@protobase/server 0.69.2 → 0.69.3

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.69.2";
+var version = "0.69.3";
 //#endregion
 export { version };

package/dist/workflows/connections/connection-tokens.js

@@ -27,8 +27,7 @@ const sharedRefresh = (accounts) => {
 * `not_connected`, with one message that tells nothing of whether the account exists; a refresh the provider refuses
 * is `link_expired`. The token is blanked out of all the step records (`secret`).
 */
-const connectionTokens = ({ deps, schema, roles, accounts }) => {
-	const tokenOf = sharedRefresh(accounts);
+const connectionTokens = ({ deps, schema, roles, accounts, refresh: tokenOf }) => {
 	return (use) => {
 		const key = `${use.plugin}:${use.name}`;
 		const notConnected = () => new ConnectionError("not_connected", `This workflow has no connection it may use for ${key}: its owner connects an account and turns the workflow on`);

package/dist/workflows/connections/connection-wiring.js

@@ -1,7 +1,8 @@
 import { connectionConsent } from "./connection-consent.js";
 import { enablerMayUpdate } from "./enabler-authority.js";
 import { enablerMailbox } from "./enabler-mailbox.js";
-import { connectionTokens } from "./connection-tokens.js";
+import { connectionTokens, sharedRefresh } from "./connection-tokens.js";
+import { stopConnection } from "./stop-connection.js";
 import { sql } from "kysely";
 import { ConnectionError } from "@protobase/workflows/plugin";
 //#region src/workflows/connections/connection-wiring.ts
@@ -10,8 +11,10 @@ const noAccounts = {
 	accessToken: async () => void 0
 };
 /**
-* The connections of an app's workflows: the consent a save checks as a version is turned on, and the connection each
-* step and trigger that declares one gets, bound by the version its run or trigger runs.
+* The connections of an app's workflows: the consent a save checks as a version is turned on, the connection each
+* step and trigger that declares one gets, bound by the version its run or trigger runs, and the one a stopped trigger's
+* unsubscribe gets (`stopping`), bound by the account and person its row recorded, which only the trigger stop job takes.
+* One refresh of an account is shared by them all.
 */
 const connectionWiring = ({ deps, schema, roles, accounts = noAccounts, plugins, connectionOf, personalMailer }) => {
 	const declarationOf = (key) => {
@@ -23,21 +26,33 @@ const connectionWiring = ({ deps, schema, roles, accounts = noAccounts, plugins,
 		declarationOf,
 		connectionOf
 	});
+	const refresh = sharedRefresh(accounts);
 	const tokens = connectionTokens({
 		deps,
 		schema,
 		roles,
-		accounts
+		accounts,
+		refresh
 	});
-	const use = (type, version, secret) => {
+	const stopTokens = stopConnection({
+		accounts,
+		refresh
+	});
+	const connectionFor = (type) => {
 		const key = connectionOf[type];
 		const declaration = key === void 0 ? void 0 : declarationOf(key);
 		if (!key || !declaration) return;
 		const [plugin, name] = key.split(":");
-		return tokens({
+		return {
 			plugin,
 			name,
-			declaration,
+			declaration
+		};
+	};
+	const use = (type, version, secret) => {
+		const connection = connectionFor(type);
+		return connection && tokens({
+			...connection,
 			version,
 			secret
 		});
@@ -55,6 +70,15 @@ const connectionWiring = ({ deps, schema, roles, accounts = noAccounts, plugins,
 		workflowId: row.workflow_id,
 		version: row.version
 	}, secret);
+	const stopping = (row, secret) => {
+		const connection = connectionFor(row.type);
+		return connection && stopTokens({
+			...connection,
+			accountId: row.connection_id,
+			userId: row.enabled_by,
+			secret
+		});
+	};
 	const runEnabler = async (runId) => {
 		const { rows } = await sql`select r.workflow_id, v.enabled_by, v.tenant_id from ${sql.id(schema, "runs")} r
       join ${sql.id(schema, "versions")} v on v.workflow_id = r.workflow_id and v.version = r.version where r.id = ${runId}`.execute(deps().db);
@@ -66,6 +90,7 @@ const connectionWiring = ({ deps, schema, roles, accounts = noAccounts, plugins,
 		consent,
 		step,
 		trigger,
+		stopping,
 		mailbox: personalMailer && ((task) => enablerMailbox(() => runEnabler(task.runId), personalMailer))
 	};
 };

package/dist/workflows/connections/stop-connection.js

@@ -0,0 +1,25 @@
+import { connectionProviderId, holdsScopes } from "./connection-provider.js";
+import { ConnectionError } from "@protobase/workflows/plugin";
+//#region src/workflows/connections/stop-connection.ts
+/**
+* The connection a stopped trigger's unsubscribe signs in with, once its workflow's consent was withdrawn: only the
+* account its row recorded, while that account still belongs to the person its row recorded as having turned it on,
+* of the connection's provider and with its scopes. A row that recorded neither, as one from before they were kept,
+* gets nothing. A refresh the provider refuses is `not_connected` too: the subscription stays, recorded, until its
+* owner ends it. Each `accessToken()` checks afresh, caching nothing; only the trigger stop job holds one.
+*/
+const stopConnection = ({ accounts, refresh }) => (use) => {
+	const key = `${use.plugin}:${use.name}`;
+	const notConnected = () => new ConnectionError("not_connected", `This trigger has no connection it may end its subscription with for ${key}: the account it was made with is no longer connected`);
+	return { accessToken: async () => {
+		if (!use.accountId || !use.userId) throw notConnected();
+		const account = await accounts.find(use.userId, use.accountId);
+		if (!account || account.providerId !== connectionProviderId(use.plugin, use.name, use.declaration) || !holdsScopes(account.scopes, use.declaration)) throw notConnected();
+		const token = await refresh(use.userId, account.id, account.refreshToken);
+		if (!token) throw new ConnectionError("not_connected", `The account connected for ${key} no longer signs in, so this trigger cannot end its subscription with it`);
+		use.secret(token);
+		return token;
+	} };
+};
+//#endregion
+export { stopConnection };

package/dist/workflows/save-hook.js

@@ -40,7 +40,7 @@ const workflowSaveHook = (schema, types, jobs, consent) => async (event, trx) =>
 	const enabled = event.after.enabled_version;
 	const enabledBy = enabled === null ? null : await consent(event.session, event.after.definition);
 	await saveConsent(trx, schema, id, enabled, enabledBy);
-	await syncTrigger(trx, schema, jobs, event.after, types.connections);
+	await syncTrigger(trx, schema, jobs, event.after, enabledBy, types.connections);
 };
 //#endregion
 export { workflowSaveHook };

package/dist/workflows/schema-sql.js

@@ -1,6 +1,6 @@
 import { quoteIdent } from "../changes/capture-sql.js";
 /** The comment the schema's function carries, which the startup check reads. */
-const workflowsComment = `Protobase workflows 8`;
+const workflowsComment = `Protobase workflows 9`;
 const commentVersion = (comment) => {
 	const match = comment?.match(/^Protobase workflows (\d+)$/);
 	return match ? Number(match[1]) : void 0;
@@ -119,6 +119,8 @@ create table if not exists ${s}."triggers" (
   "updated_at" timestamptz not null default now()
 );
 alter table ${s}."triggers" add column if not exists "poll_attempt" integer;
+-- Who turned the trigger's version on: the only person whose account its stop job ends the subscription through.
+alter table ${s}."triggers" add column if not exists "enabled_by" text;
 -- A deleted workflow's trigger stays, without its workflow, until its stop job unsubscribed it at its provider.
 alter table ${s}."triggers" alter column "workflow_id" drop not null;
 do $$ begin

package/dist/workflows/schema.js

@@ -16,7 +16,7 @@ const readWorkflowsSchema = async (db, schema) => {
 	const row = rows[0];
 	return {
 		tables: row.found,
-		current: row.found && row.trigger_rows && commentVersion(row.comment) === 8 && row.triggers === workflowsTriggers.length
+		current: row.found && row.trigger_rows && commentVersion(row.comment) === 9 && row.triggers === workflowsTriggers.length
 	};
 };
 /**

package/dist/workflows/triggers/trigger-jobs.js

@@ -17,9 +17,9 @@ const passSize = 100;
 * for a polling one its first poll; for a subscribing webhook one its subscription), `workflows.trigger-stop`
 * (unsubscribes a stopped webhook trigger at its provider and removes it), `workflows.ready-check` (starts a run of one
 * record when it is ready, at the time its time terms say), and the poll and renewal jobs. Each acts only on the
-* generation it was queued for.
+* generation it was queued for. `stopConnect` is the stop job's alone, kept out of the `input` every other job gets.
 */
-const triggerJobs = (input) => {
+const triggerJobs = (input, stopConnect) => {
 	const { schema } = input;
 	const polls = pollJobs(input);
 	const readyCheck = defineJob({
@@ -87,18 +87,22 @@ const triggerJobs = (input) => {
 	});
 	/**
 	* Ends a stopped webhook trigger's subscription at its provider: whether nothing is left there, so the trigger can go.
-	* Any error is tried again, as the job's, until the provider ends it. A sign-in the unsubscribe can no longer use, as
-	* once the workflow was turned off and so its connection with it, or once the provider refused it, cannot end it:
-	* the trigger then stays `stopping` with that error, as the record of a subscription the provider may still hold.
+	* Any error is tried again, as the job's, until the provider ends it. It signs in through the account its row recorded,
+	* as the person who turned it on, even once the workflow was turned off or deleted (`stopConnect`). An account that is
+	* no longer theirs, or a sign-in the provider refused, cannot end it: the trigger then stays `stopping` with that
+	* error, as the record of a subscription the provider may still hold.
 	*/
 	const unsubscribe = async (db, trigger, signal) => {
-		const { rows } = await sql`select type, input, workflow_id, version, store, store is not null as subscribed
+		const { rows } = await sql`select type, input, workflow_id, version, connection_id, enabled_by, store, store is not null as subscribed
       from ${sql.id(schema, "triggers")} where id = ${trigger} and status = 'stopping'`.execute(db);
 		const row = rows[0];
 		const type = row?.subscribed ? input.webhooks(row.type) : void 0;
 		if (!row || !type?.unsubscribe) return true;
 		const end = type.unsubscribe;
-		const call = triggerCall(input, row, signal, input.redact);
+		const call = triggerCall({
+			allowPrivateAddresses: input.allowPrivateAddresses,
+			connect: (_, secret) => stopConnect?.(row, secret)
+		}, row, signal, input.redact);
 		const outcome = await callPlugin(() => end({
 			...call.context,
 			state: row.store

package/dist/workflows/triggers/trigger-sync.js

@@ -17,9 +17,11 @@ const triggerOf = (definition, connectionOf) => {
 * same write: turning it on inserts a running trigger and queues its start; a new version with the same type and input
 * keeps the row, so its state carries over, and passes over the records again; any other change, or turning it off, stops the old row and starts a new one.
 * The row keeps the account the trigger's connection binds (`connectionOf` names each type's connection), so an
-* expired sign-in stops every trigger on it, and connecting it again resumes them. Only the current version can be turned on.
+* expired sign-in stops every trigger on it, and connecting it again resumes them; and who turned it on (`enabledBy`,
+* which the save's consent decided), through whose account its stop job ends its subscription once it stops. A stopped
+* row keeps both. Only the current version can be turned on.
 */
-const syncTrigger = async (trx, schema, jobs, workflow, connectionOf = {}) => {
+const syncTrigger = async (trx, schema, jobs, workflow, enabledBy, connectionOf = {}) => {
 	const enabled = workflow.enabled_version;
 	if (enabled !== null && enabled !== workflow.version) throw badRequest("invalid-workflow", `Only the current version can be enabled: set enabled_version to ${String(workflow.version)}, or clear it to turn the workflow off`);
 	const wanted = enabled === null ? void 0 : triggerOf(workflow.definition, connectionOf);
@@ -30,7 +32,7 @@ const syncTrigger = async (trx, schema, jobs, workflow, connectionOf = {}) => {
 	const existing = rows[0];
 	if (existing?.same) {
 		if (existing.version === enabled) return;
-		await sql`update ${triggers} set version = ${enabled}, status = 'active', consecutive_failures = 0, last_error = null, updated_at = now() where id = ${existing.id}`.execute(trx);
+		await sql`update ${triggers} set version = ${enabled}, enabled_by = ${enabledBy}, status = 'active', consecutive_failures = 0, last_error = null, updated_at = now() where id = ${existing.id}`.execute(trx);
 		await jobs.start.enqueue(trx, {
 			trigger: existing.id,
 			generation: existing.generation
@@ -42,8 +44,8 @@ const syncTrigger = async (trx, schema, jobs, workflow, connectionOf = {}) => {
 		await jobs.stop.enqueue(trx, { trigger: existing.id });
 	}
 	if (!wanted) return;
-	const trigger = (await sql`insert into ${triggers} (workflow_id, version, tenant_id, type, input, connection_id, status, generation, consecutive_failures)
-    values (${id}, ${enabled}, ${workflow.tenant_id ?? null}, ${wanted.type}, ${JSON.stringify(wanted.input)}::jsonb, ${wanted.connection}, 'active', 1, 0) returning id`.execute(trx)).rows[0].id;
+	const trigger = (await sql`insert into ${triggers} (workflow_id, version, tenant_id, type, input, connection_id, enabled_by, status, generation, consecutive_failures)
+    values (${id}, ${enabled}, ${workflow.tenant_id ?? null}, ${wanted.type}, ${JSON.stringify(wanted.input)}::jsonb, ${wanted.connection}, ${enabledBy}, 'active', 1, 0) returning id`.execute(trx)).rows[0].id;
 	await jobs.start.enqueue(trx, {
 		trigger,
 		generation: 1

package/dist/workflows/workflow-engine.js

@@ -60,7 +60,7 @@ const workflowEngine = (options, deps, auth) => {
 		redact: redactor.text,
 		origin: () => auth?.origins[0],
 		systemPath: () => deps().systemPath
-	});
+	}, connections.stopping);
 	auth?.connections.events.set({
 		...connectionTriggers(() => deps().db, schema, triggers),
 		uses: connectionUses({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.69.2",
+  "version": "0.69.3",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,11 +44,11 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.69.2",
-    "@protobase/query": "0.69.2",
-    "@protobase/schema": "0.69.2",
-    "@protobase/workflow-plugins": "0.69.2",
-    "@protobase/workflows": "0.69.2",
+    "@protobase/layout": "0.69.3",
+    "@protobase/query": "0.69.3",
+    "@protobase/schema": "0.69.3",
+    "@protobase/workflow-plugins": "0.69.3",
+    "@protobase/workflows": "0.69.3",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",