@shipfox/api-integration-core 5.0.0 → 6.0.0

package/src/presentation/routes/agent-tools-gateway/resolve-authorized-tools.ts

@@ -4,6 +4,11 @@ import {
   materializedAgentStepConfigSchema,
 } from '@shipfox/api-agent-dto';
 import {requireLeasedJobContext} from '@shipfox/api-auth-context';
+import {
+  type WorkflowsModuleClient,
+  workflowsInterModuleContract,
+} from '@shipfox/api-workflows-dto/inter-module';
+import {isInterModuleKnownError} from '@shipfox/inter-module';
 import {ClientError} from '@shipfox/node-fastify';
 import type {IntegrationConnection} from '#core/entities/connection.js';
 import type {IntegrationProviderKind} from '#core/entities/provider.js';
@@ -16,10 +21,49 @@ export type LeasedAgentStepLoader = (params: {
   stepId: string;
   attempt: number;
 }) => Promise<{
-  step: {type: string; config: Record<string, unknown>};
   workspaceId: string;
+  integrations?: MaterializedAgentIntegrationConfigDto[];
+  step?: {type: string; config: Record<string, unknown>};
 }>;
 
+export function createWorkflowsLeasedAgentStepLoader(
+  workflows: WorkflowsModuleClient,
+): LeasedAgentStepLoader {
+  return async ({request, stepId, attempt}) => {
+    const leasedJob = requireLeasedJobContext(request);
+    try {
+      const context = await workflows.getLeasedAgentToolContext({
+        jobId: leasedJob.jobId,
+        jobExecutionId: leasedJob.jobExecutionId,
+        runnerSessionId: leasedJob.runnerSessionId,
+        stepId,
+        attempt,
+      });
+      return {
+        workspaceId: context.workspaceId,
+        integrations: context.integrations,
+      };
+    } catch (error) {
+      throw toLeasedAgentToolClientError(error);
+    }
+  };
+}
+
+function toLeasedAgentToolClientError(error: unknown): unknown {
+  const method = workflowsInterModuleContract.methods.getLeasedAgentToolContext;
+  if (!isInterModuleKnownError(method, error)) return error;
+
+  const status = [
+    'step-attempt-mismatch',
+    'step-not-running',
+    'leased-step-not-agent',
+    'agent-step-config-invalid',
+  ].includes(error.code)
+    ? 409
+    : 404;
+  return new ClientError(error.code.replaceAll('-', ' '), error.code, {status});
+}
+
 export interface AuthorizedIntegrationTool {
   mcpName: string;
   integration: MaterializedAgentIntegrationConfigDto;
@@ -49,18 +93,13 @@ export async function resolveAuthorizedIntegrationTools(
     });
   }
 
-  const {step, workspaceId} = await params.loadLeasedAgentStep({
+  const loaded = await params.loadLeasedAgentStep({
     request: params.request,
     stepId: leasedJob.currentStepId,
     attempt: leasedJob.currentStepAttempt,
   });
-  if (step.type !== 'agent') {
-    throw new ClientError('Current leased step is not an agent step', 'leased-step-not-agent', {
-      status: 409,
-    });
-  }
-
-  const integrations = parseAgentIntegrations(step.config);
+  const workspaceId = loaded.workspaceId;
+  const integrations = loaded.integrations ?? legacyIntegrations(loaded.step);
   const authorizedTools: AuthorizedIntegrationToolMap = new Map();
 
   for (const integration of integrations) {
@@ -102,6 +141,22 @@ export async function resolveAuthorizedIntegrationTools(
   return authorizedTools;
 }
 
+function legacyIntegrations(step: {type: string; config: Record<string, unknown>} | undefined) {
+  if (step?.type !== 'agent') {
+    throw new ClientError('Current leased step is not an agent step', 'leased-step-not-agent', {
+      status: 409,
+    });
+  }
+  try {
+    return materializedAgentStepConfigSchema.parse(step.config).integrations ?? [];
+  } catch (error) {
+    throw new ClientError('Agent step config is invalid', 'agent-step-config-invalid', {
+      status: 409,
+      cause: error,
+    });
+  }
+}
+
 export function sanitizeSlug(slug: string): string {
   return slug.replaceAll('-', '_');
 }
@@ -132,19 +187,6 @@ function toolInputSchema(tool: MaterializedAgentIntegrationToolConfigDto): Agent
   return narrowMethodEnum(tool.inputSchema, authorizedMethods);
 }
 
-function parseAgentIntegrations(
-  config: Record<string, unknown>,
-): MaterializedAgentIntegrationConfigDto[] {
-  try {
-    return materializedAgentStepConfigSchema.parse(config).integrations ?? [];
-  } catch (error) {
-    throw new ClientError('Agent step config is invalid', 'agent-step-config-invalid', {
-      status: 409,
-      cause: error,
-    });
-  }
-}
-
 async function loadAuthorizedConnection(params: {
   integration: MaterializedAgentIntegrationConfigDto;
   workspaceId: string;

package/src/presentation/routes/index.ts

@@ -1,10 +1,11 @@
+import type {WorkflowsModuleClient} from '@shipfox/api-workflows-dto/inter-module';
 import type {RouteExport} from '@shipfox/node-fastify';
 import type {IntegrationProviderRegistry} from '#core/providers/registry.js';
 import type {IntegrationSourceControlService} from '#core/source-control-service.js';
 import type {GetIntegrationConnectionByIdFn} from '#db/connections.js';
 import {
   createAgentToolsGatewayRoutes,
-  type LeasedAgentStepLoader,
+  createWorkflowsLeasedAgentStepLoader,
 } from './agent-tools-gateway/index.js';
 import {createListIntegrationConnectionsRoute} from './list-connections.js';
 import {createListIntegrationProvidersRoute} from './list-providers.js';
@@ -14,12 +15,10 @@ import {
   createUpdateIntegrationConnectionRoute,
 } from './manage-connections.js';
 
-export type {LeasedAgentStepLoader} from './agent-tools-gateway/index.js';
-
 export interface CreateIntegrationRoutesOptions {
   agentTools?:
     | {
-        loadLeasedAgentStep: LeasedAgentStepLoader;
+        workflows: WorkflowsModuleClient;
         getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
       }
     | undefined;
@@ -35,7 +34,7 @@ export function createIntegrationRoutes(
     ? [
         createAgentToolsGatewayRoutes({
           registry,
-          loadLeasedAgentStep: options.agentTools.loadLeasedAgentStep,
+          loadLeasedAgentStep: createWorkflowsLeasedAgentStepLoader(options.agentTools.workflows),
           getIntegrationConnectionById: options.agentTools.getIntegrationConnectionById,
         }),
       ]

package/src/providers/gitea.ts

@@ -79,15 +79,18 @@ async function loadGiteaModuleParts(): Promise<IntegrationModuleParts> {
     );
   }
 
+  const integrationProvider = createGiteaIntegrationProvider({
+    getExistingGiteaConnection,
+    connectGiteaConnection,
+    publishSourcePush,
+    recordDeliveryOnly,
+    getIntegrationConnectionById,
+    coreDb: db,
+  });
+
   return {
-    provider: createGiteaIntegrationProvider({
-      getExistingGiteaConnection,
-      connectGiteaConnection,
-      publishSourcePush,
-      recordDeliveryOnly,
-      getIntegrationConnectionById,
-      coreDb: db,
-    }),
+    provider: integrationProvider,
+    webhookProcessors: integrationProvider.webhookProcessors,
     database: {
       db: giteaDb,
       migrationsPath: giteaMigrationsPath,

package/src/providers/github.ts

@@ -116,18 +116,24 @@ async function loadGithubModuleParts(
     );
   }
 
+  const integrationProvider = createGithubIntegrationProvider({
+    getExistingGithubConnection,
+    connectGithubInstallation,
+    publishIntegrationEventReceived,
+    publishSourcePush,
+    recordDeliveryOnly,
+    getIntegrationConnectionById,
+    coreDb: db,
+    deleteSecrets: options.secrets?.deleteSecrets,
+    agentTools: {tokenProvider},
+    ...(options.requireActiveWorkspaceMembership
+      ? {requireActiveWorkspaceMembership: options.requireActiveWorkspaceMembership}
+      : {}),
+  });
+
   return {
-    provider: createGithubIntegrationProvider({
-      getExistingGithubConnection,
-      connectGithubInstallation,
-      publishIntegrationEventReceived,
-      publishSourcePush,
-      recordDeliveryOnly,
-      getIntegrationConnectionById,
-      coreDb: db,
-      deleteSecrets: options.secrets?.deleteSecrets,
-      agentTools: {tokenProvider},
-    }),
+    provider: integrationProvider,
+    webhookProcessors: integrationProvider.webhookProcessors,
     e2eRoutes: [
       createGithubE2eRoutes({
         getExistingGithubConnection,

package/src/providers/jira.ts

@@ -152,6 +152,9 @@ async function loadJiraModuleParts(
         getExistingJiraConnection,
         connectJiraInstallation,
         disconnectJiraInstallation,
+        ...(options.requireActiveWorkspaceMembership
+          ? {requireActiveWorkspaceMembership: options.requireActiveWorkspaceMembership}
+          : {}),
       },
     }),
     database: {db: jiraDb, migrationsPath, migrationsTableName: JIRA_MIGRATIONS_TABLE},

package/src/providers/linear.ts

@@ -136,32 +136,38 @@ async function loadLinearModuleParts(
     secrets,
   });
 
-  return {
-    provider: createLinearIntegrationProvider({
-      agentTools: {tokenStore, endpoint: linearConfig.LINEAR_MCP_ENDPOINT},
-      cleanup: {
-        deleteConnectionRecords: async (connection, {tx}) => {
-          await deleteLinearInstallationByConnectionId(connection.id, {tx});
-        },
-        deleteConnectionSecrets: async (connection) => {
-          // Scoped secrets accept the provider-local suffix, after this helper validates its prefix.
-          await (options.secrets?.linear?.deleteSecrets({
-            workspaceId: connection.workspaceId,
-            namespace: linearNamespaceSuffix(linearSecretsNamespace(connection.id)),
-          }) ?? Promise.resolve());
-        },
+  const integrationProvider = createLinearIntegrationProvider({
+    agentTools: {tokenStore, endpoint: linearConfig.LINEAR_MCP_ENDPOINT},
+    cleanup: {
+      deleteConnectionRecords: async (connection, {tx}) => {
+        await deleteLinearInstallationByConnectionId(connection.id, {tx});
       },
-      routes: {
-        tokenStore,
-        getExistingLinearConnection,
-        connectLinearInstallation,
-        disconnectLinearInstallation,
-        publishIntegrationEventReceived,
-        recordDeliveryOnly,
-        getIntegrationConnectionById,
-        coreDb: db,
+      deleteConnectionSecrets: async (connection) => {
+        // Scoped secrets accept the provider-local suffix, after this helper validates its prefix.
+        await (options.secrets?.linear?.deleteSecrets({
+          workspaceId: connection.workspaceId,
+          namespace: linearNamespaceSuffix(linearSecretsNamespace(connection.id)),
+        }) ?? Promise.resolve());
       },
-    }),
+    },
+    routes: {
+      tokenStore,
+      getExistingLinearConnection,
+      connectLinearInstallation,
+      disconnectLinearInstallation,
+      publishIntegrationEventReceived,
+      recordDeliveryOnly,
+      getIntegrationConnectionById,
+      coreDb: db,
+      ...(options.requireActiveWorkspaceMembership
+        ? {requireActiveWorkspaceMembership: options.requireActiveWorkspaceMembership}
+        : {}),
+    },
+  });
+
+  return {
+    provider: integrationProvider,
+    webhookProcessors: integrationProvider.webhookProcessors,
     e2eRoutes: [
       createLinearE2eRoutes({
         tokenStore,

package/src/providers/sentry.ts

@@ -84,19 +84,22 @@ async function loadSentryModuleParts(): Promise<IntegrationModuleParts> {
     );
   }
 
+  const integrationProvider = createSentryIntegrationProvider({
+    getSentryInstallation: ({installationUuid}) =>
+      getSentryInstallationByInstallationUuid(installationUuid),
+    getConnectionById,
+    connectSentryInstallation,
+    persistVerifiedUnclaimedInstallation,
+    coreDb: db,
+    publishIntegrationEventReceived,
+    recordDeliveryOnly,
+    getIntegrationConnectionById,
+    updateConnectionLifecycleStatus: updateIntegrationConnectionLifecycleStatus,
+  });
+
   return {
-    provider: createSentryIntegrationProvider({
-      getSentryInstallation: ({installationUuid}) =>
-        getSentryInstallationByInstallationUuid(installationUuid),
-      getConnectionById,
-      connectSentryInstallation,
-      persistVerifiedUnclaimedInstallation,
-      coreDb: db,
-      publishIntegrationEventReceived,
-      recordDeliveryOnly,
-      getIntegrationConnectionById,
-      updateConnectionLifecycleStatus: updateIntegrationConnectionLifecycleStatus,
-    }),
+    provider: integrationProvider,
+    webhookProcessors: integrationProvider.webhookProcessors,
     database: {
       db: sentryDb,
       migrationsPath: sentryMigrationsPath,

package/src/providers/slack.ts

@@ -138,33 +138,39 @@ async function loadSlackModuleParts(
     secrets,
   });
 
-  return {
-    provider: createSlackIntegrationProvider({
-      agentTools: {tokenStore},
-      cleanup: {
-        deleteConnectionRecords: async (connection, {tx}) => {
-          await deleteSlackInstallationByConnectionId(connection.id, {tx});
-        },
-        deleteConnectionSecrets: async (connection) => {
-          // Scoped secrets accept the provider-local suffix, after this helper validates its prefix.
-          await (options.secrets?.slack?.deleteSecrets({
-            workspaceId: connection.workspaceId,
-            namespace: slackNamespaceSuffix(slackSecretsNamespace(connection.id)),
-          }) ?? Promise.resolve());
-        },
+  const integrationProvider = createSlackIntegrationProvider({
+    agentTools: {tokenStore},
+    cleanup: {
+      deleteConnectionRecords: async (connection, {tx}) => {
+        await deleteSlackInstallationByConnectionId(connection.id, {tx});
       },
-      routes: {
-        tokenStore,
-        getExistingSlackConnection,
-        connectSlackInstallation,
-        disconnectSlackInstallation,
-        coreDb: db,
-        claimWebhookDelivery,
-        publishIntegrationEventReceived,
-        recordDeliveryOnly,
-        getIntegrationConnectionById,
+      deleteConnectionSecrets: async (connection) => {
+        // Scoped secrets accept the provider-local suffix, after this helper validates its prefix.
+        await (options.secrets?.slack?.deleteSecrets({
+          workspaceId: connection.workspaceId,
+          namespace: slackNamespaceSuffix(slackSecretsNamespace(connection.id)),
+        }) ?? Promise.resolve());
       },
-    }),
+    },
+    routes: {
+      tokenStore,
+      getExistingSlackConnection,
+      connectSlackInstallation,
+      disconnectSlackInstallation,
+      coreDb: db,
+      claimWebhookDelivery,
+      publishIntegrationEventReceived,
+      recordDeliveryOnly,
+      getIntegrationConnectionById,
+      ...(options.requireActiveWorkspaceMembership
+        ? {requireActiveWorkspaceMembership: options.requireActiveWorkspaceMembership}
+        : {}),
+    },
+  });
+
+  return {
+    provider: integrationProvider,
+    webhookProcessors: integrationProvider.webhookProcessors,
     e2eRoutes: [
       createSlackE2eRoutes({
         tokenStore,

package/src/providers/types.ts

@@ -1,3 +1,5 @@
+import type {UserContextMembership} from '@shipfox/api-auth-context';
+import type {WebhookRequestProcessor, WebhookRouteId} from '@shipfox/api-integration-core-dto';
 import type {RouteExport} from '@shipfox/node-fastify';
 import type {ModuleDatabase, ModuleWorker} from '@shipfox/node-module';
 import type {IntegrationProvider} from '#core/entities/provider.js';
@@ -17,6 +19,12 @@ export interface IntegrationModuleParts {
   e2eRoutes?: RouteExport[] | undefined;
   workers?: ModuleWorker[] | undefined;
   startupTasks?: Array<() => Promise<void>> | undefined;
+  webhookProcessors?: WebhookProcessorRegistration[] | undefined;
+}
+
+export interface WebhookProcessorRegistration {
+  routeIds: readonly WebhookRouteId[];
+  processor: WebhookRequestProcessor;
 }
 
 /**
@@ -32,6 +40,13 @@ export interface IntegrationProviderModule {
 
 export interface IntegrationProviderModuleLoadOptions {
   secrets?: IntegrationProviderSecrets | undefined;
+  requireActiveWorkspaceMembership?:
+    | ((input: {
+        workspaceId: string;
+        userId: string;
+        memberships: ReadonlyArray<UserContextMembership>;
+      }) => Promise<unknown>)
+    | undefined;
 }
 
 export interface IntegrationProviderSecrets {

package/src/providers/webhook.ts

@@ -15,16 +15,18 @@ export const webhookProviderModule: IntegrationProviderModule = {
   enabled: config.INTEGRATIONS_ENABLE_WEBHOOK_PROVIDER,
   load: async () => {
     const {createWebhookIntegrationProvider} = await import('@shipfox/api-integration-webhook');
+    const integrationProvider = createWebhookIntegrationProvider({
+      coreDb: db,
+      createIntegrationConnection,
+      listIntegrationConnections,
+      getIntegrationConnectionById,
+      updateIntegrationConnectionLifecycleStatus,
+      deleteIntegrationConnection,
+      publishIntegrationEventReceived,
+    });
     return {
-      provider: createWebhookIntegrationProvider({
-        coreDb: db,
-        createIntegrationConnection,
-        listIntegrationConnections,
-        getIntegrationConnectionById,
-        updateIntegrationConnectionLifecycleStatus,
-        deleteIntegrationConnection,
-        publishIntegrationEventReceived,
-      }),
+      provider: integrationProvider,
+      webhookProcessors: integrationProvider.webhookProcessors,
     };
   },
 };