zod_1.z.union([
         id: zod_1.z.string().trim().min(1).max(255),
         optional: zod_1.z.boolean().default(false),
         models: zod_1.z.array(zod_1.z.string().trim().min(1).max(255)).max(20).optional(),
+        scopes: zod_1.z.array(zod_1.z.string().min(1).max(200).regex(/^\S+$/)).min(1).max(20).optional(),
     }),
 ]);
 function normalizeCredentialRequirement(requirement) {
@@ -92,6 +101,7 @@ function normalizeCredentialRequirement(requirement) {
                 definitionId: null,
                 optional: false,
                 models: ['fast'],
+                scopes: [],
             };
         }
         return {
@@ -99,6 +109,7 @@ function normalizeCredentialRequirement(requirement) {
             definitionId: requirement,
             optional: false,
             models: [],
+            scopes: [],
         };
     }
     return {
@@ -112,6 +123,7 @@ function normalizeCredentialRequirement(requirement) {
         models: [
             ...(requirement.id === 'ai' ? (requirement.models ?? ['fast']) : (requirement.models ?? [])),
         ].sort(),
+        scopes: 'definitionId' in requirement ? [] : [...new Set(requirement.scopes ?? [])].sort(),
     };
 }
 function isCredentialAiModelInCatalog(ai, capability, modelId) {

package/dist/src/data-marts/credentials/dto/credential-api.dto.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialAiModelMappings, CredentialAiModelMappingModes, CredentialDefinitionContract, CredentialDefinitionSource, CredentialValidationState } from '../credential.types';
+import type { CredentialAiModelMappings, CredentialAiModelMappingModes, CredentialDefinitionContract, CredentialDefinitionSource, CredentialPublicMetadata, CredentialValidationState } from '../credential.types';
 import type { UserProjectionDto } from '../../../idp/dto/domain/user-projection.dto';
 import type { ContextSummary } from '../../utils/extract-context-summaries';
 export declare class CredentialSecretApiDto {
@@ -33,6 +33,9 @@ export declare class CredentialDefinitionApiDto {
     description: string;
     documentationUrl: string | null;
     secretLabel: string;
+    auth: {
+        type: CredentialDefinitionContract['auth']['type'];
+    };
     origins: string[];
     supportsAi: boolean;
     ai: CredentialDefinitionContract['ai'] | null;
@@ -60,6 +63,7 @@ export declare class CredentialResponseApiDto {
     lastUsedAt: Date | null;
     aiModelMappings: CredentialAiModelMappings | null;
     aiModelMappingModes: CredentialAiModelMappingModes | null;
+    publicMetadata: CredentialPublicMetadata | null;
     ownerUsers: UserProjectionDto[];
     contexts: ContextSummary[];
     usedBy: CredentialConsumerReferenceApiDto[];

package/dist/src/data-marts/credentials/dto/credential-api.dto.js

@@ -196,6 +196,7 @@ class CredentialDefinitionApiDto {
     description;
     documentationUrl;
     secretLabel;
+    auth;
     origins;
     supportsAi;
     ai;
@@ -226,6 +227,13 @@ __decorate([
     (0, swagger_1.ApiProperty)(),
     __metadata("design:type", String)
 ], CredentialDefinitionApiDto.prototype, "secretLabel", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: 'object',
+        properties: { type: { type: 'string', enum: ['header', 'google-service-account'] } },
+    }),
+    __metadata("design:type", Object)
+], CredentialDefinitionApiDto.prototype, "auth", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ type: [String] }),
     __metadata("design:type", Array)
@@ -258,6 +266,7 @@ class CredentialResponseApiDto {
     lastUsedAt;
     aiModelMappings;
     aiModelMappingModes;
+    publicMetadata;
     ownerUsers;
     contexts;
     usedBy;
@@ -333,6 +342,18 @@ __decorate([
     }),
     __metadata("design:type", Object)
 ], CredentialResponseApiDto.prototype, "aiModelMappingModes", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: 'object',
+        nullable: true,
+        properties: {
+            clientEmail: { type: 'string' },
+            projectId: { type: 'string' },
+            privateKeyId: { type: 'string' },
+        },
+    }),
+    __metadata("design:type", Object)
+], CredentialResponseApiDto.prototype, "publicMetadata", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ type: [Object] }),
     __metadata("design:type", Array)

package/dist/src/data-marts/credentials/dto/credential.dto.d.ts

@@ -1,6 +1,6 @@
 import type { UserProjectionDto } from '../../../idp/dto/domain/user-projection.dto';
 import type { ContextSummary } from '../../utils/extract-context-summaries';
-import type { CredentialAiModelMappingModes, CredentialAiModelMappings, CredentialValidationState } from '../credential.types';
+import type { CredentialAiModelMappingModes, CredentialAiModelMappings, CredentialPublicMetadata, CredentialValidationState } from '../credential.types';
 import type { CredentialConsumerReferenceApiDto, CredentialDefinitionApiDto } from './credential-api.dto';
 export interface CredentialDto {
     readonly id: string;
@@ -17,6 +17,7 @@ export interface CredentialDto {
     readonly lastUsedAt: Date | null;
     readonly aiModelMappings: CredentialAiModelMappings | null;
     readonly aiModelMappingModes: CredentialAiModelMappingModes | null;
+    readonly publicMetadata: CredentialPublicMetadata | null;
     readonly ownerUsers: UserProjectionDto[];
     readonly contexts: ContextSummary[];
     readonly usedBy: CredentialConsumerReferenceApiDto[];

package/dist/src/data-marts/credentials/entities/credential.entity.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialAiModelMappings, CredentialAiModelMappingModes, CredentialAiModelMappingSources, CredentialDefinitionSource, CredentialSecret, CredentialValidationState } from '../credential.types';
+import type { CredentialAiModelMappings, CredentialAiModelMappingModes, CredentialAiModelMappingSources, CredentialDefinitionSource, CredentialPublicMetadata, CredentialSecret, CredentialValidationState } from '../credential.types';
 import { CredentialContext } from './credential-context.entity';
 import { CredentialOwner } from './credential-owner.entity';
 export declare class Credential {
@@ -9,6 +9,7 @@ export declare class Credential {
     definitionId: string;
     acceptedCompatibilityLine: string | null;
     secret: CredentialSecret;
+    publicMetadata: CredentialPublicMetadata | null;
     aiModelMappings: CredentialAiModelMappings | null;
     aiModelMappingModes: CredentialAiModelMappingModes | null;
     aiModelMappingSources: CredentialAiModelMappingSources | null;

package/dist/src/data-marts/credentials/entities/credential.entity.js

@@ -21,6 +21,7 @@ let Credential = class Credential {
     definitionId;
     acceptedCompatibilityLine;
     secret;
+    publicMetadata;
     aiModelMappings;
     aiModelMappingModes;
     aiModelMappingSources;
@@ -72,6 +73,10 @@ __decorate([
     (0, typeorm_1.Column)({ type: 'json' }),
     __metadata("design:type", Object)
 ], Credential.prototype, "secret", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'json', nullable: true }),
+    __metadata("design:type", Object)
+], Credential.prototype, "publicMetadata", void 0);
 __decorate([
     (0, typeorm_1.Column)({ type: 'json', nullable: true }),
     __metadata("design:type", Object)

package/dist/src/data-marts/credentials/facades/credential-consumer-binding.facade.impl.js

@@ -258,11 +258,15 @@ function assertUniqueRequirementKeys(requirements) {
     }
 }
 function sameRequirement(left, right) {
+    const leftScopes = left.scopes ?? [];
+    const rightScopes = right.scopes ?? [];
     return (left.key === right.key &&
         left.definitionId === right.definitionId &&
         left.optional === right.optional &&
         left.models.length === right.models.length &&
-        left.models.every((model, index) => model === right.models[index]));
+        left.models.every((model, index) => model === right.models[index]) &&
+        leftScopes.length === rightScopes.length &&
+        leftScopes.every((scope, index) => scope === rightScopes[index]));
 }
 function requirementRevision(requirement) {
     return (0, node_crypto_1.createHash)('sha256')
@@ -271,6 +275,7 @@ function requirementRevision(requirement) {
         definitionId: requirement.definitionId,
         optional: requirement.optional,
         models: requirement.models,
+        ...(requirement.scopes?.length ? { scopes: requirement.scopes } : {}),
     }))
         .digest('hex');
 }

package/dist/src/data-marts/credentials/mappers/credential.mapper.js

@@ -24,6 +24,7 @@ function mapCredentialDefinitionToApiDto(definition) {
         description: definition.contract.description,
         documentationUrl: definition.contract.documentationUrl ?? null,
         secretLabel: definition.contract.auth.label,
+        auth: { type: definition.contract.auth.type },
         origins: [...definition.contract.origins],
         supportsAi: definition.contract.ai !== undefined,
         ai: definition.contract.ai ?? null,
@@ -53,6 +54,7 @@ let CredentialMapper = class CredentialMapper {
             lastUsedAt,
             aiModelMappings: (0, credential_types_1.resolveCredentialAiModelMappings)(credential.aiModelMappings, credential.aiModelMappingModes, definition.contract.ai?.recommended),
             aiModelMappingModes: credential.aiModelMappingModes,
+            publicMetadata: credential.publicMetadata ?? null,
             ownerUsers: (0, resolve_owner_users_1.resolveOwnerUsers)(credential.ownerIds, users),
             contexts: (0, extract_context_summaries_1.extractContextSummaries)(credential.contexts),
             usedBy: bindings.map(binding => ({

package/dist/src/data-marts/credentials/services/builtin-credential-definitions.js

@@ -128,6 +128,14 @@ exports.BUILTIN_CREDENTIAL_DEFINITIONS = [
             },
         },
     },
+    {
+        id: 'google-service-account',
+        displayName: 'Google Service Account',
+        description: 'Google Cloud service account JSON key',
+        documentationUrl: 'https://docs.cloud.google.com/iam/docs/keys-create-delete',
+        auth: { type: 'google-service-account', label: 'Service account key (JSON)' },
+        origins: ['https://*.googleapis.com'],
+    },
 ];
 exports.BUILTIN_CREDENTIAL_DEFINITION_IDS = new Set(exports.BUILTIN_CREDENTIAL_DEFINITIONS.map(definition => definition.id));
 //# sourceMappingURL=builtin-credential-definitions.js.map

package/dist/src/data-marts/credentials/services/credential-external-definition-registry.service.d.ts

@@ -19,7 +19,11 @@ export declare class CredentialExternalDefinitionRegistryService {
     private readonly dataSource;
     constructor(definitions: Repository<CredentialExternalDefinition>, versions: Repository<CredentialDefinitionVersion>, dataSource: DataSource);
     register(input: RegisterExternalCredentialDefinitionInput): Promise<ResolvedCredentialDefinition>;
+    preview(input: RegisterExternalCredentialDefinitionInput): Promise<{
+        readonly contract: CredentialDefinitionContract;
+    }>;
     private persist;
+    private validateAgainstRecorded;
     private createOrFindDefinition;
     getCurrentByGithubRepoId(githubRepoId: string): Promise<ResolvedCredentialDefinition | null>;
     listDue(now: Date, limit: number): Promise<CredentialExternalDefinition[]>;

package/dist/src/data-marts/credentials/services/credential-external-definition-registry.service.js

@@ -39,6 +39,12 @@ let CredentialExternalDefinitionRegistryService = class CredentialExternalDefini
         const definition = await this.createOrFindDefinition(input);
         return this.persist(definition.id, input);
     }
+    async preview(input) {
+        await this.validateNetworkBoundary(input.contract);
+        const definition = await this.definitions.findOneBy({ githubRepoId: input.githubRepoId });
+        const { recorded } = await this.validateAgainstRecorded(definition, input);
+        return { contract: (recorded ?? input).contract };
+    }
     async persist(definitionId, input) {
         const query = this.definitions
             .createQueryBuilder('definition')
@@ -51,27 +57,12 @@ let CredentialExternalDefinitionRegistryService = class CredentialExternalDefini
             throw new common_1.BadRequestException('Credential definition sync state was lost');
         definition.repoOwner = input.repoOwner;
         definition.repoName = input.repoName;
-        const compatibilityLine = compatibilityLineForSemver(input.semver);
-        const recorded = await this.versions.findOneBy({
-            externalDefinitionId: definition.id,
-            semver: input.semver,
-        });
+        const { compatibilityLine, recorded, current } = await this.validateAgainstRecorded(definition, input);
         if (recorded) {
-            if (recorded.commitSha !== input.commitSha ||
-                recorded.githubReleaseId !== input.githubReleaseId) {
-                throw new common_1.BadRequestException(`Credential definition version ${input.semver} was already recorded from another release`);
-            }
             this.markSynced(definition, input.semver, new Date());
             await this.definitions.save(definition);
             return this.resolved(definition.id, recorded);
         }
-        const current = definition.currentVersionId
-            ? await this.versions.findOneBy({ id: definition.currentVersionId })
-            : null;
-        if (current?.compatibilityLine === compatibilityLine &&
-            !isCompatibleWithinLine(current.contract, input.contract)) {
-            throw new common_1.BadRequestException(`Credential definition ${input.semver} changes an incompatible contract within compatibility line ${compatibilityLine}; publish a new compatibility line for this change`);
-        }
         const version = await this.versions.save(this.versions.create({
             externalDefinitionId: definition.id,
             semver: input.semver,
@@ -89,6 +80,30 @@ let CredentialExternalDefinitionRegistryService = class CredentialExternalDefini
         await this.definitions.save(definition);
         return this.resolved(definition.id, version);
     }
+    async validateAgainstRecorded(definition, input) {
+        const compatibilityLine = compatibilityLineForSemver(input.semver);
+        const recorded = definition
+            ? await this.versions.findOneBy({
+                externalDefinitionId: definition.id,
+                semver: input.semver,
+            })
+            : null;
+        if (recorded) {
+            if (recorded.commitSha !== input.commitSha ||
+                recorded.githubReleaseId !== input.githubReleaseId) {
+                throw new common_1.BadRequestException(`Credential definition version ${input.semver} was already recorded from another release`);
+            }
+            return { compatibilityLine, recorded, current: null };
+        }
+        const current = definition?.currentVersionId
+            ? await this.versions.findOneBy({ id: definition.currentVersionId })
+            : null;
+        if (current?.compatibilityLine === compatibilityLine &&
+            !isCompatibleWithinLine(current.contract, input.contract)) {
+            throw new common_1.BadRequestException(`Credential definition ${input.semver} changes an incompatible contract within compatibility line ${compatibilityLine}; publish a new compatibility line for this change`);
+        }
+        return { compatibilityLine, recorded: null, current };
+    }
     async createOrFindDefinition(input) {
         const existing = await this.definitions.findOneBy({ githubRepoId: input.githubRepoId });
         if (existing)
@@ -149,6 +164,9 @@ let CredentialExternalDefinitionRegistryService = class CredentialExternalDefini
         return hash % SLOTS_PER_DAY;
     }
     async validateNetworkBoundary(contract) {
+        if (contract.auth.type !== 'header') {
+            throw new common_1.BadRequestException('An external Credential definition must use header auth');
+        }
         try {
             for (const origin of contract.origins) {
                 const url = await (0, safe_url_helper_1.assertPublicHttpUrl)(origin, { allowedProtocols: ['https:'] });
@@ -203,7 +221,8 @@ function compatibilityLineForSemver(semver) {
 function isCompatibleWithinLine(previous, next) {
     return (previous.id === next.id &&
         sameSet(previous.origins, next.origins) &&
-        previous.auth.type === next.auth.type &&
+        previous.auth.type === 'header' &&
+        next.auth.type === 'header' &&
         previous.auth.headerName.toLowerCase() === next.auth.headerName.toLowerCase() &&
         (previous.auth.prefix ?? '') === (next.auth.prefix ?? '') &&
         (!previous.ai || Boolean(next.ai)) &&

package/dist/src/data-marts/credentials/services/credential-fetch.service.d.ts

@@ -1,13 +1,21 @@
 import type { CredentialFetchRequestApiDto, CredentialFetchResponseApiDto } from '../dto/credential-fetch-api.dto';
 import type { ResolvedCredentialBinding } from '../facades/credential-consumer-binding.facade';
+import { CredentialService } from './credential.service';
+import { GoogleServiceAccountTokenService } from './google-service-account-token.service';
 export interface CredentialFetchLimits {
     readonly timeoutMs?: number;
     readonly maxResponseBodyBytes?: number;
     readonly signal?: AbortSignal;
 }
 export declare class CredentialFetchService {
+    private readonly googleTokens;
+    private readonly credentials;
+    private readonly logger;
+    constructor(googleTokens: GoogleServiceAccountTokenService, credentials: CredentialService);
     run(binding: ResolvedCredentialBinding, input: CredentialFetchRequestApiDto, limits?: CredentialFetchLimits): Promise<CredentialFetchResponseApiDto>;
     runRaw(binding: ResolvedCredentialBinding, input: CredentialFetchRequestApiDto, limits?: CredentialFetchLimits): Promise<Response>;
+    private send;
+    private authorization;
     private assertAllowedUrl;
     private buildRequestHeaders;
 }