@pipefy/pipefy-process-coder 0.1.0 → 0.1.2

package/src/report/integrations.ts

@@ -1,231 +0,0 @@
-import type { PayloadEnvelope, Row } from '../model/payload.ts';
-
-/**
- * The integration surface of a pipe, pulled out of the payload as its own
- * artifact.
- *
- * "Integration" here means every way this pipe touches something outside
- * itself, because those are the parts of a change whose blast radius leaves the
- * pipe: a webhook fires at a third party, a pipe relation writes cards into
- * another process, a cross-repo automation does both. They are also the parts
- * that carry credentials, which is why the rendered summary is redacted and the
- * raw rows go in a file the workspace .gitignore covers.
- *
- * Recorded per run rather than derived on demand: a run is the only moment when
- * "what did this pipe reach, before and after" is knowable, and by the next
- * apply the answer has changed.
- */
-
-/** Automation actions that reach outside the pipe they are triggered in. */
-const OUTBOUND_ACTIONS = new Set([
-  'http_request',
-  'send_email',
-  'send_email_template',
-  'create_card',
-  'create_card_relation',
-  'move_single_card',
-  'create_table_record',
-  'update_table_record',
-]);
-
-export type IntegrationEdge = {
-  kind: 'webhook' | 'pipe_relation' | 'automation' | 'connected_field' | 'email_inbox';
-  /** What this pipe reaches, named the way a human would say it. */
-  target: string;
-  /** The row's id, so it can be found again. */
-  id: string | null;
-  detail: string;
-  /** True when the row carries a credential, so the report redacts it. */
-  bearsSecret?: boolean;
-};
-
-export type IntegrationsView = {
-  generatedAt: string;
-  repoId: number;
-  repoName: string;
-  /**
-   * Coverage for the groups this view reads. `unknown` here means the list
-   * below is not "no integrations" but "not read" — the same doctrine as
-   * everywhere else, and it matters most here, where the absent row might be a
-   * live webhook.
-   */
-  coverage: Record<string, string>;
-  counts: { webhooks: number; pipe_relations: number; outbound_automations: number; connected_fields: number };
-  edges: IntegrationEdge[];
-  /** Every repo id this pipe is wired to, however it is wired. */
-  connected_repo_ids: number[];
-  /** Raw rows, unredacted — the workspace .gitignore covers this file. */
-  webhooks: Row[];
-  pipe_relations: Row[];
-  outbound_automations: Row[];
-  email_inboxes: Row[];
-  public_form: { open: boolean; title: unknown } | null;
-};
-
-const s = (v: unknown): string | null => (v === null || v === undefined ? null : String(v));
-
-const hostOf = (url: unknown): string => {
-  const raw = s(url);
-  if (!raw) return '(no url)';
-  try {
-    return new URL(raw).host;
-  } catch {
-    return raw.slice(0, 40);
-  }
-};
-
-/** Whether a row holds anything bearer-equivalent. */
-const bearsSecret = (row: Row): boolean => {
-  const j = JSON.stringify(row).toLowerCase();
-  return (
-    j.includes('authentication_value') ||
-    j.includes('authentication_key') ||
-    j.includes('token') ||
-    j.includes('secret') ||
-    /[?&](key|token|sig|signature|auth)=/.test(j)
-  );
-};
-
-export const integrationsFrom = (env: PayloadEnvelope): IntegrationsView => {
-  const rel = env.payload.relations;
-  const repoId = Number(env.payload.id);
-  const webhooks = rel.webhooks ?? [];
-  const relations = rel.pipe_relations ?? [];
-  const automations = rel.automations ?? [];
-  const inboxes = rel.email_inboxes ?? [];
-  const fields = rel.fields ?? [];
-
-  const outbound = automations.filter((a) => {
-    const action = s(a['action_id']) ?? '';
-    const target = s(a['action_repo_id']);
-    const crossRepo = target !== null && target !== s(a['event_repo_id']);
-    return crossRepo || OUTBOUND_ACTIONS.has(action);
-  });
-
-  const connectedFields = fields.filter((f) => s(f['connected_repo_id']) ?? s(f['connected_pipe_id']));
-
-  const edges: IntegrationEdge[] = [
-    ...webhooks.map(
-      (w): IntegrationEdge => ({
-        kind: 'webhook',
-        target: hostOf(w['url']),
-        id: s(w['id']),
-        detail:
-          `${s(w['name']) ?? 'unnamed'} on ` +
-          `${Array.isArray(w['actions']) ? (w['actions'] as unknown[]).join(', ') : (s(w['actions']) ?? 'no actions')}`,
-        bearsSecret: bearsSecret(w),
-      }),
-    ),
-    ...relations.map(
-      (r): IntegrationEdge => ({
-        kind: 'pipe_relation',
-        target: `repo ${s(r['child_id']) ?? s(r['parent_id']) ?? '?'}`,
-        id: s(r['id']),
-        detail: `${s(r['name']) ?? 'unnamed'} — parent ${s(r['parent_id'])} to child ${s(r['child_id'])}`,
-      }),
-    ),
-    ...outbound.map(
-      (a): IntegrationEdge => ({
-        kind: 'automation',
-        target:
-          s(a['action_repo_id']) && s(a['action_repo_id']) !== String(repoId)
-            ? `repo ${s(a['action_repo_id'])}`
-            : (s(a['action_id']) ?? 'action'),
-        id: s(a['id']),
-        detail:
-          `${s(a['name']) ?? 'unnamed'} — ${s(a['event_id'])} to ${s(a['action_id'])}` +
-          `${a['active'] === false ? ' (inactive)' : ''}`,
-        bearsSecret: bearsSecret(a),
-      }),
-    ),
-    ...connectedFields.map(
-      (f): IntegrationEdge => ({
-        kind: 'connected_field',
-        target: `repo ${s(f['connected_repo_id']) ?? s(f['connected_pipe_id'])}`,
-        id: s(f['id']),
-        // Payload rows spell the type `type_id`; a reconstructed row may spell it
-        // `type`. Neither is guaranteed, so both are tried before giving up.
-        detail: `field "${s(f['label']) ?? s(f['name']) ?? '?'}" (${s(f['type_id']) ?? s(f['type']) ?? 'unknown type'})`,
-      }),
-    ),
-    ...inboxes.map(
-      (i): IntegrationEdge => ({
-        kind: 'email_inbox',
-        target: s(i['email']) ?? s(i['name']) ?? 'inbox',
-        id: s(i['id']),
-        detail: 'inbound email',
-      }),
-    ),
-  ];
-
-  const connected = new Set<number>();
-  const note = (v: unknown) => {
-    const n = Number(v);
-    if (Number.isFinite(n) && n !== repoId && n !== 0) connected.add(n);
-  };
-  for (const r of relations) {
-    note(r['parent_id']);
-    note(r['child_id']);
-  }
-  for (const a of outbound) note(a['action_repo_id']);
-  for (const f of connectedFields) note(f['connected_repo_id'] ?? f['connected_pipe_id']);
-
-  const form = (rel.public_forms ?? [])[0] ?? null;
-
-  return {
-    generatedAt: new Date().toISOString(),
-    repoId,
-    repoName: String(env.payload['name'] ?? repoId),
-    coverage: {
-      webhooks: env.coverage.webhooks,
-      pipe_relations: env.coverage.pipe_relations,
-      automations: env.coverage.automations,
-      email_inboxes: env.coverage.email_inboxes,
-    },
-    counts: {
-      webhooks: webhooks.length,
-      pipe_relations: relations.length,
-      outbound_automations: outbound.length,
-      connected_fields: connectedFields.length,
-    },
-    edges,
-    connected_repo_ids: [...connected].sort((a, b) => a - b),
-    webhooks,
-    pipe_relations: relations,
-    outbound_automations: outbound,
-    email_inboxes: inboxes,
-    public_form: form ? { open: Boolean(env.payload['public']), title: form['title'] ?? null } : null,
-  };
-};
-
-/** The integration surface as report prose. Hosts kept, credentials never. */
-export const renderIntegrations = (v: IntegrationsView): string[] => {
-  const lines: string[] = [];
-  const gaps = Object.entries(v.coverage).filter(([, c]) => c !== 'complete');
-  if (gaps.length) {
-    lines.push(
-      `> Coverage: ${gaps.map(([k, c]) => `${k} is ${c}`).join(', ')}. ` +
-        'An absent row below is not evidence that nothing is there.',
-      '',
-    );
-  }
-  if (!v.edges.length) {
-    lines.push('This pipe reaches nothing outside itself.');
-    return lines;
-  }
-  lines.push('| Kind | Target | Id | Detail |', '| --- | --- | --- | --- |');
-  for (const e of v.edges) {
-    lines.push(
-      `| ${e.kind.replace(/_/g, ' ')} | ${e.target}${e.bearsSecret ? ' (key)' : ''} | ${e.id ?? '-'} | ` +
-        `${e.detail.replace(/\|/g, '\\|')} |`,
-    );
-  }
-  if (v.edges.some((e) => e.bearsSecret)) {
-    lines.push(
-      '',
-      '(key) marks a row that carries a credential. The value is in `integrations.json`, ' +
-        'which the workspace .gitignore covers.',
-    );
-  }
-  return lines;
-};