@shipfox/api-integration-linear 2.0.0

package/dist/presentation/routes/install.d.ts

@@ -0,0 +1,19 @@
+import type { IntegrationCapability, IntegrationConnection } from '@shipfox/api-integration-core-dto';
+import { type RouteGroup } from '@shipfox/node-fastify';
+import type { LinearApiClient } from '#api/client.js';
+import { type ConnectLinearInstallationInput } from '#core/install.js';
+import type { LinearTokenStore } from '#core/tokens.js';
+export interface CreateLinearIntegrationRoutesOptions {
+    linear: LinearApiClient;
+    tokenStore: Pick<LinearTokenStore, 'storeTokens'>;
+    getExistingLinearConnection: (input: {
+        organizationId: string;
+    }) => Promise<IntegrationConnection<'linear'> | undefined>;
+    connectLinearInstallation: (input: ConnectLinearInstallationInput) => Promise<IntegrationConnection<'linear'>>;
+    disconnectLinearInstallation: (input: {
+        connectionId: string;
+    }) => Promise<void>;
+    connectionCapabilities: IntegrationCapability[];
+}
+export declare function createLinearIntegrationRoutes({ linear, tokenStore, getExistingLinearConnection, connectLinearInstallation, disconnectLinearInstallation, connectionCapabilities, }: CreateLinearIntegrationRoutesOptions): RouteGroup;
+//# sourceMappingURL=install.d.ts.map

package/dist/presentation/routes/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/install.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,qBAAqB,EAAE,qBAAqB,EAAC,MAAM,mCAAmC,CAAC;AASpG,OAAO,EAAc,KAAK,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EACL,KAAK,8BAA8B,EAGpC,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iBAAiB,CAAC;AAItD,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAClD,2BAA2B,EAAE,CAAC,KAAK,EAAE;QACnC,cAAc,EAAE,MAAM,CAAC;KACxB,KAAK,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,CAAC;IAC3D,yBAAyB,EAAE,CACzB,KAAK,EAAE,8BAA8B,KAClC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,4BAA4B,EAAE,CAAC,KAAK,EAAE;QAAC,YAAY,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,sBAAsB,EAAE,qBAAqB,EAAE,CAAC;CACjD;AAED,wBAAgB,6BAA6B,CAAC,EAC5C,MAAM,EACN,UAAU,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,EAC5B,sBAAsB,GACvB,EAAE,oCAAoC,GAAG,UAAU,CA6EnD"}

package/dist/presentation/routes/install.js

@@ -0,0 +1,100 @@
+import { AUTH_USER, requireUserContext, requireWorkspaceAccess } from '@shipfox/api-auth-context';
+import { createLinearInstallBodySchema, createLinearInstallResponseSchema, linearCallbackQuerySchema, linearCallbackResponseSchema } from '@shipfox/api-integration-linear-dto';
+import { requireWorkspaceMembership } from '@shipfox/api-workspaces';
+import { defineRoute } from '@shipfox/node-fastify';
+import { config } from '#config.js';
+import { handleLinearCallback, handleLinearOAuthCallbackError } from '#core/install.js';
+import { formatLinearOAuthScopes } from '#core/scopes.js';
+import { signLinearInstallState } from '#core/state.js';
+import { toIntegrationConnectionDto } from '#presentation/dto/integrations.js';
+import { linearRouteErrorHandler } from './errors.js';
+export function createLinearIntegrationRoutes({ linear, tokenStore, getExistingLinearConnection, connectLinearInstallation, disconnectLinearInstallation, connectionCapabilities }) {
+    const createInstallRoute = defineRoute({
+        method: 'POST',
+        path: '/install',
+        auth: AUTH_USER,
+        description: 'Create a Linear OAuth authorization URL for a workspace.',
+        schema: {
+            body: createLinearInstallBodySchema,
+            response: {
+                200: createLinearInstallResponseSchema
+            }
+        },
+        handler: (request)=>{
+            const { workspace_id: workspaceId } = request.body;
+            const actor = requireUserContext(request);
+            requireWorkspaceAccess({
+                request,
+                workspaceId
+            });
+            const state = signLinearInstallState({
+                workspaceId,
+                userId: actor.userId
+            });
+            const installUrl = new URL('https://linear.app/oauth/authorize');
+            installUrl.searchParams.set('client_id', config.LINEAR_OAUTH_CLIENT_ID);
+            installUrl.searchParams.set('redirect_uri', config.LINEAR_OAUTH_REDIRECT_URL);
+            installUrl.searchParams.set('response_type', 'code');
+            installUrl.searchParams.set('state', state);
+            installUrl.searchParams.set('actor', 'app');
+            installUrl.searchParams.set('scope', formatLinearOAuthScopes());
+            return {
+                install_url: installUrl.toString()
+            };
+        }
+    });
+    const callbackApiRoute = defineRoute({
+        method: 'GET',
+        path: '/callback/api',
+        auth: AUTH_USER,
+        description: 'Handle the Linear OAuth callback.',
+        schema: {
+            querystring: linearCallbackQuerySchema,
+            response: {
+                200: linearCallbackResponseSchema
+            }
+        },
+        errorHandler: linearRouteErrorHandler,
+        handler: async (request)=>{
+            const actor = requireUserContext(request);
+            const query = request.query;
+            if (isLinearOAuthErrorCallback(query)) {
+                return await handleLinearOAuthCallbackError({
+                    state: query.state,
+                    error: query.error,
+                    errorDescription: query.error_description,
+                    sessionUserId: actor.userId,
+                    sessionMemberships: actor.memberships,
+                    requireWorkspaceMembership
+                });
+            }
+            const connection = await handleLinearCallback({
+                linear,
+                tokenStore,
+                code: query.code,
+                state: query.state,
+                sessionUserId: actor.userId,
+                sessionMemberships: actor.memberships,
+                requireWorkspaceMembership,
+                getExistingLinearConnection,
+                connectLinearInstallation,
+                disconnectLinearInstallation
+            });
+            return toIntegrationConnectionDto(connection, {
+                capabilities: connectionCapabilities
+            });
+        }
+    });
+    return {
+        prefix: '/integrations/linear',
+        routes: [
+            createInstallRoute,
+            callbackApiRoute
+        ]
+    };
+}
+function isLinearOAuthErrorCallback(query) {
+    return 'error' in query && typeof query.error === 'string';
+}
+
+//# sourceMappingURL=install.js.map

package/dist/presentation/routes/install.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/install.ts"],"sourcesContent":["import {AUTH_USER, requireUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';\nimport type {IntegrationCapability, IntegrationConnection} from '@shipfox/api-integration-core-dto';\nimport {\n  createLinearInstallBodySchema,\n  createLinearInstallResponseSchema,\n  type LinearCallbackQueryDto,\n  linearCallbackQuerySchema,\n  linearCallbackResponseSchema,\n} from '@shipfox/api-integration-linear-dto';\nimport {requireWorkspaceMembership} from '@shipfox/api-workspaces';\nimport {defineRoute, type RouteGroup} from '@shipfox/node-fastify';\nimport type {LinearApiClient} from '#api/client.js';\nimport {config} from '#config.js';\nimport {\n  type ConnectLinearInstallationInput,\n  handleLinearCallback,\n  handleLinearOAuthCallbackError,\n} from '#core/install.js';\nimport {formatLinearOAuthScopes} from '#core/scopes.js';\nimport {signLinearInstallState} from '#core/state.js';\nimport type {LinearTokenStore} from '#core/tokens.js';\nimport {toIntegrationConnectionDto} from '#presentation/dto/integrations.js';\nimport {linearRouteErrorHandler} from './errors.js';\n\nexport interface CreateLinearIntegrationRoutesOptions {\n  linear: LinearApiClient;\n  tokenStore: Pick<LinearTokenStore, 'storeTokens'>;\n  getExistingLinearConnection: (input: {\n    organizationId: string;\n  }) => Promise<IntegrationConnection<'linear'> | undefined>;\n  connectLinearInstallation: (\n    input: ConnectLinearInstallationInput,\n  ) => Promise<IntegrationConnection<'linear'>>;\n  disconnectLinearInstallation: (input: {connectionId: string}) => Promise<void>;\n  connectionCapabilities: IntegrationCapability[];\n}\n\nexport function createLinearIntegrationRoutes({\n  linear,\n  tokenStore,\n  getExistingLinearConnection,\n  connectLinearInstallation,\n  disconnectLinearInstallation,\n  connectionCapabilities,\n}: CreateLinearIntegrationRoutesOptions): RouteGroup {\n  const createInstallRoute = defineRoute({\n    method: 'POST',\n    path: '/install',\n    auth: AUTH_USER,\n    description: 'Create a Linear OAuth authorization URL for a workspace.',\n    schema: {\n      body: createLinearInstallBodySchema,\n      response: {\n        200: createLinearInstallResponseSchema,\n      },\n    },\n    handler: (request) => {\n      const {workspace_id: workspaceId} = request.body;\n      const actor = requireUserContext(request);\n\n      requireWorkspaceAccess({request, workspaceId});\n\n      const state = signLinearInstallState({workspaceId, userId: actor.userId});\n      const installUrl = new URL('https://linear.app/oauth/authorize');\n      installUrl.searchParams.set('client_id', config.LINEAR_OAUTH_CLIENT_ID);\n      installUrl.searchParams.set('redirect_uri', config.LINEAR_OAUTH_REDIRECT_URL);\n      installUrl.searchParams.set('response_type', 'code');\n      installUrl.searchParams.set('state', state);\n      installUrl.searchParams.set('actor', 'app');\n      installUrl.searchParams.set('scope', formatLinearOAuthScopes());\n\n      return {install_url: installUrl.toString()};\n    },\n  });\n\n  const callbackApiRoute = defineRoute({\n    method: 'GET',\n    path: '/callback/api',\n    auth: AUTH_USER,\n    description: 'Handle the Linear OAuth callback.',\n    schema: {\n      querystring: linearCallbackQuerySchema,\n      response: {\n        200: linearCallbackResponseSchema,\n      },\n    },\n    errorHandler: linearRouteErrorHandler,\n    handler: async (request) => {\n      const actor = requireUserContext(request);\n      const query = request.query;\n      if (isLinearOAuthErrorCallback(query)) {\n        return await handleLinearOAuthCallbackError({\n          state: query.state,\n          error: query.error,\n          errorDescription: query.error_description,\n          sessionUserId: actor.userId,\n          sessionMemberships: actor.memberships,\n          requireWorkspaceMembership,\n        });\n      }\n      const connection = await handleLinearCallback({\n        linear,\n        tokenStore,\n        code: query.code,\n        state: query.state,\n        sessionUserId: actor.userId,\n        sessionMemberships: actor.memberships,\n        requireWorkspaceMembership,\n        getExistingLinearConnection,\n        connectLinearInstallation,\n        disconnectLinearInstallation,\n      });\n\n      return toIntegrationConnectionDto(connection, {capabilities: connectionCapabilities});\n    },\n  });\n\n  return {\n    prefix: '/integrations/linear',\n    routes: [createInstallRoute, callbackApiRoute],\n  };\n}\n\nfunction isLinearOAuthErrorCallback(\n  query: LinearCallbackQueryDto,\n): query is LinearCallbackQueryDto & {\n  error: string;\n  error_description?: string | undefined;\n  state: string;\n} {\n  return 'error' in query && typeof query.error === 'string';\n}\n"],"names":["AUTH_USER","requireUserContext","requireWorkspaceAccess","createLinearInstallBodySchema","createLinearInstallResponseSchema","linearCallbackQuerySchema","linearCallbackResponseSchema","requireWorkspaceMembership","defineRoute","config","handleLinearCallback","handleLinearOAuthCallbackError","formatLinearOAuthScopes","signLinearInstallState","toIntegrationConnectionDto","linearRouteErrorHandler","createLinearIntegrationRoutes","linear","tokenStore","getExistingLinearConnection","connectLinearInstallation","disconnectLinearInstallation","connectionCapabilities","createInstallRoute","method","path","auth","description","schema","body","response","handler","request","workspace_id","workspaceId","actor","state","userId","installUrl","URL","searchParams","set","LINEAR_OAUTH_CLIENT_ID","LINEAR_OAUTH_REDIRECT_URL","install_url","toString","callbackApiRoute","querystring","errorHandler","query","isLinearOAuthErrorCallback","error","errorDescription","error_description","sessionUserId","sessionMemberships","memberships","connection","code","capabilities","prefix","routes"],"mappings":"AAAA,SAAQA,SAAS,EAAEC,kBAAkB,EAAEC,sBAAsB,QAAO,4BAA4B;AAEhG,SACEC,6BAA6B,EAC7BC,iCAAiC,EAEjCC,yBAAyB,EACzBC,4BAA4B,QACvB,sCAAsC;AAC7C,SAAQC,0BAA0B,QAAO,0BAA0B;AACnE,SAAQC,WAAW,QAAwB,wBAAwB;AAEnE,SAAQC,MAAM,QAAO,aAAa;AAClC,SAEEC,oBAAoB,EACpBC,8BAA8B,QACzB,mBAAmB;AAC1B,SAAQC,uBAAuB,QAAO,kBAAkB;AACxD,SAAQC,sBAAsB,QAAO,iBAAiB;AAEtD,SAAQC,0BAA0B,QAAO,oCAAoC;AAC7E,SAAQC,uBAAuB,QAAO,cAAc;AAepD,OAAO,SAASC,8BAA8B,EAC5CC,MAAM,EACNC,UAAU,EACVC,2BAA2B,EAC3BC,yBAAyB,EACzBC,4BAA4B,EAC5BC,sBAAsB,EACe;IACrC,MAAMC,qBAAqBf,YAAY;QACrCgB,QAAQ;QACRC,MAAM;QACNC,MAAM1B;QACN2B,aAAa;QACbC,QAAQ;YACNC,MAAM1B;YACN2B,UAAU;gBACR,KAAK1B;YACP;QACF;QACA2B,SAAS,CAACC;YACR,MAAM,EAACC,cAAcC,WAAW,EAAC,GAAGF,QAAQH,IAAI;YAChD,MAAMM,QAAQlC,mBAAmB+B;YAEjC9B,uBAAuB;gBAAC8B;gBAASE;YAAW;YAE5C,MAAME,QAAQvB,uBAAuB;gBAACqB;gBAAaG,QAAQF,MAAME,MAAM;YAAA;YACvE,MAAMC,aAAa,IAAIC,IAAI;YAC3BD,WAAWE,YAAY,CAACC,GAAG,CAAC,aAAahC,OAAOiC,sBAAsB;YACtEJ,WAAWE,YAAY,CAACC,GAAG,CAAC,gBAAgBhC,OAAOkC,yBAAyB;YAC5EL,WAAWE,YAAY,CAACC,GAAG,CAAC,iBAAiB;YAC7CH,WAAWE,YAAY,CAACC,GAAG,CAAC,SAASL;YACrCE,WAAWE,YAAY,CAACC,GAAG,CAAC,SAAS;YACrCH,WAAWE,YAAY,CAACC,GAAG,CAAC,SAAS7B;YAErC,OAAO;gBAACgC,aAAaN,WAAWO,QAAQ;YAAE;QAC5C;IACF;IAEA,MAAMC,mBAAmBtC,YAAY;QACnCgB,QAAQ;QACRC,MAAM;QACNC,MAAM1B;QACN2B,aAAa;QACbC,QAAQ;YACNmB,aAAa1C;YACbyB,UAAU;gBACR,KAAKxB;YACP;QACF;QACA0C,cAAcjC;QACdgB,SAAS,OAAOC;YACd,MAAMG,QAAQlC,mBAAmB+B;YACjC,MAAMiB,QAAQjB,QAAQiB,KAAK;YAC3B,IAAIC,2BAA2BD,QAAQ;gBACrC,OAAO,MAAMtC,+BAA+B;oBAC1CyB,OAAOa,MAAMb,KAAK;oBAClBe,OAAOF,MAAME,KAAK;oBAClBC,kBAAkBH,MAAMI,iBAAiB;oBACzCC,eAAenB,MAAME,MAAM;oBAC3BkB,oBAAoBpB,MAAMqB,WAAW;oBACrCjD;gBACF;YACF;YACA,MAAMkD,aAAa,MAAM/C,qBAAqB;gBAC5CO;gBACAC;gBACAwC,MAAMT,MAAMS,IAAI;gBAChBtB,OAAOa,MAAMb,KAAK;gBAClBkB,eAAenB,MAAME,MAAM;gBAC3BkB,oBAAoBpB,MAAMqB,WAAW;gBACrCjD;gBACAY;gBACAC;gBACAC;YACF;YAEA,OAAOP,2BAA2B2C,YAAY;gBAACE,cAAcrC;YAAsB;QACrF;IACF;IAEA,OAAO;QACLsC,QAAQ;QACRC,QAAQ;YAACtC;YAAoBuB;SAAiB;IAChD;AACF;AAEA,SAASI,2BACPD,KAA6B;IAM7B,OAAO,WAAWA,SAAS,OAAOA,MAAME,KAAK,KAAK;AACpD"}

package/dist/presentation/routes/webhooks.d.ts

@@ -0,0 +1,11 @@
+import type { GetIntegrationConnectionByIdFn, PublishIntegrationEventReceivedFn, RecordDeliveryOnlyFn } from '@shipfox/api-integration-core-dto';
+import { type RouteGroup } from '@shipfox/node-fastify';
+import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
+export interface CreateLinearWebhookRoutesOptions {
+    coreDb: () => NodePgDatabase<Record<string, unknown>>;
+    publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+    recordDeliveryOnly: RecordDeliveryOnlyFn;
+    getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+}
+export declare function createLinearWebhookRoutes(options: CreateLinearWebhookRoutesOptions): RouteGroup;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/presentation/routes/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/webhooks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,8BAA8B,EAE9B,iCAAiC,EACjC,oBAAoB,EACrB,MAAM,mCAAmC,CAAC;AAK3C,OAAO,EAEL,KAAK,UAAU,EAIhB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAS9D,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,+BAA+B,EAAE,iCAAiC,CAAC;IACnE,kBAAkB,EAAE,oBAAoB,CAAC;IACzC,4BAA4B,EAAE,8BAA8B,CAAC;CAC9D;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,GAAG,UAAU,CAyG/F"}

package/dist/presentation/routes/webhooks.js

@@ -0,0 +1,136 @@
+import { Buffer } from 'node:buffer';
+import { LINEAR_PROVIDER, linearWebhookBaseEnvelopeSchema } from '@shipfox/api-integration-linear-dto';
+import { defineRoute, rawBodyPlugin, verifyHexHmacSignature, WEBHOOK_BODY_LIMIT } from '@shipfox/node-fastify';
+import { logger } from '@shipfox/node-opentelemetry';
+import { config } from '#config.js';
+import { handleLinearWebhook } from '#core/webhook.js';
+const DELIVERY_HEADER = 'linear-delivery';
+const EVENT_HEADER = 'linear-event';
+const SIGNATURE_HEADER = 'linear-signature';
+const WEBHOOK_REPLAY_WINDOW_MS = 60_000;
+export function createLinearWebhookRoutes(options) {
+    const webhookRoute = defineRoute({
+        method: 'POST',
+        path: '/',
+        auth: [],
+        description: 'Linear webhook receiver.',
+        options: {
+            bodyLimit: WEBHOOK_BODY_LIMIT
+        },
+        handler: async (request, reply)=>{
+            const deliveryHeader = request.headers[DELIVERY_HEADER];
+            const event = request.headers[EVENT_HEADER];
+            const signature = request.headers[SIGNATURE_HEADER];
+            if (typeof deliveryHeader !== 'string' || !deliveryHeader) {
+                reply.code(400);
+                return {
+                    error: 'missing Linear-Delivery header'
+                };
+            }
+            if (typeof event !== 'string' || !event) {
+                reply.code(400);
+                return {
+                    error: 'missing Linear-Event header'
+                };
+            }
+            if (typeof signature !== 'string' || !signature) {
+                reply.code(401);
+                return {
+                    error: 'missing Linear-Signature header'
+                };
+            }
+            const body = request.body;
+            if (!Buffer.isBuffer(body)) {
+                reply.code(400);
+                return {
+                    error: 'expected raw JSON body'
+                };
+            }
+            const rawBody = body.toString('utf8');
+            if (!verifyHexHmacSignature({
+                rawBody,
+                signature,
+                secret: config.LINEAR_WEBHOOK_SIGNING_SECRET
+            })) {
+                reply.code(401);
+                return {
+                    error: 'invalid signature'
+                };
+            }
+            let parsedJson;
+            try {
+                parsedJson = JSON.parse(rawBody);
+            } catch (error) {
+                logger().warn({
+                    deliveryId: deliveryHeader,
+                    err: error
+                }, 'linear webhook payload JSON parse failed');
+                reply.code(400);
+                return {
+                    error: 'malformed JSON'
+                };
+            }
+            const payload = linearWebhookBaseEnvelopeSchema.safeParse(parsedJson);
+            if (!payload.success) {
+                logger().warn({
+                    deliveryId: deliveryHeader,
+                    issues: payload.error.issues
+                }, 'linear webhook envelope failed schema validation');
+                await recordSignedDeliveryOnly(options, deliveryHeader);
+                reply.code(200);
+                return null;
+            }
+            if (Math.abs(Date.now() - payload.data.webhookTimestamp) > WEBHOOK_REPLAY_WINDOW_MS) {
+                reply.code(401);
+                return {
+                    error: 'stale webhook timestamp'
+                };
+            }
+            if (event !== payload.data.type) {
+                logger().warn({
+                    deliveryId: deliveryHeader,
+                    event,
+                    type: payload.data.type
+                }, 'linear webhook event header did not match payload type');
+                await recordSignedDeliveryOnly(options, deliveryHeader);
+                reply.code(200);
+                return null;
+            }
+            await options.coreDb().transaction(async (tx)=>{
+                await handleLinearWebhook({
+                    tx,
+                    // Linear documents this header as the delivery UUID; the signed timestamp is per-send.
+                    deliveryId: deliveryHeader,
+                    payload: payload.data,
+                    rawPayload: parsedJson,
+                    publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+                    recordDeliveryOnly: options.recordDeliveryOnly,
+                    getIntegrationConnectionById: options.getIntegrationConnectionById
+                });
+            });
+            reply.code(200);
+            return null;
+        }
+    });
+    return {
+        prefix: '/webhooks/integrations/linear',
+        auth: [],
+        plugins: [
+            rawBodyPlugin
+        ],
+        routes: [
+            webhookRoute
+        ]
+    };
+}
+async function recordSignedDeliveryOnly(options, deliveryId) {
+    await options.coreDb().transaction(async (tx)=>{
+        await options.recordDeliveryOnly({
+            tx,
+            provider: LINEAR_PROVIDER,
+            deliveryId
+        });
+    });
+}
+
+//# sourceMappingURL=webhooks.js.map

package/dist/presentation/routes/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/webhooks.ts"],"sourcesContent":["import {Buffer} from 'node:buffer';\nimport type {\n  GetIntegrationConnectionByIdFn,\n  IntegrationTx,\n  PublishIntegrationEventReceivedFn,\n  RecordDeliveryOnlyFn,\n} from '@shipfox/api-integration-core-dto';\nimport {\n  LINEAR_PROVIDER,\n  linearWebhookBaseEnvelopeSchema,\n} from '@shipfox/api-integration-linear-dto';\nimport {\n  defineRoute,\n  type RouteGroup,\n  rawBodyPlugin,\n  verifyHexHmacSignature,\n  WEBHOOK_BODY_LIMIT,\n} from '@shipfox/node-fastify';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport type {NodePgDatabase} from 'drizzle-orm/node-postgres';\nimport {config} from '#config.js';\nimport {handleLinearWebhook} from '#core/webhook.js';\n\nconst DELIVERY_HEADER = 'linear-delivery';\nconst EVENT_HEADER = 'linear-event';\nconst SIGNATURE_HEADER = 'linear-signature';\nconst WEBHOOK_REPLAY_WINDOW_MS = 60_000;\n\nexport interface CreateLinearWebhookRoutesOptions {\n  coreDb: () => NodePgDatabase<Record<string, unknown>>;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n}\n\nexport function createLinearWebhookRoutes(options: CreateLinearWebhookRoutesOptions): RouteGroup {\n  const webhookRoute = defineRoute({\n    method: 'POST',\n    path: '/',\n    auth: [],\n    description: 'Linear webhook receiver.',\n    options: {bodyLimit: WEBHOOK_BODY_LIMIT},\n    handler: async (request, reply) => {\n      const deliveryHeader = request.headers[DELIVERY_HEADER];\n      const event = request.headers[EVENT_HEADER];\n      const signature = request.headers[SIGNATURE_HEADER];\n\n      if (typeof deliveryHeader !== 'string' || !deliveryHeader) {\n        reply.code(400);\n        return {error: 'missing Linear-Delivery header'};\n      }\n      if (typeof event !== 'string' || !event) {\n        reply.code(400);\n        return {error: 'missing Linear-Event header'};\n      }\n      if (typeof signature !== 'string' || !signature) {\n        reply.code(401);\n        return {error: 'missing Linear-Signature header'};\n      }\n\n      const body = request.body;\n      if (!Buffer.isBuffer(body)) {\n        reply.code(400);\n        return {error: 'expected raw JSON body'};\n      }\n      const rawBody = body.toString('utf8');\n\n      if (\n        !verifyHexHmacSignature({\n          rawBody,\n          signature,\n          secret: config.LINEAR_WEBHOOK_SIGNING_SECRET,\n        })\n      ) {\n        reply.code(401);\n        return {error: 'invalid signature'};\n      }\n\n      let parsedJson: unknown;\n      try {\n        parsedJson = JSON.parse(rawBody);\n      } catch (error) {\n        logger().warn(\n          {deliveryId: deliveryHeader, err: error},\n          'linear webhook payload JSON parse failed',\n        );\n        reply.code(400);\n        return {error: 'malformed JSON'};\n      }\n\n      const payload = linearWebhookBaseEnvelopeSchema.safeParse(parsedJson);\n      if (!payload.success) {\n        logger().warn(\n          {deliveryId: deliveryHeader, issues: payload.error.issues},\n          'linear webhook envelope failed schema validation',\n        );\n        await recordSignedDeliveryOnly(options, deliveryHeader);\n        reply.code(200);\n        return null;\n      }\n\n      if (Math.abs(Date.now() - payload.data.webhookTimestamp) > WEBHOOK_REPLAY_WINDOW_MS) {\n        reply.code(401);\n        return {error: 'stale webhook timestamp'};\n      }\n\n      if (event !== payload.data.type) {\n        logger().warn(\n          {deliveryId: deliveryHeader, event, type: payload.data.type},\n          'linear webhook event header did not match payload type',\n        );\n        await recordSignedDeliveryOnly(options, deliveryHeader);\n        reply.code(200);\n        return null;\n      }\n\n      await options.coreDb().transaction(async (tx) => {\n        await handleLinearWebhook({\n          tx,\n          // Linear documents this header as the delivery UUID; the signed timestamp is per-send.\n          deliveryId: deliveryHeader,\n          payload: payload.data,\n          rawPayload: parsedJson,\n          publishIntegrationEventReceived: options.publishIntegrationEventReceived,\n          recordDeliveryOnly: options.recordDeliveryOnly,\n          getIntegrationConnectionById: options.getIntegrationConnectionById,\n        });\n      });\n\n      reply.code(200);\n      return null;\n    },\n  });\n\n  return {\n    prefix: '/webhooks/integrations/linear',\n    auth: [],\n    plugins: [rawBodyPlugin],\n    routes: [webhookRoute],\n  };\n}\n\nasync function recordSignedDeliveryOnly(\n  options: Pick<CreateLinearWebhookRoutesOptions, 'coreDb' | 'recordDeliveryOnly'>,\n  deliveryId: string,\n): Promise<void> {\n  await options.coreDb().transaction(async (tx: IntegrationTx) => {\n    await options.recordDeliveryOnly({\n      tx,\n      provider: LINEAR_PROVIDER,\n      deliveryId,\n    });\n  });\n}\n"],"names":["Buffer","LINEAR_PROVIDER","linearWebhookBaseEnvelopeSchema","defineRoute","rawBodyPlugin","verifyHexHmacSignature","WEBHOOK_BODY_LIMIT","logger","config","handleLinearWebhook","DELIVERY_HEADER","EVENT_HEADER","SIGNATURE_HEADER","WEBHOOK_REPLAY_WINDOW_MS","createLinearWebhookRoutes","options","webhookRoute","method","path","auth","description","bodyLimit","handler","request","reply","deliveryHeader","headers","event","signature","code","error","body","isBuffer","rawBody","toString","secret","LINEAR_WEBHOOK_SIGNING_SECRET","parsedJson","JSON","parse","warn","deliveryId","err","payload","safeParse","success","issues","recordSignedDeliveryOnly","Math","abs","Date","now","data","webhookTimestamp","type","coreDb","transaction","tx","rawPayload","publishIntegrationEventReceived","recordDeliveryOnly","getIntegrationConnectionById","prefix","plugins","routes","provider"],"mappings":"AAAA,SAAQA,MAAM,QAAO,cAAc;AAOnC,SACEC,eAAe,EACfC,+BAA+B,QAC1B,sCAAsC;AAC7C,SACEC,WAAW,EAEXC,aAAa,EACbC,sBAAsB,EACtBC,kBAAkB,QACb,wBAAwB;AAC/B,SAAQC,MAAM,QAAO,8BAA8B;AAEnD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,mBAAmB,QAAO,mBAAmB;AAErD,MAAMC,kBAAkB;AACxB,MAAMC,eAAe;AACrB,MAAMC,mBAAmB;AACzB,MAAMC,2BAA2B;AASjC,OAAO,SAASC,0BAA0BC,OAAyC;IACjF,MAAMC,eAAeb,YAAY;QAC/Bc,QAAQ;QACRC,MAAM;QACNC,MAAM,EAAE;QACRC,aAAa;QACbL,SAAS;YAACM,WAAWf;QAAkB;QACvCgB,SAAS,OAAOC,SAASC;YACvB,MAAMC,iBAAiBF,QAAQG,OAAO,CAAChB,gBAAgB;YACvD,MAAMiB,QAAQJ,QAAQG,OAAO,CAACf,aAAa;YAC3C,MAAMiB,YAAYL,QAAQG,OAAO,CAACd,iBAAiB;YAEnD,IAAI,OAAOa,mBAAmB,YAAY,CAACA,gBAAgB;gBACzDD,MAAMK,IAAI,CAAC;gBACX,OAAO;oBAACC,OAAO;gBAAgC;YACjD;YACA,IAAI,OAAOH,UAAU,YAAY,CAACA,OAAO;gBACvCH,MAAMK,IAAI,CAAC;gBACX,OAAO;oBAACC,OAAO;gBAA6B;YAC9C;YACA,IAAI,OAAOF,cAAc,YAAY,CAACA,WAAW;gBAC/CJ,MAAMK,IAAI,CAAC;gBACX,OAAO;oBAACC,OAAO;gBAAiC;YAClD;YAEA,MAAMC,OAAOR,QAAQQ,IAAI;YACzB,IAAI,CAAC/B,OAAOgC,QAAQ,CAACD,OAAO;gBAC1BP,MAAMK,IAAI,CAAC;gBACX,OAAO;oBAACC,OAAO;gBAAwB;YACzC;YACA,MAAMG,UAAUF,KAAKG,QAAQ,CAAC;YAE9B,IACE,CAAC7B,uBAAuB;gBACtB4B;gBACAL;gBACAO,QAAQ3B,OAAO4B,6BAA6B;YAC9C,IACA;gBACAZ,MAAMK,IAAI,CAAC;gBACX,OAAO;oBAACC,OAAO;gBAAmB;YACpC;YAEA,IAAIO;YACJ,IAAI;gBACFA,aAAaC,KAAKC,KAAK,CAACN;YAC1B,EAAE,OAAOH,OAAO;gBACdvB,SAASiC,IAAI,CACX;oBAACC,YAAYhB;oBAAgBiB,KAAKZ;gBAAK,GACvC;gBAEFN,MAAMK,IAAI,CAAC;gBACX,OAAO;oBAACC,OAAO;gBAAgB;YACjC;YAEA,MAAMa,UAAUzC,gCAAgC0C,SAAS,CAACP;YAC1D,IAAI,CAACM,QAAQE,OAAO,EAAE;gBACpBtC,SAASiC,IAAI,CACX;oBAACC,YAAYhB;oBAAgBqB,QAAQH,QAAQb,KAAK,CAACgB,MAAM;gBAAA,GACzD;gBAEF,MAAMC,yBAAyBhC,SAASU;gBACxCD,MAAMK,IAAI,CAAC;gBACX,OAAO;YACT;YAEA,IAAImB,KAAKC,GAAG,CAACC,KAAKC,GAAG,KAAKR,QAAQS,IAAI,CAACC,gBAAgB,IAAIxC,0BAA0B;gBACnFW,MAAMK,IAAI,CAAC;gBACX,OAAO;oBAACC,OAAO;gBAAyB;YAC1C;YAEA,IAAIH,UAAUgB,QAAQS,IAAI,CAACE,IAAI,EAAE;gBAC/B/C,SAASiC,IAAI,CACX;oBAACC,YAAYhB;oBAAgBE;oBAAO2B,MAAMX,QAAQS,IAAI,CAACE,IAAI;gBAAA,GAC3D;gBAEF,MAAMP,yBAAyBhC,SAASU;gBACxCD,MAAMK,IAAI,CAAC;gBACX,OAAO;YACT;YAEA,MAAMd,QAAQwC,MAAM,GAAGC,WAAW,CAAC,OAAOC;gBACxC,MAAMhD,oBAAoB;oBACxBgD;oBACA,uFAAuF;oBACvFhB,YAAYhB;oBACZkB,SAASA,QAAQS,IAAI;oBACrBM,YAAYrB;oBACZsB,iCAAiC5C,QAAQ4C,+BAA+B;oBACxEC,oBAAoB7C,QAAQ6C,kBAAkB;oBAC9CC,8BAA8B9C,QAAQ8C,4BAA4B;gBACpE;YACF;YAEArC,MAAMK,IAAI,CAAC;YACX,OAAO;QACT;IACF;IAEA,OAAO;QACLiC,QAAQ;QACR3C,MAAM,EAAE;QACR4C,SAAS;YAAC3D;SAAc;QACxB4D,QAAQ;YAAChD;SAAa;IACxB;AACF;AAEA,eAAe+B,yBACbhC,OAAgF,EAChF0B,UAAkB;IAElB,MAAM1B,QAAQwC,MAAM,GAAGC,WAAW,CAAC,OAAOC;QACxC,MAAM1C,QAAQ6C,kBAAkB,CAAC;YAC/BH;YACAQ,UAAUhE;YACVwC;QACF;IACF;AACF"}