@pipefy/pipefy-process-coder 0.1.0

package/src/pipefy/toolkit_bearer.py

@@ -0,0 +1,137 @@
+"""Print a Pipefy bearer token resolved by the official ai-toolkit.
+
+Run inside the toolkit's own environment (see toolkit.ts for how it is located),
+so the credential precedence, the keychain backend and the refresh logic are all
+the toolkit's rather than reimplemented here:
+
+    static token (PIPEFY_TOKEN / config.toml)
+      -> service account (PIPEFY_SERVICE_ACCOUNT_*)
+      -> stored session from `pipefy auth login`, refreshed if stale
+
+Emits one JSON object on stdout and nothing else. Never writes the token
+anywhere; the caller holds it in memory for the life of one command.
+
+    {"ok": true,  "source": "stored-session", "token": "...", "base_url": "..."}
+    {"ok": false, "reason": "no-credentials", "message": "..."}
+
+Exit code is 0 whenever the JSON was produced, including for "no credentials" —
+that is an answer, not a failure. A non-zero exit means the toolkit itself could
+not be used, and the caller falls back to its own credential store.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+
+
+def _fail(reason: str, message: str) -> int:
+    json.dump({"ok": False, "reason": reason, "message": message}, sys.stdout)
+    return 0
+
+
+def main() -> int:
+    try:
+        from pipefy_auth import (  # noqa: PLC0415
+            AuthSettings,
+            OidcClient,
+            ServiceAccountAuth,
+            StaticTokenAuth,
+            StoredSessionAuth,
+            configure_keychain_backend,
+            ensure_fresh_session,
+            resolve_pipefy_auth,
+        )
+        from pipefy_auth.resolver import ServiceAccount  # noqa: PLC0415
+    except Exception as exc:  # pragma: no cover - environment problem
+        print(f"pipefy_auth is not importable: {exc}", file=sys.stderr)
+        return 3
+
+    settings = AuthSettings()
+
+    # Select the keyring backend before any session read. On Windows the default
+    # `auto` backend cannot hold a Keycloak session (CredWrite caps the blob at
+    # ~2.5 KB), so machines set `keychain_backend = "file"` — and a reader that
+    # skips this looks in the empty store and reports "not signed in" while
+    # `pipefy auth status` says otherwise.
+    configure_keychain_backend(settings.keychain_backend)
+
+    service_account = None
+    if settings.service_account_client_id and settings.service_account_client_secret:
+        service_account = ServiceAccount(
+            token_url=settings.service_account_url,
+            client_id=settings.service_account_client_id,
+            client_secret=settings.service_account_client_secret,
+        )
+
+    oidc = OidcClient(issuer_url=settings.auth_url, client_id=settings.auth_client_id)
+
+    resolved = resolve_pipefy_auth(
+        static_token=settings.static_token,
+        service_account=service_account,
+        oidc_client=oidc,
+    )
+
+    if resolved is None:
+        return _fail(
+            "no-credentials",
+            "no Pipefy credential found: run `pipefy auth login`, set PIPEFY_TOKEN, "
+            "or configure PIPEFY_SERVICE_ACCOUNT_*",
+        )
+
+    common = {"ok": True, "base_url": settings.base_url}
+
+    if isinstance(resolved, StaticTokenAuth):
+        json.dump({**common, "source": "static-token", "token": resolved.token}, sys.stdout)
+        return 0
+
+    if isinstance(resolved, StoredSessionAuth):
+        session = ensure_fresh_session(
+            issuer=resolved.oidc_client.issuer_url,
+            client_id=resolved.oidc_client.client_id,
+        )
+        if session is None:
+            return _fail(
+                "session-expired",
+                "the stored session could not be refreshed — run `pipefy auth login` again",
+            )
+        json.dump(
+            {
+                **common,
+                "source": "stored-session",
+                "token": session.token.access_token,
+                "issuer": session.issuer,
+                "expires_in": session.token.expires_in,
+            },
+            sys.stdout,
+        )
+        return 0
+
+    if isinstance(resolved, ServiceAccountAuth):
+        # The client-credentials exchange happens here so the secret never
+        # crosses the process boundary — only the short-lived bearer does.
+        import httpx  # noqa: PLC0415
+
+        creds = resolved.credentials
+        try:
+            response = httpx.post(
+                creds.token_url,
+                data={
+                    "grant_type": "client_credentials",
+                    "client_id": creds.client_id,
+                    "client_secret": creds.client_secret,
+                },
+                timeout=30.0,
+            )
+            response.raise_for_status()
+            token = response.json()["access_token"]
+        except Exception as exc:
+            return _fail("service-account-failed", f"client-credentials grant failed: {exc}")
+        json.dump({**common, "source": "service-account", "token": token}, sys.stdout)
+        return 0
+
+    return _fail("unknown-method", f"unrecognised auth method {type(resolved).__name__}")
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/src/report/integrations.ts

@@ -0,0 +1,231 @@
+import type { PayloadEnvelope, Row } from '../model/payload.ts';
+
+/**
+ * The integration surface of a pipe, pulled out of the payload as its own
+ * artifact.
+ *
+ * "Integration" here means every way this pipe touches something outside
+ * itself, because those are the parts of a change whose blast radius leaves the
+ * pipe: a webhook fires at a third party, a pipe relation writes cards into
+ * another process, a cross-repo automation does both. They are also the parts
+ * that carry credentials, which is why the rendered summary is redacted and the
+ * raw rows go in a file the workspace .gitignore covers.
+ *
+ * Recorded per run rather than derived on demand: a run is the only moment when
+ * "what did this pipe reach, before and after" is knowable, and by the next
+ * apply the answer has changed.
+ */
+
+/** Automation actions that reach outside the pipe they are triggered in. */
+const OUTBOUND_ACTIONS = new Set([
+  'http_request',
+  'send_email',
+  'send_email_template',
+  'create_card',
+  'create_card_relation',
+  'move_single_card',
+  'create_table_record',
+  'update_table_record',
+]);
+
+export type IntegrationEdge = {
+  kind: 'webhook' | 'pipe_relation' | 'automation' | 'connected_field' | 'email_inbox';
+  /** What this pipe reaches, named the way a human would say it. */
+  target: string;
+  /** The row's id, so it can be found again. */
+  id: string | null;
+  detail: string;
+  /** True when the row carries a credential, so the report redacts it. */
+  bearsSecret?: boolean;
+};
+
+export type IntegrationsView = {
+  generatedAt: string;
+  repoId: number;
+  repoName: string;
+  /**
+   * Coverage for the groups this view reads. `unknown` here means the list
+   * below is not "no integrations" but "not read" — the same doctrine as
+   * everywhere else, and it matters most here, where the absent row might be a
+   * live webhook.
+   */
+  coverage: Record<string, string>;
+  counts: { webhooks: number; pipe_relations: number; outbound_automations: number; connected_fields: number };
+  edges: IntegrationEdge[];
+  /** Every repo id this pipe is wired to, however it is wired. */
+  connected_repo_ids: number[];
+  /** Raw rows, unredacted — the workspace .gitignore covers this file. */
+  webhooks: Row[];
+  pipe_relations: Row[];
+  outbound_automations: Row[];
+  email_inboxes: Row[];
+  public_form: { open: boolean; title: unknown } | null;
+};
+
+const s = (v: unknown): string | null => (v === null || v === undefined ? null : String(v));
+
+const hostOf = (url: unknown): string => {
+  const raw = s(url);
+  if (!raw) return '(no url)';
+  try {
+    return new URL(raw).host;
+  } catch {
+    return raw.slice(0, 40);
+  }
+};
+
+/** Whether a row holds anything bearer-equivalent. */
+const bearsSecret = (row: Row): boolean => {
+  const j = JSON.stringify(row).toLowerCase();
+  return (
+    j.includes('authentication_value') ||
+    j.includes('authentication_key') ||
+    j.includes('token') ||
+    j.includes('secret') ||
+    /[?&](key|token|sig|signature|auth)=/.test(j)
+  );
+};
+
+export const integrationsFrom = (env: PayloadEnvelope): IntegrationsView => {
+  const rel = env.payload.relations;
+  const repoId = Number(env.payload.id);
+  const webhooks = rel.webhooks ?? [];
+  const relations = rel.pipe_relations ?? [];
+  const automations = rel.automations ?? [];
+  const inboxes = rel.email_inboxes ?? [];
+  const fields = rel.fields ?? [];
+
+  const outbound = automations.filter((a) => {
+    const action = s(a['action_id']) ?? '';
+    const target = s(a['action_repo_id']);
+    const crossRepo = target !== null && target !== s(a['event_repo_id']);
+    return crossRepo || OUTBOUND_ACTIONS.has(action);
+  });
+
+  const connectedFields = fields.filter((f) => s(f['connected_repo_id']) ?? s(f['connected_pipe_id']));
+
+  const edges: IntegrationEdge[] = [
+    ...webhooks.map(
+      (w): IntegrationEdge => ({
+        kind: 'webhook',
+        target: hostOf(w['url']),
+        id: s(w['id']),
+        detail:
+          `${s(w['name']) ?? 'unnamed'} on ` +
+          `${Array.isArray(w['actions']) ? (w['actions'] as unknown[]).join(', ') : (s(w['actions']) ?? 'no actions')}`,
+        bearsSecret: bearsSecret(w),
+      }),
+    ),
+    ...relations.map(
+      (r): IntegrationEdge => ({
+        kind: 'pipe_relation',
+        target: `repo ${s(r['child_id']) ?? s(r['parent_id']) ?? '?'}`,
+        id: s(r['id']),
+        detail: `${s(r['name']) ?? 'unnamed'} — parent ${s(r['parent_id'])} to child ${s(r['child_id'])}`,
+      }),
+    ),
+    ...outbound.map(
+      (a): IntegrationEdge => ({
+        kind: 'automation',
+        target:
+          s(a['action_repo_id']) && s(a['action_repo_id']) !== String(repoId)
+            ? `repo ${s(a['action_repo_id'])}`
+            : (s(a['action_id']) ?? 'action'),
+        id: s(a['id']),
+        detail:
+          `${s(a['name']) ?? 'unnamed'} — ${s(a['event_id'])} to ${s(a['action_id'])}` +
+          `${a['active'] === false ? ' (inactive)' : ''}`,
+        bearsSecret: bearsSecret(a),
+      }),
+    ),
+    ...connectedFields.map(
+      (f): IntegrationEdge => ({
+        kind: 'connected_field',
+        target: `repo ${s(f['connected_repo_id']) ?? s(f['connected_pipe_id'])}`,
+        id: s(f['id']),
+        // Payload rows spell the type `type_id`; a reconstructed row may spell it
+        // `type`. Neither is guaranteed, so both are tried before giving up.
+        detail: `field "${s(f['label']) ?? s(f['name']) ?? '?'}" (${s(f['type_id']) ?? s(f['type']) ?? 'unknown type'})`,
+      }),
+    ),
+    ...inboxes.map(
+      (i): IntegrationEdge => ({
+        kind: 'email_inbox',
+        target: s(i['email']) ?? s(i['name']) ?? 'inbox',
+        id: s(i['id']),
+        detail: 'inbound email',
+      }),
+    ),
+  ];
+
+  const connected = new Set<number>();
+  const note = (v: unknown) => {
+    const n = Number(v);
+    if (Number.isFinite(n) && n !== repoId && n !== 0) connected.add(n);
+  };
+  for (const r of relations) {
+    note(r['parent_id']);
+    note(r['child_id']);
+  }
+  for (const a of outbound) note(a['action_repo_id']);
+  for (const f of connectedFields) note(f['connected_repo_id'] ?? f['connected_pipe_id']);
+
+  const form = (rel.public_forms ?? [])[0] ?? null;
+
+  return {
+    generatedAt: new Date().toISOString(),
+    repoId,
+    repoName: String(env.payload['name'] ?? repoId),
+    coverage: {
+      webhooks: env.coverage.webhooks,
+      pipe_relations: env.coverage.pipe_relations,
+      automations: env.coverage.automations,
+      email_inboxes: env.coverage.email_inboxes,
+    },
+    counts: {
+      webhooks: webhooks.length,
+      pipe_relations: relations.length,
+      outbound_automations: outbound.length,
+      connected_fields: connectedFields.length,
+    },
+    edges,
+    connected_repo_ids: [...connected].sort((a, b) => a - b),
+    webhooks,
+    pipe_relations: relations,
+    outbound_automations: outbound,
+    email_inboxes: inboxes,
+    public_form: form ? { open: Boolean(env.payload['public']), title: form['title'] ?? null } : null,
+  };
+};
+
+/** The integration surface as report prose. Hosts kept, credentials never. */
+export const renderIntegrations = (v: IntegrationsView): string[] => {
+  const lines: string[] = [];
+  const gaps = Object.entries(v.coverage).filter(([, c]) => c !== 'complete');
+  if (gaps.length) {
+    lines.push(
+      `> Coverage: ${gaps.map(([k, c]) => `${k} is ${c}`).join(', ')}. ` +
+        'An absent row below is not evidence that nothing is there.',
+      '',
+    );
+  }
+  if (!v.edges.length) {
+    lines.push('This pipe reaches nothing outside itself.');
+    return lines;
+  }
+  lines.push('| Kind | Target | Id | Detail |', '| --- | --- | --- | --- |');
+  for (const e of v.edges) {
+    lines.push(
+      `| ${e.kind.replace(/_/g, ' ')} | ${e.target}${e.bearsSecret ? ' (key)' : ''} | ${e.id ?? '-'} | ` +
+        `${e.detail.replace(/\|/g, '\\|')} |`,
+    );
+  }
+  if (v.edges.some((e) => e.bearsSecret)) {
+    lines.push(
+      '',
+      '(key) marks a row that carries a credential. The value is in `integrations.json`, ' +
+        'which the workspace .gitignore covers.',
+    );
+  }
+  return lines;
+};