@rezti/dsh-rez-suite 0.1.5 → 0.1.6

package/src/protocol.ts

@@ -35,12 +35,29 @@ export interface RezMcpServerSpec {
   toolCallTimeoutMs?: number
 }
 
+/** Company MCP endpoints persisted under ~/.dsh/dsh-rez-suite.json. Secrets are not stored here. */
+export interface RezConnections {
+  odoo: { enabled: boolean; url: string }
+  nextcloud: { enabled: boolean; url: string; username: string }
+  wechat: { enabled: boolean }
+  homeassistant: { enabled: boolean; url: string }
+}
+
+export interface RezPublicConnection {
+  enabled: boolean
+  url?: string
+  username?: string
+  secretConfigured: boolean
+  secretRef: string
+}
+
 /** Full plugin configuration persisted under ~/.dsh/dsh-rez-suite.json. */
 export interface RezConfig {
   enabled: boolean
   announceToAgent: boolean
   role: RezRoleId
   servers: Record<string, RezMcpServerSpec>
+  connections: RezConnections
   billing: {
     inputCostPer1k: number
     outputCostPer1k: number
@@ -56,6 +73,12 @@ export interface RezPublicConfig {
   enabled: boolean
   role: RezRoleId
   servers: Record<string, RezPublicServer>
+  connections: {
+    odoo: RezPublicConnection
+    nextcloud: RezPublicConnection
+    wechat: RezPublicConnection
+    homeassistant: RezPublicConnection
+  }
   billing: { inputCostPer1k: number; outputCostPer1k: number; monthlyBudget: number }
 }
 

package/src/routes.ts

@@ -6,6 +6,13 @@
 
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
+import {
+  REZ_CREDENTIAL_REFS,
+  REZ_SYSTEMS,
+  mergeConnections,
+  writeManagedCredential,
+  type RezSystem,
+} from '@rezti/dsh-rez-sso'
 import type { RezConfig, RezMcpServerSpec, RezRoleId } from './protocol.ts'
 import { REZ_API } from './protocol.ts'
 import type { McpHost } from './mcp-host.ts'
@@ -74,11 +81,25 @@ function mergeMaskedRecord(base: Record<string, string> | undefined, incoming: u
 }
 
 /** Apply a browser-safe public patch without overwriting masked secrets. */
-function applyPublicPatch(current: RezConfig, patch: Record<string, unknown>): RezConfig {
+function applyPublicPatch(current: RezConfig, patch: Record<string, unknown>): { next: RezConfig; secrets: Array<{ system: RezSystem; value: string }> } {
   const next: RezConfig = JSON.parse(JSON.stringify(current)) as RezConfig
+  const secrets: Array<{ system: RezSystem; value: string }> = []
   if (typeof patch.enabled === 'boolean') next.enabled = patch.enabled
   if (patch.role === 'engineer' || patch.role === 'sales' || patch.role === 'operations' || patch.role === 'all') next.role = patch.role as RezRoleId
 
+  if (typeof patch.connections === 'object' && patch.connections !== null) {
+    const incoming = patch.connections as Record<string, unknown>
+    next.connections = mergeConnections({ ...next.connections, ...incoming })
+    for (const system of Object.keys(REZ_CREDENTIAL_REFS) as RezSystem[]) {
+      const row = incoming[system]
+      if (typeof row !== 'object' || row === null) continue
+      const secret = (row as { secret?: unknown }).secret
+      if (typeof secret === 'string' && secret.length > 0 && secret !== SECRET_MASK) {
+        secrets.push({ system, value: secret })
+      }
+    }
+  }
+
   if (typeof patch.servers === 'object' && patch.servers !== null) {
     for (const [id, raw] of Object.entries(patch.servers as Record<string, unknown>)) {
       if (typeof raw !== 'object' || raw === null) continue
@@ -104,7 +125,7 @@ function applyPublicPatch(current: RezConfig, patch: Record<string, unknown>): R
     if (typeof value.outputCostPer1k === 'number') next.billing.outputCostPer1k = value.outputCostPer1k
     if (typeof value.monthlyBudget === 'number') next.billing.monthlyBudget = value.monthlyBudget
   }
-  return next
+  return { next, secrets }
 }
 
 export interface RezRoutesDeps {
@@ -113,11 +134,12 @@ export interface RezRoutesDeps {
   updateConfig: (next: RezConfig) => Promise<RezConfig>
   host: McpHost
   tokens: TokenManager
+  onCredentialWritten?: (ref: string) => void
 }
 
 /** Build every /api/dsh-rez-suite route (exact paths). */
 export function makeRoutes(deps: RezRoutesDeps): WebRoute[] {
-  const { getConfig, updateConfig, host, tokens } = deps
+  const { getConfig, updateConfig, host, tokens, onCredentialWritten } = deps
 
   const guard = (req: IncomingMessage, res: ServerResponse, method: string): boolean => {
     if (!isLoopbackRequest(req)) {
@@ -146,8 +168,14 @@ export function makeRoutes(deps: RezRoutesDeps): WebRoute[] {
           writeJson(res, 400, { error: 'invalid JSON body' })
           return
         }
-        const next = applyPublicPatch(getConfig(), body)
+        const { next, secrets } = applyPublicPatch(getConfig(), body)
         const saved = await updateConfig(next)
+        for (const item of secrets) {
+          writeManagedCredential(REZ_CREDENTIAL_REFS[item.system], item.value)
+        }
+        for (const system of REZ_SYSTEMS) {
+          onCredentialWritten?.(REZ_CREDENTIAL_REFS[system])
+        }
         writeJson(res, 200, { config: publicConfig(saved) })
       },
     },

package/src/store.ts

@@ -8,6 +8,12 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
+import {
+  REZ_CREDENTIAL_REFS,
+  REZ_DEFAULT_CONNECTIONS,
+  mergeConnections,
+  secretConfigured,
+} from '@rezti/dsh-rez-sso'
 import type { RezConfig, RezMcpServerSpec, RezPublicConfig } from './protocol.ts'
 
 /** File format version. */
@@ -36,13 +42,14 @@ export function expandHome(path: string): string {
   return resolve(path)
 }
 
-/** Defaults: panel-only. Company MCP rows live in cordis.patch.yml. */
+/** Defaults: company MCP endpoints. Secrets live in credentials.yaml / env. */
 export function defaultConfig(): RezConfig {
   return {
     enabled: true,
     announceToAgent: true,
     role: 'all',
     servers: {},
+    connections: JSON.parse(JSON.stringify(REZ_DEFAULT_CONNECTIONS)) as RezConfig['connections'],
     billing: {
       inputCostPer1k: 0.001,
       outputCostPer1k: 0.002,
@@ -74,10 +81,37 @@ export function publicConfig(config: RezConfig): RezPublicConfig {
   for (const [id, server] of Object.entries(config.servers)) {
     servers[id] = maskServer(server)
   }
+  const connections = mergeConnections(config.connections)
   return {
     enabled: config.enabled,
     role: config.role,
     servers,
+    connections: {
+      odoo: {
+        enabled: connections.odoo.enabled,
+        url: connections.odoo.url,
+        secretConfigured: secretConfigured('odoo'),
+        secretRef: REZ_CREDENTIAL_REFS.odoo,
+      },
+      nextcloud: {
+        enabled: connections.nextcloud.enabled,
+        url: connections.nextcloud.url,
+        username: connections.nextcloud.username,
+        secretConfigured: secretConfigured('nextcloud'),
+        secretRef: REZ_CREDENTIAL_REFS.nextcloud,
+      },
+      wechat: {
+        enabled: connections.wechat.enabled,
+        secretConfigured: secretConfigured('wechat'),
+        secretRef: REZ_CREDENTIAL_REFS.wechat,
+      },
+      homeassistant: {
+        enabled: connections.homeassistant.enabled,
+        url: connections.homeassistant.url,
+        secretConfigured: secretConfigured('homeassistant'),
+        secretRef: REZ_CREDENTIAL_REFS.homeassistant,
+      },
+    },
     billing: { ...config.billing },
   }
 }
@@ -96,6 +130,8 @@ export function mergeConfig(base: RezConfig, override: unknown): RezConfig {
   if (typeof value.announceToAgent === 'boolean') result.announceToAgent = value.announceToAgent
   if (value.role === 'engineer' || value.role === 'sales' || value.role === 'operations' || value.role === 'all') result.role = value.role
 
+  result.connections = mergeConnections(value.connections ?? result.connections)
+
   if (typeof value.servers === 'object' && value.servers !== null) {
     for (const [id, raw] of Object.entries(value.servers as Record<string, unknown>)) {
       if (typeof raw !== 'object' || raw === null) continue