@proofhound/core 0.1.6

package/dist/server/modules/connector/connector.service.js

@@ -0,0 +1,682 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectorService = void 0;
+// Connector business service
+// See docs/specs/26-connectors.md §3 / §7 occupancy and deletion constraints
+// The inbound webhook token is self-managed by this module: create automatically generates the first token,
+// subsequently managed via listWebhookTokens / createWebhookToken / revokeWebhookToken.
+// See docs/specs/06-database-schema.md §3.2 / §4.5
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const logger_1 = require("@proofhound/logger");
+const access_control_1 = require("../../common/access-control");
+const access_control_service_1 = require("../../common/contracts/access-control.service");
+const workflow_authorization_hook_1 = require("../../common/contracts/workflow-authorization.hook");
+const crypto_service_1 = require("../../../shared/crypto/crypto.service");
+const connector_driver_factory_1 = require("./connector.driver-factory");
+const connector_repository_1 = require("./connector.repository");
+const EMPTY_REFERENCES = Object.freeze({
+    canaryReleases: 0,
+    productionReleases: 0,
+});
+const MAX_PEEK_SCHEMA_DEPTH = 6;
+const MAX_PEEK_SCHEMA_PROPERTIES = 200;
+const DEFAULT_INITIAL_WEBHOOK_TOKEN_NAME = 'Auto-generated webhook token';
+let ConnectorService = class ConnectorService {
+    constructor(repo, driverFactory, crypto, accessControl, workflowAuth) {
+        this.repo = repo;
+        this.driverFactory = driverFactory;
+        this.crypto = crypto;
+        this.accessControl = accessControl;
+        this.workflowAuth = workflowAuth;
+        this.logger = (0, logger_1.createLogger)('connector.service', { service: 'server' });
+    }
+    // -------------------------------------------------------------------------
+    // Queries
+    // -------------------------------------------------------------------------
+    async list(projectId, actor, query) {
+        await this.getAccessibleProject(projectId, actor);
+        const rows = await this.repo.listByProject(projectId, query);
+        const filtered = this.applySearch(rows, query?.search);
+        const references = await this.repo.countReferences(filtered.map((row) => row.id));
+        const tokenCounts = await this.repo.countActiveWebhookTokensByConnectorIds(filtered.map((row) => row.id));
+        const data = filtered.map((row) => this.toListItem(row, references.get(row.id) ?? this.cloneEmptyReferences(), tokenCounts.get(row.id) ?? 0));
+        return { data, total: data.length };
+    }
+    async getDetail(projectId, connectorId, actor) {
+        await this.getAccessibleProject(projectId, actor);
+        const row = await this.repo.findById(projectId, connectorId);
+        if (!row)
+            throw new common_1.NotFoundException(`Connector ${connectorId} not found`);
+        const counts = await this.repo.countReferences([row.id]);
+        const tokens = await this.loadWebhookTokenSummaries(row);
+        return this.toDetail(row, counts.get(row.id) ?? this.cloneEmptyReferences(), tokens);
+    }
+    async getReferences(projectId, connectorId, actor) {
+        await this.getAccessibleProject(projectId, actor);
+        const row = await this.repo.findById(projectId, connectorId);
+        if (!row)
+            throw new common_1.NotFoundException(`Connector ${connectorId} not found`);
+        const summary = (await this.repo.countReferences([row.id])).get(row.id) ?? this.cloneEmptyReferences();
+        const references = await this.repo.listReferenceDetails(connectorId);
+        return { summary, references };
+    }
+    // -------------------------------------------------------------------------
+    // Writes
+    // -------------------------------------------------------------------------
+    async create(projectId, dto, actor, source = 'api') {
+        void source;
+        await this.getWritableProject(projectId, actor);
+        await this.assertNameAvailable(projectId, dto.name);
+        const id = (0, node_crypto_1.randomUUID)();
+        const insert = this.buildInsertRow(id, projectId, dto, actor.sub);
+        const created = await this.repo.insert(insert);
+        // Webhook input connectors auto-generate the first webhook token on creation
+        let initialWebhookToken = null;
+        if (dto.type === 'webhook' && dto.direction === 'input') {
+            initialWebhookToken = await this.generateInitialWebhookToken(created.id, projectId, actor.sub);
+        }
+        const detail = await this.getDetail(projectId, created.id, actor);
+        if (!initialWebhookToken)
+            return detail;
+        return {
+            ...detail,
+            initialWebhookToken: {
+                id: initialWebhookToken.id,
+                name: initialWebhookToken.name,
+                prefix: initialWebhookToken.prefix,
+                plaintext: initialWebhookToken.plaintext,
+                expiresAt: initialWebhookToken.expiresAt?.toISOString() ?? null,
+            },
+        };
+    }
+    async update(projectId, connectorId, dto, actor, source = 'api') {
+        void source;
+        await this.getWritableProject(projectId, actor);
+        const existing = await this.repo.findById(projectId, connectorId);
+        if (!existing)
+            throw new common_1.NotFoundException(`Connector ${connectorId} not found`);
+        if (dto.name !== undefined && dto.name !== existing.name) {
+            await this.assertNameAvailable(projectId, dto.name, connectorId);
+        }
+        const patch = {};
+        if (dto.name !== undefined)
+            patch.name = dto.name;
+        if (dto.description !== undefined)
+            patch.description = dto.description ?? null;
+        if (dto.config !== undefined) {
+            this.assertConfigShape(existing.type, existing.direction, dto.config);
+            patch.config = this.mergePersistentConfig(existing.config, dto.config);
+        }
+        if (dto.credentials !== undefined) {
+            const credentialType = existing.type === 'redis' || existing.type === 'kafka' ? existing.type : null;
+            if (!credentialType) {
+                throw new common_1.BadRequestException('credentials apply only to redis / kafka connectors');
+            }
+            const configEncrypted = this.buildUpdatedProjectConnectorEncryptedConfig(existing.configEncrypted, credentialType, dto.credentials);
+            if (configEncrypted !== undefined)
+                patch.configEncrypted = configEncrypted;
+        }
+        // ipWhitelist is only allowed for the webhook type
+        if (dto.ipWhitelist !== undefined) {
+            if (existing.type !== 'webhook') {
+                throw new common_1.BadRequestException('ipWhitelist applies only to webhook connectors');
+            }
+            patch.ipWhitelist = dto.ipWhitelist;
+        }
+        // dto.tokenId is deprecated: webhook tokens are managed via createWebhookToken / revokeWebhookToken.
+        // Silently ignored here to keep the legacy frontend form working during the transition.
+        if (dto.tokenId !== undefined) {
+            this.logger.warn({ connectorId, projectId, tokenId: dto.tokenId }, 'connector_update_tokenId_ignored_deprecated');
+        }
+        await this.repo.update(projectId, connectorId, patch);
+        return this.getDetail(projectId, connectorId, actor);
+    }
+    async delete(projectId, connectorId, query, actor, source = 'api') {
+        void source;
+        await this.getWritableProject(projectId, actor);
+        const existing = await this.repo.findById(projectId, connectorId);
+        if (!existing)
+            throw new common_1.NotFoundException(`Connector ${connectorId} not found`);
+        const force = query.force ?? false;
+        if (!force) {
+            const counts = (await this.repo.countReferences([connectorId])).get(connectorId) ?? this.cloneEmptyReferences();
+            const total = counts.canaryReleases + counts.productionReleases;
+            if (total > 0) {
+                throw new common_1.ConflictException(`connector_referenced:${total}`);
+            }
+        }
+        await this.repo.softDelete(projectId, connectorId);
+    }
+    async bulkDelete(projectId, dto, actor, source = 'api') {
+        void source;
+        await this.getWritableProject(projectId, actor);
+        const force = dto.force ?? false;
+        const deletedIds = [];
+        const rejected = [];
+        const rows = await this.repo.findManyByIds(projectId, dto.ids);
+        const found = new Map(rows.map((row) => [row.id, row]));
+        const refMap = await this.repo.countReferences(dto.ids);
+        for (const id of dto.ids) {
+            const row = found.get(id);
+            if (!row) {
+                rejected.push({ id, reason: 'not_found' });
+                continue;
+            }
+            const refs = refMap.get(id) ?? this.cloneEmptyReferences();
+            const totalRefs = refs.canaryReleases + refs.productionReleases;
+            if (!force && totalRefs > 0) {
+                rejected.push({ id, reason: 'connector_referenced', referencedBy: refs });
+                continue;
+            }
+            await this.repo.softDelete(projectId, id);
+            deletedIds.push(id);
+        }
+        return { deletedIds, rejected };
+    }
+    // -------------------------------------------------------------------------
+    // webhook token: list / create / revoke
+    // -------------------------------------------------------------------------
+    async listWebhookTokens(projectId, connectorId, actor) {
+        await this.getAccessibleProject(projectId, actor);
+        const row = await this.repo.findById(projectId, connectorId);
+        if (!row)
+            throw new common_1.NotFoundException(`Connector ${connectorId} not found`);
+        const tokens = await this.repo.listWebhookTokensForConnector(connectorId);
+        const data = tokens.map((token) => this.toWebhookTokenSummary(token));
+        return { data, total: data.length };
+    }
+    async createWebhookToken(projectId, connectorId, dto, actor, source = 'api') {
+        void source;
+        await this.getWritableProject(projectId, actor);
+        const row = await this.repo.findById(projectId, connectorId);
+        if (!row)
+            throw new common_1.NotFoundException(`Connector ${connectorId} not found`);
+        if (row.type !== 'webhook' || row.direction !== 'input') {
+            throw new common_1.BadRequestException('webhook tokens apply only to webhook input connectors');
+        }
+        const expiresAt = dto.expiresAt ? new Date(dto.expiresAt) : null;
+        const plaintext = this.generateWebhookTokenPlaintext();
+        const tokenHash = this.hashToken(plaintext);
+        const prefix = plaintext.slice(0, 12);
+        const name = dto.name?.trim() && dto.name.trim().length > 0 ? dto.name.trim() : DEFAULT_INITIAL_WEBHOOK_TOKEN_NAME;
+        const inserted = await this.repo.insertWebhookToken({
+            connectorId,
+            projectId,
+            name,
+            tokenHash,
+            tokenEncrypted: this.crypto.encryptApiKey(plaintext),
+            prefix,
+            expiresAt,
+            createdBy: actor.sub,
+        });
+        return {
+            id: inserted.id,
+            name,
+            prefix,
+            plaintext,
+            expiresAt: expiresAt?.toISOString() ?? null,
+        };
+    }
+    async revokeWebhookToken(projectId, connectorId, tokenId, actor, source = 'api') {
+        void source;
+        await this.getWritableProject(projectId, actor);
+        const row = await this.repo.findById(projectId, connectorId);
+        if (!row)
+            throw new common_1.NotFoundException(`Connector ${connectorId} not found`);
+        const token = await this.repo.findWebhookTokenById(connectorId, tokenId);
+        if (!token)
+            throw new common_1.NotFoundException(`webhook token ${tokenId} not found`);
+        const revoked = await this.repo.revokeWebhookToken(connectorId, tokenId);
+        if (!revoked)
+            throw new common_1.NotFoundException(`webhook token ${tokenId} not found`);
+        const remaining = await this.repo.countActiveWebhookTokens(connectorId);
+        if (remaining === 0) {
+            this.logger.warn({ projectId, connectorId, tokenId }, 'connector_webhook_token_revoke_left_zero_active_tokens');
+        }
+    }
+    // Aligned with token.service's revealApiToken / revealGlobalMcpToken:
+    // decrypt from token_encrypted and return the plaintext, allowing the local admin console to reveal multiple times (SPEC 06 §3.2).
+    async revealWebhookToken(projectId, connectorId, tokenId, actor, source = 'api') {
+        void source;
+        await this.getWritableProject(projectId, actor);
+        const row = await this.repo.findById(projectId, connectorId);
+        if (!row)
+            throw new common_1.NotFoundException(`Connector ${connectorId} not found`);
+        const token = await this.repo.findWebhookTokenWithEncryptedById(connectorId, tokenId);
+        if (!token)
+            throw new common_1.NotFoundException(`webhook token ${tokenId} not found`);
+        const plaintext = token.tokenEncrypted ? this.crypto.decryptApiKey(token.tokenEncrypted) : null;
+        return { tokenId, plaintext, available: Boolean(plaintext) };
+    }
+    // -------------------------------------------------------------------------
+    // probe / peek (driver)
+    // -------------------------------------------------------------------------
+    async probe(projectId, connectorId, actor, source = 'api', orgId) {
+        void source;
+        await this.getAccessibleProject(projectId, actor);
+        const row = await this.repo.findById(projectId, connectorId);
+        if (!row)
+            throw new common_1.NotFoundException(`Connector ${connectorId} not found`);
+        await this.assertProbeWorkflowStart(projectId, actor, orgId);
+        const startedAt = Date.now();
+        const driverResult = await this.driverFactory.probe({
+            configEncrypted: row.configEncrypted,
+            type: row.type,
+            direction: row.direction,
+            config: (row.config ?? {}),
+        });
+        const error = driverResult.error;
+        const probedAt = new Date();
+        const durationMs = Math.max(1, Date.now() - startedAt);
+        await this.repo.updateProbeOutcome(projectId, connectorId, probedAt, error);
+        return {
+            connectorId,
+            status: error ? 'failed' : 'success',
+            probedAt: probedAt.toISOString(),
+            durationMs,
+            error,
+        };
+    }
+    async peek(projectId, connectorId, body, actor, source = 'api') {
+        void source;
+        await this.getAccessibleProject(projectId, actor);
+        const row = await this.repo.findById(projectId, connectorId);
+        if (!row)
+            throw new common_1.NotFoundException(`Connector ${connectorId} not found`);
+        if (row.direction !== 'input') {
+            throw new common_1.BadRequestException('peek_not_supported_for_output');
+        }
+        const limit = body.limit ?? 5;
+        const config = (row.config ?? {});
+        const driverResult = await this.driverFactory.peek({
+            configEncrypted: row.configEncrypted,
+            type: row.type,
+            direction: 'input',
+            config,
+            limit,
+        });
+        const fetchedAt = new Date().toISOString();
+        const persistedMessages = driverResult.error ? [] : driverResult.messages;
+        const payloadSchema = this.inferPeekPayloadSchema(persistedMessages);
+        if (row.type === 'redis' || row.type === 'kafka') {
+            await this.repo.update(projectId, connectorId, {
+                config: this.withLatestPeekMetadata(config, payloadSchema, persistedMessages[0] ?? null, fetchedAt, persistedMessages.length),
+                healthStatus: driverResult.error ? 'unhealthy' : 'healthy',
+                lastProbedAt: new Date(fetchedAt),
+                lastProbeError: driverResult.error,
+            });
+        }
+        return {
+            connectorId,
+            source: driverResult.source,
+            messages: persistedMessages,
+            payloadSchema,
+            fetchedAt,
+            error: driverResult.error,
+        };
+    }
+    // -------------------------------------------------------------------------
+    // helpers
+    // -------------------------------------------------------------------------
+    async generateInitialWebhookToken(connectorId, projectId, createdBy) {
+        const plaintext = this.generateWebhookTokenPlaintext();
+        const tokenHash = this.hashToken(plaintext);
+        const prefix = plaintext.slice(0, 12);
+        const name = DEFAULT_INITIAL_WEBHOOK_TOKEN_NAME;
+        const inserted = await this.repo.insertWebhookToken({
+            connectorId,
+            projectId,
+            name,
+            tokenHash,
+            tokenEncrypted: this.crypto.encryptApiKey(plaintext),
+            prefix,
+            expiresAt: null,
+            createdBy,
+        });
+        return { id: inserted.id, name, prefix, plaintext, expiresAt: null };
+    }
+    generateWebhookTokenPlaintext() {
+        return `ph_wh_${(0, node_crypto_1.randomBytes)(24).toString('base64url')}`;
+    }
+    hashToken(plaintext) {
+        return (0, node_crypto_1.createHash)('sha256').update(plaintext).digest('hex');
+    }
+    async assertProbeWorkflowStart(projectId, actor, orgId) {
+        const project = orgId ? { projectId, orgId, source: 'local' } : { projectId, source: 'local' };
+        await this.workflowAuth.assertCanStart((0, access_control_1.toActorContext)(actor), project, 'probe');
+    }
+    async loadWebhookTokenSummaries(row) {
+        if (row.type !== 'webhook' || row.direction !== 'input')
+            return [];
+        const tokens = await this.repo.listWebhookTokensForConnector(row.id);
+        return tokens.map((token) => this.toWebhookTokenSummary(token));
+    }
+    toWebhookTokenSummary(token) {
+        return {
+            id: token.id,
+            name: token.name,
+            prefix: token.prefix,
+            expiresAt: token.expiresAt?.toISOString() ?? null,
+            lastUsedAt: token.lastUsedAt?.toISOString() ?? null,
+            createdAt: token.createdAt.toISOString(),
+        };
+    }
+    withLatestPeekMetadata(config, payloadSchema, latestMessage, fetchedAt, messageCount) {
+        const base = this.isRecord(config) ? { ...config } : {};
+        return {
+            ...base,
+            lastPeekPayloadSchema: payloadSchema,
+            lastPeekMessage: latestMessage,
+            lastPeekedAt: fetchedAt,
+            lastPeekMessageCount: messageCount,
+        };
+    }
+    inferPeekPayloadSchema(messages) {
+        if (messages.length === 0)
+            return null;
+        return this.mergeValueSchemas(messages.map((message) => this.inferValueSchema(message.payload)));
+    }
+    inferValueSchema(value, depth = 0) {
+        if (value === null)
+            return { type: 'null' };
+        if (Array.isArray(value)) {
+            const itemSchemas = value
+                .slice(0, MAX_PEEK_SCHEMA_PROPERTIES)
+                .map((item) => this.inferValueSchema(item, depth + 1));
+            return itemSchemas.length > 0 ? { type: 'array', items: this.mergeValueSchemas(itemSchemas) } : { type: 'array' };
+        }
+        const valueType = typeof value;
+        if (valueType === 'string')
+            return { type: 'string' };
+        if (valueType === 'number')
+            return { type: Number.isInteger(value) ? 'integer' : 'number' };
+        if (valueType === 'boolean')
+            return { type: 'boolean' };
+        if (valueType !== 'object' || !this.isRecord(value))
+            return { type: 'unknown' };
+        if (depth >= MAX_PEEK_SCHEMA_DEPTH)
+            return { type: 'object' };
+        const properties = {};
+        for (const [key, child] of Object.entries(value).slice(0, MAX_PEEK_SCHEMA_PROPERTIES)) {
+            properties[key] = this.inferValueSchema(child, depth + 1);
+        }
+        return { type: 'object', properties };
+    }
+    mergeValueSchemas(schemas) {
+        const nonNullSchemas = schemas.filter((schema) => schema.type !== 'null');
+        if (nonNullSchemas.length === 0)
+            return { type: 'null' };
+        const normalizedTypes = new Set(nonNullSchemas.map((schema) => schema.type));
+        if (normalizedTypes.has('number') && normalizedTypes.has('integer')) {
+            normalizedTypes.delete('integer');
+        }
+        if (normalizedTypes.size > 1)
+            return { type: 'unknown' };
+        const [type] = Array.from(normalizedTypes);
+        if (type === 'object') {
+            return { type: 'object', properties: this.mergeObjectProperties(nonNullSchemas) };
+        }
+        if (type === 'array') {
+            const itemSchemas = nonNullSchemas
+                .map((schema) => schema.items)
+                .filter((item) => this.isRecord(item));
+            return itemSchemas.length > 0 ? { type: 'array', items: this.mergeValueSchemas(itemSchemas) } : { type: 'array' };
+        }
+        return { type: type === 'number' ? 'number' : String(type ?? 'unknown') };
+    }
+    mergeObjectProperties(schemas) {
+        const keys = new Set();
+        const propertyMaps = schemas.map((schema) => (this.isRecord(schema.properties) ? schema.properties : {}));
+        for (const properties of propertyMaps) {
+            for (const key of Object.keys(properties))
+                keys.add(key);
+        }
+        const merged = {};
+        for (const key of keys) {
+            const childSchemas = propertyMaps
+                .map((properties) => properties[key])
+                .filter((value) => this.isRecord(value));
+            if (childSchemas.length > 0)
+                merged[key] = this.mergeValueSchemas(childSchemas);
+        }
+        return merged;
+    }
+    isRecord(value) {
+        return typeof value === 'object' && value !== null && !Array.isArray(value);
+    }
+    cloneEmptyReferences() {
+        return { ...EMPTY_REFERENCES };
+    }
+    async getAccessibleProject(projectId, actor) {
+        await this.accessControl.assertCan((0, access_control_1.toActorContext)(actor), { projectId, source: 'local' }, 'project_read');
+        const project = await this.repo.findProjectAccess(actor.sub, projectId, actor.isSuperAdmin);
+        if (!project)
+            throw new common_1.NotFoundException(`Workspace ${projectId} not found`);
+        return project;
+    }
+    async getWritableProject(projectId, actor) {
+        await this.accessControl.assertCan((0, access_control_1.toActorContext)(actor), { projectId, source: 'local' }, 'project_write');
+        return this.getAccessibleProject(projectId, actor);
+    }
+    async assertNameAvailable(projectId, name, excludeId) {
+        const existing = await this.repo.findByProjectAndName(projectId, name, excludeId);
+        if (existing)
+            throw new common_1.ConflictException(`connector_name_in_use:${name}`);
+    }
+    buildInsertRow(id, projectId, dto, createdBy) {
+        const base = {
+            id,
+            projectId,
+            name: dto.name,
+            description: dto.description ?? null,
+            direction: dto.direction,
+            type: dto.type,
+            healthStatus: 'unknown',
+            lastProbedAt: null,
+            lastProbeError: null,
+            createdBy,
+        };
+        if (dto.type === 'redis' || dto.type === 'kafka') {
+            const config = dto.config;
+            this.assertProjectConnectionConfigured(dto.type, config);
+            return {
+                ...base,
+                config,
+                configEncrypted: this.buildProjectConnectorEncryptedConfig(dto),
+                webhookPath: null,
+                ipWhitelist: null,
+            };
+        }
+        // Webhook branch
+        if (dto.direction === 'input') {
+            // Note: generating webhookPath asynchronously in the service layer would introduce nested async, so we use synchronous allocation.
+            // Since the collision probability of randomUUID is ~0, generate it directly; if a collision really happens, the DB unique index will reject it.
+            return {
+                ...base,
+                configEncrypted: null,
+                config: dto.config,
+                webhookPath: (0, node_crypto_1.randomUUID)(),
+                ipWhitelist: dto.ipWhitelist ?? null,
+            };
+        }
+        // Webhook output: no path / token needed; only targetUrl is recorded in config
+        return {
+            ...base,
+            configEncrypted: null,
+            config: dto.config,
+            webhookPath: null,
+            ipWhitelist: null,
+        };
+    }
+    assertProjectConnectionConfigured(type, config) {
+        const record = this.isRecord(config) ? config : null;
+        const rawConnection = record?.['connection'];
+        const connection = this.isRecord(rawConnection) ? rawConnection : null;
+        if (!connection) {
+            throw new common_1.BadRequestException(`${type} connector requires local connection config`);
+        }
+        if (type === 'redis') {
+            if (!connection.host)
+                throw new common_1.BadRequestException('redis connector connection.host is required');
+            if (!connection.port)
+                throw new common_1.BadRequestException('redis connector connection.port is required');
+            return;
+        }
+        const bootstrapBrokers = connection.bootstrapBrokers;
+        if (!Array.isArray(bootstrapBrokers) || bootstrapBrokers.length === 0) {
+            throw new common_1.BadRequestException('kafka connector connection.bootstrapBrokers is required');
+        }
+    }
+    buildProjectConnectorEncryptedConfig(dto) {
+        if (dto.type === 'redis') {
+            const password = dto.credentials?.password;
+            return password ? this.encryptBrokerConfig({ password }) : null;
+        }
+        const saslPassword = dto.credentials?.saslPassword;
+        return saslPassword ? this.encryptBrokerConfig({ saslPassword }) : null;
+    }
+    buildUpdatedProjectConnectorEncryptedConfig(existingEncrypted, type, credentials) {
+        const existing = this.decryptBrokerConfig(existingEncrypted);
+        if (type === 'redis') {
+            if (!('password' in credentials) || !credentials.password)
+                return undefined;
+            return this.encryptBrokerConfig({ ...existing, password: credentials.password });
+        }
+        if (!('saslPassword' in credentials) || !credentials.saslPassword)
+            return undefined;
+        return this.encryptBrokerConfig({ ...existing, saslPassword: credentials.saslPassword });
+    }
+    mergePersistentConfig(existing, next) {
+        if (!this.isRecord(existing) || !this.isRecord(next))
+            return next;
+        const merged = { ...next };
+        if (!this.isRecord(merged.connection) && this.isRecord(existing.connection)) {
+            merged.connection = existing.connection;
+        }
+        return merged;
+    }
+    encryptBrokerConfig(value) {
+        return this.crypto.encryptApiKey(JSON.stringify(value));
+    }
+    decryptBrokerConfig(payload) {
+        if (typeof payload === 'string') {
+            try {
+                const plain = this.crypto.decryptApiKey(payload);
+                const parsed = JSON.parse(plain);
+                if (parsed && typeof parsed === 'object')
+                    return parsed;
+            }
+            catch (error) {
+                this.logger.warn({ msg: 'decrypt_connector_broker_config_failed', error: error.message });
+            }
+            return {};
+        }
+        if (payload && typeof payload === 'object')
+            return payload;
+        return {};
+    }
+    assertConfigShape(type, direction, _config) {
+        if (!['redis', 'kafka', 'webhook'].includes(type)) {
+            throw new common_1.BadRequestException(`invalid connector type: ${type}`);
+        }
+        if (!['input', 'output'].includes(direction)) {
+            throw new common_1.BadRequestException(`invalid connector direction: ${direction}`);
+        }
+    }
+    applySearch(rows, search) {
+        if (!search)
+            return rows;
+        const needle = search.trim().toLowerCase();
+        if (!needle)
+            return rows;
+        return rows.filter((row) => {
+            if (row.name.toLowerCase().includes(needle))
+                return true;
+            if (row.description?.toLowerCase().includes(needle))
+                return true;
+            if (row.webhookPath?.toLowerCase().includes(needle))
+                return true;
+            const configStr = row.config ? JSON.stringify(row.config).toLowerCase() : '';
+            return configStr.includes(needle);
+        });
+    }
+    // -------------------------------------------------------------------------
+    // DTO mappers
+    // -------------------------------------------------------------------------
+    toConfigSummary(row) {
+        const config = row.config;
+        if (!config)
+            return '';
+        if (row.type === 'redis') {
+            const mode = String(config.mode ?? '');
+            const key = String(config.key ?? '');
+            return `${mode}: ${key}`;
+        }
+        if (row.type === 'kafka') {
+            const topic = String(config.topic ?? '');
+            const group = config.consumerGroup ? `·${String(config.consumerGroup)}` : '';
+            return `topic: ${topic}${group}`;
+        }
+        if (row.type === 'webhook') {
+            if (row.direction === 'input') {
+                const mode = String(config.webhookMode ?? '');
+                return `webhook ${mode}`;
+            }
+            const target = String(config.targetUrl ?? '');
+            return `→ ${target}`;
+        }
+        return '';
+    }
+    toListItem(row, references, activeWebhookTokenCount) {
+        const ipWhitelistArr = row.ipWhitelist ?? null;
+        return {
+            id: row.id,
+            projectId: row.projectId,
+            name: row.name,
+            description: row.description ?? null,
+            direction: row.direction,
+            type: row.type,
+            webhookPath: row.webhookPath ?? null,
+            hasToken: activeWebhookTokenCount > 0,
+            ipWhitelistCount: ipWhitelistArr?.length ?? 0,
+            configSummary: this.toConfigSummary(row),
+            healthStatus: row.healthStatus,
+            lastProbedAt: row.lastProbedAt?.toISOString() ?? null,
+            lastProbeError: row.lastProbeError ?? null,
+            references,
+            createdBy: row.createdBy,
+            createdByDisplayName: row.createdByDisplayName ?? null,
+            createdAt: row.createdAt.toISOString(),
+            updatedAt: row.updatedAt.toISOString(),
+        };
+    }
+    toDetail(row, references, webhookTokens) {
+        const listItem = this.toListItem(row, references, webhookTokens.length);
+        return {
+            ...listItem,
+            config: row.config,
+            webhookTokens,
+            ipWhitelist: row.ipWhitelist ?? null,
+        };
+    }
+};
+exports.ConnectorService = ConnectorService;
+exports.ConnectorService = ConnectorService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [connector_repository_1.ConnectorRepository,
+        connector_driver_factory_1.ConnectorDriverFactory,
+        crypto_service_1.CryptoService,
+        access_control_service_1.AccessControlService,
+        workflow_authorization_hook_1.WorkflowAuthorizationHook])
+], ConnectorService);
+//# sourceMappingURL=connector.service.js.map