@protobase/server 0.68.6 → 0.69.1

package/dist/workflows/triggers/trigger-start.js

@@ -1,4 +1,4 @@
-import { callPlugin, redactAlso, triggerContext } from "./plugin-call.js";
+import { callPlugin, redactAlso, triggerCall } from "./plugin-call.js";
 import { stateProblem } from "./poll-result.js";
 import { hookMode } from "../hooks/hook-secrets.js";
 import { hookPath } from "../hooks/hook-paths.js";
@@ -47,7 +47,8 @@ const triggerStarts = (input, jobs) => {
 		const due = first.value;
 		let cursor = state.cursor;
 		if (!state.has_cursor) {
-			const outcome = await callPlugin(() => type.start(triggerContext(input, trigger.input, signal)), redact);
+			const call = triggerCall(input, trigger, signal, redact);
+			const outcome = await callPlugin(() => type.start(call.context), call.redact);
 			if (!("value" in outcome)) return startFailed(db, schema, trigger, outcome, state.consecutive_failures, restart);
 			const problem = stateProblem(outcome.value);
 			if (problem) return startFailed(db, schema, trigger, { failed: `The start ${problem}` }, state.consecutive_failures, restart);
@@ -63,7 +64,16 @@ const triggerStarts = (input, jobs) => {
 		const type = input.webhooks(trigger.type);
 		const state = type?.subscribe && await stateOf(db, schema, trigger);
 		const mode = hookMode(trigger.input);
-		if (!type?.subscribe || !state || state.has_store) return;
+		if (!type?.subscribe || !state) return;
+		if (state.has_store) {
+			if (!type.renew) return;
+			const now = /* @__PURE__ */ new Date();
+			return saveStart(db, schema, trigger, "store", null, now, (trx) => jobs.renew.enqueue(trx, {
+				trigger: trigger.id,
+				generation: trigger.generation,
+				due: now.toISOString()
+			}, { runAt: now }));
+		}
 		const origin = input.origin();
 		if (!origin || !mode) return startFailed(db, schema, trigger, { failed: origin ? "The trigger names an auth mode the app does not know" : "The app has no public address to subscribe with: give its auth a baseURL" }, state.consecutive_failures, restart);
 		const { key, secret } = await saveHook(db, schema, {
@@ -77,11 +87,12 @@ const triggerStarts = (input, jobs) => {
 			secret,
 			secret.replace(/^whsec_/, "")
 		], redact);
+		const call = triggerCall(input, trigger, signal, hidden);
 		const outcome = await callPlugin(() => subscribe({
-			...triggerContext(input, trigger.input, signal),
+			...call.context,
 			url: `${origin}${hookPath(input.systemPath(), key)}`,
 			secret
-		}), hidden);
+		}), call.redact);
 		if (!("value" in outcome)) return startFailed(db, schema, trigger, outcome, state.consecutive_failures, restart);
 		const problem = stateProblem(outcome.value);
 		if (problem) return startFailed(db, schema, trigger, { failed: `The subscription ${problem}` }, state.consecutive_failures, restart);

package/dist/workflows/triggers/trigger-sync.js

@@ -1,26 +1,31 @@
 import { badRequest } from "../../problem.js";
 import { sql } from "kysely";
 //#region src/workflows/triggers/trigger-sync.ts
-const triggerOf = (definition) => {
-	const [type, input] = Object.entries(definition.trigger)[0];
-	return type === "manual" ? void 0 : {
+const triggerOf = (definition, connectionOf) => {
+	const document = definition;
+	const [type, input] = Object.entries(document.trigger)[0];
+	if (type === "manual") return;
+	const key = connectionOf[type];
+	return {
 		type,
-		input
+		input,
+		connection: key !== void 0 && document.connections?.[key] || null
 	};
 };
 /**
 * Keeps a workflow's trigger row in step with its enabled version, in the write's transaction, queueing its jobs in that
 * same write: turning it on inserts a running trigger and queues its start; a new version with the same type and input
 * keeps the row, so its state carries over, and passes over the records again; any other change, or turning it off, stops the old row and starts a new one.
-* Only the current version can be turned on.
+* The row keeps the account the trigger's connection binds (`connectionOf` names each type's connection), so an
+* expired sign-in stops every trigger on it, and connecting it again resumes them. Only the current version can be turned on.
 */
-const syncTrigger = async (trx, schema, jobs, workflow) => {
+const syncTrigger = async (trx, schema, jobs, workflow, connectionOf = {}) => {
 	const enabled = workflow.enabled_version;
 	if (enabled !== null && enabled !== workflow.version) throw badRequest("invalid-workflow", `Only the current version can be enabled: set enabled_version to ${String(workflow.version)}, or clear it to turn the workflow off`);
-	const wanted = enabled === null ? void 0 : triggerOf(workflow.definition);
+	const wanted = enabled === null ? void 0 : triggerOf(workflow.definition, connectionOf);
 	const triggers = sql.id(schema, "triggers");
 	const id = String(workflow.id);
-	const { rows } = await sql`select id, generation, version, (type = ${wanted?.type ?? null} and input = ${JSON.stringify(wanted?.input ?? null)}::jsonb and connection_id is null) as same
+	const { rows } = await sql`select id, generation, version, (type = ${wanted?.type ?? null} and input = ${JSON.stringify(wanted?.input ?? null)}::jsonb and connection_id is not distinct from ${wanted?.connection ?? null}::text) as same
     from ${triggers} where workflow_id = ${id} and status <> 'stopping'`.execute(trx);
 	const existing = rows[0];
 	if (existing?.same) {
@@ -37,8 +42,8 @@ const syncTrigger = async (trx, schema, jobs, workflow) => {
 		await jobs.stop.enqueue(trx, { trigger: existing.id });
 	}
 	if (!wanted) return;
-	const trigger = (await sql`insert into ${triggers} (workflow_id, version, tenant_id, type, input, status, generation, consecutive_failures)
-    values (${id}, ${enabled}, ${workflow.tenant_id ?? null}, ${wanted.type}, ${JSON.stringify(wanted.input)}::jsonb, 'active', 1, 0) returning id`.execute(trx)).rows[0].id;
+	const trigger = (await sql`insert into ${triggers} (workflow_id, version, tenant_id, type, input, connection_id, status, generation, consecutive_failures)
+    values (${id}, ${enabled}, ${workflow.tenant_id ?? null}, ${wanted.type}, ${JSON.stringify(wanted.input)}::jsonb, ${wanted.connection}, 'active', 1, 0) returning id`.execute(trx)).rows[0].id;
 	await jobs.start.enqueue(trx, {
 		trigger,
 		generation: 1

package/dist/workflows/workflow-engine.js

@@ -9,6 +9,9 @@ import { issueRoute } from "./hooks/issue-route.js";
 import { workflowDeleteHook } from "./triggers/delete-hook.js";
 import { triggerJobs } from "./triggers/trigger-jobs.js";
 import { workflowTypes } from "./workflow-types.js";
+import { betterAuthConnectionAccounts } from "./connections/connection-accounts.js";
+import { connectionWiring } from "./connections/connection-wiring.js";
+import { connectionTriggers } from "./connections/connection-triggers.js";
 import { secretRedactor } from "@protobase/workflows";
 //#region src/workflows/workflow-engine.ts
 /**
@@ -21,17 +24,28 @@ const workflowEngine = (options, deps, auth) => {
 	const schema = workflowsSchema(options);
 	const roles = options.savedByRoles ?? (auth && betterAuthOwnerRoles(auth));
 	if (!roles) throw new Error("workflows act on records as each workflow's last editor, with their current roles: give the config `auth` (Better Auth), or `workflows.savedByRoles`");
+	const secrets = workflowSecrets(options, globalThis.process?.env ?? {});
+	const types = workflowTypes(options.plugins, (name) => deps().registry.find(name)?.model, auth?.connectionSupport);
+	const accounts = auth && betterAuthConnectionAccounts(auth);
+	const connections = connectionWiring({
+		deps,
+		schema,
+		roles,
+		accounts,
+		plugins: types.plugins,
+		connectionOf: types.connections,
+		...auth && auth.personalMail.length > 0 && { personalMailer: auth.personalMailer }
+	});
 	const input = {
 		deps,
 		schema,
 		roles,
-		allowPrivateAddresses: Boolean(options.allowPrivateAddresses)
+		allowPrivateAddresses: Boolean(options.allowPrivateAddresses),
+		connect: connections.trigger
 	};
-	const secrets = workflowSecrets(options, globalThis.process?.env ?? {});
-	const types = workflowTypes(options.plugins, (name) => deps().registry.find(name)?.model);
 	const { runner, job } = workflowsRunner({
 		schema,
-		tasks: (context) => types.tasks(input, context.mail),
+		tasks: (context) => types.tasks(input, context.mail, connections.step, connections.mailbox),
 		secrets
 	});
 	const redactor = secretRedactor(Object.values(secrets));
@@ -46,6 +60,7 @@ const workflowEngine = (options, deps, auth) => {
 		origin: () => auth?.origins[0],
 		systemPath: () => deps().systemPath
 	});
+	auth?.connections.events.set(connectionTriggers(() => deps().db, schema, triggers));
 	const webhooks = usable(types.webhooks);
 	const issue = {
 		deps,
@@ -68,7 +83,7 @@ const workflowEngine = (options, deps, auth) => {
 		},
 		issue,
 		hooks: [
-			workflowSaveHook(schema, types.check, triggers),
+			workflowSaveHook(schema, types.check, triggers, connections.consent),
 			workflowDeleteHook(schema, triggers),
 			runStartHook(runner, deps, schema)
 		],

package/dist/workflows/workflow-types.d.ts

@@ -1,7 +1,7 @@
 import { Mailer } from "../mail/mail-message.js";
 import { ServicesInput } from "./plugin-services.js";
 import { ResourceModel } from "@protobase/schema";
-import { CheckOptions, LoadedPlugin, TaskHandlers } from "@protobase/workflows";
+import { CheckOptions, ConnectionSupport, LoadedPlugin, StepWiring, TaskHandlers } from "@protobase/workflows";
 import { Plugin, PollingTrigger, ReadyTrigger, WebhookTrigger } from "@protobase/workflows/plugin";
 //#region src/workflows/workflow-types.d.ts
 type Models = (name: string) => ResourceModel | undefined;
@@ -9,16 +9,20 @@ type Models = (name: string) => ResourceModel | undefined;
  * The trigger and step types of an app: the built-in plugin, `app`, then the app's own, all through the same loader and
  * interface. `types` is the list the MCP tools and the editor read; `check` is what a save checks a definition against,
  * the available types only, and `checkWith` the same check against other resources, such as those a caller may read.
+ * A type that signs in is available once the app can make its connection, as `support` says.
  */
-export declare const workflowTypes: (loaded?: readonly LoadedPlugin[], models?: Models) => {
+export declare const workflowTypes: (loaded?: readonly LoadedPlugin[], models?: Models, support?: ConnectionSupport) => {
   plugins: Plugin[];
   types: import("@protobase/workflows").TypeEntry[];
   check: CheckOptions;
   checkWith: (against: Models) => CheckOptions;
-  tasks: (input: ServicesInput, mail: Mailer | undefined) => TaskHandlers;
+  tasks: (input: ServicesInput, mail: Mailer | undefined, connection: StepWiring["connection"], mailbox?: StepWiring["mailbox"]) => TaskHandlers;
   ready: Map<string, ReadyTrigger>;
   polling: Map<string, PollingTrigger>;
   webhooks: Map<string, WebhookTrigger>;
+  connections: {
+    [k: string]: string;
+  };
   available: (id: string) => boolean;
 };
 export type WorkflowTypes = ReturnType<typeof workflowTypes>;

package/dist/workflows/workflow-types.js

@@ -1,13 +1,8 @@
 import { pluginServices } from "./plugin-services.js";
 import { readyProblems } from "./ready/ready-check.js";
-import { loadPlugins, stepHandlers, triggerChecks, typeList } from "@protobase/workflows";
-import { ConnectionError } from "@protobase/workflows/plugin";
+import { connectionUnavailable, loadPlugins, stepHandlers, triggerChecks, typeList } from "@protobase/workflows";
 import { appPlugin } from "@protobase/workflow-plugins";
 //#region src/workflows/workflow-types.ts
-const unavailable = (type) => {
-	if (type.connection) return "It signs in through a connection, which this app cannot make yet";
-};
-const noConnection = (stepId, name) => ({ accessToken: () => Promise.reject(new ConnectionError("not_connected", `${stepId} signs in through "${name}", and this workflow has no sign-in for it`)) });
 const requiredInputs = (input) => Array.isArray(input.required) ? input.required : [];
 /** The triggers of `plugins` of one kind, by id. */
 const triggersOfKind = (plugins, kind) => new Map(plugins.flatMap((plugin) => Object.entries(plugin.triggers ?? {}).flatMap(([key, type]) => type.kind === kind ? [[`${plugin.name}:${key}`, type]] : [])));
@@ -17,13 +12,15 @@ const readyTriggers = (plugins) => triggersOfKind(plugins, "ready");
 * The trigger and step types of an app: the built-in plugin, `app`, then the app's own, all through the same loader and
 * interface. `types` is the list the MCP tools and the editor read; `check` is what a save checks a definition against,
 * the available types only, and `checkWith` the same check against other resources, such as those a caller may read.
+* A type that signs in is available once the app can make its connection, as `support` says.
 */
-const workflowTypes = (loaded = [], models = () => void 0) => {
+const workflowTypes = (loaded = [], models = () => void 0, support) => {
 	const plugins = loadPlugins([{
 		plugin: appPlugin,
 		source: "@protobase/workflow-plugins"
 	}, ...loaded]);
-	const types = typeList(plugins, unavailable);
+	const types = typeList(plugins, connectionUnavailable(support));
+	const connections = Object.fromEntries(types.flatMap((type) => type.connection ? [[type.id, `${type.plugin}:${type.connection.name}`]] : []));
 	const available = new Set(types.filter((type) => type.kind !== "step" && type.available).map((type) => type.id));
 	const ready = readyTriggers(plugins);
 	const polling = triggersOfKind(plugins, "polling");
@@ -44,14 +41,16 @@ const workflowTypes = (loaded = [], models = () => void 0) => {
 			resources: steps.map((type) => type.id),
 			required: Object.fromEntries(steps.map((type) => [type.id, requiredInputs(type.input)])),
 			triggers: Object.fromEntries(checks.filter(([id]) => available.has(id))),
-			unavailable: reasons
+			unavailable: reasons,
+			connections
 		};
 	};
 	const check = checkWith(models);
-	/** The step types of one segment, which sends mail with the mailer of the job that runs it. */
-	const tasks = (input, mail) => stepHandlers(plugins, {
+	/** The step types of one segment, which sends mail with the mailer of the job that runs it, signs in through `connection`, and sends from the enabler's `mailbox`. */
+	const tasks = (input, mail, connection, mailbox) => stepHandlers(plugins, {
 		services: pluginServices(input, mail),
-		connection: noConnection
+		connection,
+		...mailbox && { mailbox }
 	});
 	return {
 		plugins,
@@ -62,6 +61,7 @@ const workflowTypes = (loaded = [], models = () => void 0) => {
 		ready,
 		polling,
 		webhooks,
+		connections,
 		available: (id) => available.has(id)
 	};
 };

package/dist/write-shared.js

@@ -65,6 +65,7 @@ const notifier = (deps, access, removed) => async (trx, kind, before, after) =>
 		user: session.user,
 		...session.tenant !== void 0 && { tenant: session.tenant },
 		...session.anonymous && { anonymous: true },
+		session,
 		...before && { before: maskEncrypted(access.full, before) },
 		...after && { after: maskEncrypted(access.full, after) }
 	};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.68.6",
+  "version": "0.69.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,11 +44,11 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.68.6",
-    "@protobase/query": "0.68.6",
-    "@protobase/schema": "0.68.6",
-    "@protobase/workflow-plugins": "0.68.6",
-    "@protobase/workflows": "0.68.6",
+    "@protobase/layout": "0.69.1",
+    "@protobase/query": "0.69.1",
+    "@protobase/schema": "0.69.1",
+    "@protobase/workflow-plugins": "0.69.1",
+    "@protobase/workflows": "0.69.1",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",

package/dist/better-auth/end-replaced-session.d.ts

@@ -1,17 +0,0 @@
-//#region src/better-auth/end-replaced-session.d.ts
-/** The part of Better Auth's endpoint context that ending a replaced session reads. */
-export type ReplacingContext = {
-  getSignedCookie: (name: string, secret: string) => Promise<string | null | false>;
-  context: {
-    authCookies: {
-      sessionToken: {
-        name: string;
-      };
-    };
-    secret: string;
-    internalAdapter: {
-      deleteSession: (token: string) => Promise<void>;
-    };
-  };
-};
-//#endregion