@shipfox/api-server 8.0.0 → 9.0.1

package/package.json

@@ -2,7 +2,7 @@
   "name": "@shipfox/api-server",
   "license": "MIT",
   "private": false,
-  "version": "8.0.0",
+  "version": "9.0.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -11,9 +11,6 @@
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "imports": {
-    "#*": "./dist/*"
-  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -25,37 +22,40 @@
     }
   },
   "dependencies": {
-    "@shipfox/annotations": "8.0.0",
-    "@shipfox/annotations-dto": "6.0.0",
-    "@shipfox/api-agent": "8.0.0",
-    "@shipfox/api-agent-dto": "8.0.0",
-    "@shipfox/api-auth": "7.1.0",
-    "@shipfox/api-auth-dto": "7.1.0",
-    "@shipfox/api-definitions": "8.0.0",
-    "@shipfox/api-definitions-dto": "6.0.0",
-    "@shipfox/api-dispatcher": "7.1.0",
-    "@shipfox/api-email-challenges": "0.3.0",
-    "@shipfox/api-integration-core": "8.0.0",
-    "@shipfox/api-integration-core-dto": "8.0.0",
-    "@shipfox/api-logs": "8.0.0",
-    "@shipfox/api-projects": "8.0.0",
-    "@shipfox/api-projects-dto": "8.0.0",
-    "@shipfox/api-runners": "8.0.0",
-    "@shipfox/api-runners-dto": "7.0.1",
-    "@shipfox/api-secrets": "8.0.0",
-    "@shipfox/api-secrets-dto": "6.0.0",
-    "@shipfox/api-triggers": "8.0.0",
-    "@shipfox/api-workflows": "8.0.0",
-    "@shipfox/api-workflows-dto": "8.0.0",
-    "@shipfox/api-workspaces-dto": "6.0.0",
-    "@shipfox/api-workspaces": "7.1.0",
-    "@shipfox/config": "1.2.2",
-    "@shipfox/node-error-monitoring": "0.2.0",
-    "@shipfox/node-fastify": "0.3.0",
-    "@shipfox/node-jwt": "0.3.0",
-    "@shipfox/node-module": "0.5.0",
-    "@shipfox/node-opentelemetry": "0.6.0",
-    "@shipfox/node-postgres": "0.4.2"
+    "@shipfox/annotations": "9.0.1",
+    "@shipfox/annotations-dto": "9.0.1",
+    "@shipfox/api-agent": "9.0.1",
+    "@shipfox/api-agent-dto": "9.0.1",
+    "@shipfox/api-auth": "9.0.1",
+    "@shipfox/api-auth-dto": "9.0.1",
+    "@shipfox/api-definitions": "9.0.1",
+    "@shipfox/api-definitions-dto": "9.0.1",
+    "@shipfox/api-dispatcher": "9.0.1",
+    "@shipfox/api-email-challenges": "1.1.0",
+    "@shipfox/api-integration-core": "9.0.1",
+    "@shipfox/api-integration-core-dto": "9.0.1",
+    "@shipfox/api-logs": "9.0.1",
+    "@shipfox/api-projects": "9.0.1",
+    "@shipfox/api-projects-dto": "9.0.1",
+    "@shipfox/api-runners": "9.0.1",
+    "@shipfox/api-runners-dto": "9.0.1",
+    "@shipfox/api-secrets": "9.0.1",
+    "@shipfox/api-secrets-dto": "9.0.1",
+    "@shipfox/api-triggers": "9.0.1",
+    "@shipfox/api-workflows": "9.0.1",
+    "@shipfox/api-workflows-dto": "9.0.1",
+    "@shipfox/api-workspaces-dto": "9.0.1",
+    "@shipfox/api-workspaces": "9.0.1",
+    "@shipfox/config": "1.2.3",
+    "@shipfox/node-error-monitoring": "0.2.1",
+    "@shipfox/node-fastify": "0.3.1",
+    "@shipfox/node-jwt": "0.3.1",
+    "@shipfox/node-module": "1.0.0",
+    "@shipfox/node-opentelemetry": "0.6.1",
+    "@shipfox/node-postgres": "0.4.3"
+  },
+  "imports": {
+    "#*": "./dist/*"
   },
   "scripts": {
     "build": "shipfox-swc",

package/src/auth-token-interoperability.test.ts

@@ -1,8 +1,11 @@
+import {createLeaseTokenAuthMethod, issueJobLeaseToken} from '@shipfox/api-auth';
 import {AUTH_LEASED_JOB, requireLeasedJobContext} from '@shipfox/api-auth-context';
 import {closeApp, createApp, defineRoute} from '@shipfox/node-fastify';
 import {afterEach, describe, expect, it} from '@shipfox/vitest/vi';
 
-process.env.AUTH_ROOT_KEY ??= 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=';
+vi.hoisted(() => {
+  process.env.AUTH_ROOT_KEY ??= 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=';
+});
 
 const leaseRoute = defineRoute({
   method: 'GET',
@@ -20,7 +23,6 @@ describe('Auth token interoperability', () => {
   });
 
   it('accepts an Auth-issued step lease through the server route boundary', async () => {
-    const {createLeaseTokenAuthMethod, issueJobLeaseToken} = await import('@shipfox/api-auth');
     const jobId = crypto.randomUUID();
     const stepId = crypto.randomUUID();
     const token = await issueJobLeaseToken({
@@ -48,5 +50,5 @@ describe('Auth token interoperability', () => {
 
     expect(res.statusCode).toBe(200);
     expect(res.json()).toEqual({job_id: jobId, step_id: stepId});
-  });
+  }, 15_000);
 });

package/src/modules.test.ts

@@ -33,6 +33,7 @@ const mocks = vi.hoisted(() => ({
   deleteSecrets: vi.fn(),
   getIntegrationConnectionById: vi.fn(),
   getSecret: vi.fn(),
+  getWorkspaceCreator: vi.fn(),
   listMembershipsForTokenClaims: vi.fn(),
   setSecrets: vi.fn(),
 }));
@@ -101,6 +102,7 @@ vi.mock('@shipfox/api-workspaces', () => ({
         contract: workspacesInterModuleContract,
         handlers: {
           listMembershipsForTokenClaims: mocks.listMembershipsForTokenClaims,
+          getWorkspaceCreator: mocks.getWorkspaceCreator,
           preflightInvitationAcceptance: vi.fn(),
           acceptInvitation: vi.fn(),
           requireActiveMembership: vi.fn(),
@@ -127,6 +129,7 @@ describe('defaultModules', () => {
     mocks.deleteSecrets.mockReset();
     mocks.getIntegrationConnectionById.mockReset();
     mocks.getSecret.mockReset();
+    mocks.getWorkspaceCreator.mockReset();
     mocks.listMembershipsForTokenClaims.mockReset();
     mocks.setSecrets.mockReset();
 
@@ -153,6 +156,7 @@ describe('defaultModules', () => {
     mocks.deleteSecrets.mockResolvedValue({deleted: 1});
     mocks.getSecret.mockResolvedValue({value: 'secret'});
     mocks.listMembershipsForTokenClaims.mockResolvedValue({memberships: []});
+    mocks.getWorkspaceCreator.mockResolvedValue({creatorUserId: null});
     mocks.setSecrets.mockResolvedValue({});
     mocks.createProjectsModule.mockReturnValue({
       name: 'projects',
@@ -258,6 +262,27 @@ describe('defaultModules', () => {
     ]);
   });
 
+  it('registers one presentation for every composed inter-module client before sealing', async () => {
+    const modules = await defaultModules();
+    const presentationModules = modules.flatMap((module) =>
+      (module.interModulePresentations ?? []).map(({contract}) => contract.module),
+    );
+    const composedClientModules = [
+      agentInterModuleContract,
+      annotationsInterModuleContract,
+      authInterModuleContract,
+      definitionsInterModuleContract,
+      integrationsInterModuleContract,
+      projectsInterModuleContract,
+      runnersInterModuleContract,
+      secretsInterModuleContract,
+      workflowsInterModuleContract,
+      workspacesInterModuleContract,
+    ].map((contract) => contract.module);
+
+    expect(presentationModules.sort()).toEqual(composedClientModules.sort());
+  });
+
   it('injects Auth into the Runners module', async () => {
     await defaultModules();
 
@@ -309,13 +334,20 @@ describe('defaultModules', () => {
     const modules = await defaultModules({extension});
     const userId = crypto.randomUUID();
     const memberships = await workspaces?.listMembershipsForTokenClaims({userId});
+    const workspaceId = crypto.randomUUID();
+    const creator = await workspaces?.getWorkspaceCreator({workspaceId});
 
     expect(extension).toHaveBeenCalledWith({workspaces: expect.any(Object)});
     expect(memberships).toEqual({memberships: []});
+    expect(creator).toEqual({creatorUserId: null});
     expect(mocks.listMembershipsForTokenClaims).toHaveBeenCalledWith(
       {userId},
       expect.objectContaining({signal: expect.any(AbortSignal)}),
     );
+    expect(mocks.getWorkspaceCreator).toHaveBeenCalledWith(
+      {workspaceId},
+      expect.objectContaining({signal: expect.any(AbortSignal)}),
+    );
     expect(modules.at(-1)).toBe(extensionModule);
   });
 

package/test/published/_environment.mjs

@@ -0,0 +1,61 @@
+export function publishedTestEnvironment() {
+  // Use the active workspace's isolated Postgres instead of a fixed CI port, which
+  // could point at an unrelated local database when this contract runs in a worktree.
+  const postgresHost = process.env.POSTGRES_HOST ?? '127.0.0.1';
+  const postgresPort = process.env.POSTGRES_PORT ?? '5432';
+  const postgresUsername = process.env.POSTGRES_USERNAME ?? 'shipfox';
+  const postgresPassword = process.env.POSTGRES_PASSWORD ?? 'password';
+  const postgresDatabase = 'api_test';
+
+  return {
+    AUTH_ROOT_KEY: 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=',
+    DATABASE_URL: `postgres://${postgresUsername}:${postgresPassword}@${postgresHost}:${postgresPort}/${postgresDatabase}`,
+    GITEA_BASE_URL: 'https://gitea.example.com',
+    GITEA_SERVICE_TOKEN: 'external-consumer-token',
+    GITEA_SERVICE_USERNAME: 'shipfox-bot',
+    GITEA_WEBHOOK_SECRET: 'external-consumer-webhook-secret',
+    GITHUB_API_BASE_URL: 'https://api.github.com',
+    GITHUB_APP_CLIENT_ID: 'external-consumer-client-id',
+    GITHUB_APP_CLIENT_SECRET: 'external-consumer-client-secret',
+    GITHUB_APP_ID: '1',
+    GITHUB_APP_PRIVATE_KEY: 'external-consumer-private-key',
+    GITHUB_APP_SLUG: 'shipfox-external-consumer',
+    GITHUB_APP_USERNAME: 'shipfox-external-consumer',
+    GITHUB_APP_WEBHOOK_SECRET: 'external-consumer-webhook-secret',
+    GITHUB_INSTALL_STATE_SECRET: 'external-consumer-install-state-secret',
+    JIRA_OAUTH_CLIENT_ID: 'external-consumer-client-id',
+    JIRA_OAUTH_CLIENT_SECRET: 'external-consumer-client-secret',
+    JIRA_OAUTH_REDIRECT_URL: 'https://shipfox.example.com/integrations/jira/callback',
+    JIRA_WEBHOOK_BASE_URL: 'https://shipfox.example.com',
+    JIRA_WEBHOOK_SIGNING_SECRET: 'external-consumer-webhook-secret',
+    LINEAR_MCP_ENDPOINT: 'https://mcp.linear.app/mcp',
+    LINEAR_OAUTH_CLIENT_ID: 'external-consumer-client-id',
+    LINEAR_OAUTH_CLIENT_SECRET: 'external-consumer-client-secret',
+    LINEAR_OAUTH_REDIRECT_URL: 'https://shipfox.example.com/integrations/linear/callback',
+    LINEAR_WEBHOOK_SIGNING_SECRET: 'external-consumer-webhook-secret',
+    SLACK_API_BASE_URL: 'https://slack.example.com/api',
+    SLACK_OAUTH_CLIENT_ID: 'external-consumer-client-id',
+    SLACK_OAUTH_CLIENT_SECRET: 'external-consumer-client-secret',
+    SLACK_OAUTH_REDIRECT_URL: 'https://shipfox.example.com/integrations/slack/callback',
+    SLACK_SIGNING_SECRET: 'external-consumer-signing-secret',
+    LOG_STORAGE_S3_ACCESS_KEY_ID: 'external-consumer-access-key',
+    LOG_STORAGE_S3_BUCKET: 'shipfox-logs',
+    LOG_STORAGE_S3_ENDPOINT: 'http://127.0.0.1:3900',
+    LOG_STORAGE_S3_FORCE_PATH_STYLE: 'true',
+    LOG_STORAGE_S3_REGION: 'garage',
+    LOG_STORAGE_S3_SECRET_ACCESS_KEY: 'external-consumer-secret-key',
+    POSTGRES_DATABASE: postgresDatabase,
+    POSTGRES_HOST: postgresHost,
+    POSTGRES_MAX_CONNECTIONS: '5',
+    POSTGRES_PASSWORD: postgresPassword,
+    POSTGRES_PORT: postgresPort,
+    POSTGRES_USERNAME: postgresUsername,
+    SECRETS_ENCRYPTION_KEK: 'ZmVkY2JhOTg3NjU0MzIxMGZlZGNiYTk4NzY1NDMyMTA=',
+    SENTRY_APP_CLIENT_ID: 'external-consumer-client-id',
+    SENTRY_APP_CLIENT_SECRET: 'external-consumer-client-secret',
+    SENTRY_APP_SLUG: 'shipfox-external-consumer',
+    SENTRY_APP_VERIFY_INSTALL: 'true',
+    TEMPORAL_ADDRESS: '127.0.0.1:7233',
+    WORKSPACE_JWT_SECRET: 'external-consumer-workspace-secret',
+  };
+}

package/test/published/composition.ts

@@ -0,0 +1,19 @@
+import {createRunnersModule} from '@shipfox/api-runners';
+import {createServer, defaultModules} from '@shipfox/api-server';
+
+void createServer({
+  modules: [
+    ...(await defaultModules({
+      runnersModule: ({auth}) =>
+        createRunnersModule({
+          auth,
+          installationProvisioning: {
+            policy: {
+              filterEligibleWorkspaceIds: async (workspaceIds) => new Set(workspaceIds),
+            },
+          },
+        }),
+    })),
+    {name: 'external-dummy'},
+  ],
+});

package/test/published/development-conditions.development.mjs

@@ -0,0 +1,3 @@
+await import('@shipfox/api-server/instrumentation');
+
+process.exit(0);

package/test/published/login-methods-route.mjs

@@ -0,0 +1,22 @@
+const {loginMethodsResponseSchema} = await import('@shipfox/api-auth-dto');
+const {createLoginMethodsRoute} = await import('@shipfox/api-server');
+const {createApp} = await import('@shipfox/node-fastify');
+
+const app = await createApp({
+  auth: [],
+  routes: [createLoginMethodsRoute({loginMethods: [{id: 'external-provider'}]})],
+  swagger: false,
+});
+
+try {
+  const response = await app.inject({method: 'GET', url: '/auth/login-methods'});
+  if (response.statusCode !== 200) {
+    throw new Error('Packed login-method catalog route did not respond.');
+  }
+  const body = loginMethodsResponseSchema.parse(response.json());
+  if (body.login_methods[0]?.id !== 'external-provider') {
+    throw new Error('Packed login-method catalog route returned an unexpected contract.');
+  }
+} finally {
+  await app.close();
+}

package/test/published/workflow-bundles.mjs

@@ -0,0 +1,50 @@
+process.env.INTEGRATIONS_ENABLE_SENTRY_PROVIDER = 'true';
+process.env.NODE_ENV = 'production';
+
+const {readdir, readFile} = await import('node:fs/promises');
+const {dirname, join} = await import('node:path');
+const {defaultModules} = await import('@shipfox/api-server');
+const {loadProductionWorkflowBundle} = await import('@shipfox/node-temporal');
+const modules = await defaultModules();
+const workflowPaths = new Set(
+  modules.flatMap((module) => module.workers ?? []).map((worker) => worker.workflowsPath),
+);
+
+if (!workflowPaths.size) throw new Error('Packed API server declares no workflow entrypoints.');
+
+const bundles = new Map();
+for (const workflowsPath of workflowPaths) {
+  const workflowBundle = loadProductionWorkflowBundle(workflowsPath);
+  bundles.set(workflowsPath, workflowBundle);
+
+  const code = await readFile(workflowBundle.codePath, 'utf8');
+  if (/@shipfox[/\\][^/\\]+[/\\]src[/\\]/u.test(code)) {
+    throw new Error(`Workflow bundle for ${workflowsPath} resolved a first-party source path.`);
+  }
+}
+
+const declaredCodePaths = new Set([...bundles.values()].map(({codePath}) => codePath));
+if (declaredCodePaths.size !== workflowPaths.size) {
+  throw new Error('Packed API workflow entrypoints do not map one-to-one to prebuilt bundles.');
+}
+
+const workflowDirectories = new Set(
+  [...workflowPaths].map((workflowsPath) => dirname(workflowsPath)),
+);
+const emittedBundles = (
+  await Promise.all(
+    [...workflowDirectories].map(async (directory) =>
+      (
+        await readdir(directory)
+      )
+        .filter((entry) => entry.endsWith('.bundle.js'))
+        .map((entry) => join(directory, entry)),
+    ),
+  )
+).flat();
+const unreferencedBundles = emittedBundles.filter((codePath) => !declaredCodePaths.has(codePath));
+if (unreferencedBundles.length) {
+  throw new Error(
+    `Packed API contains unreferenced workflow bundles: ${unreferencedBundles.join(', ')}`,
+  );
+}