@shipfox/api-workflows 5.0.0 → 7.0.1

package/src/presentation/routes/get-step-secrets.ts

@@ -1,4 +1,4 @@
-import {getSecret, SecretDecryptionError} from '@shipfox/api-secrets';
+import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
 import {
   materializedSecretBindingSchema,
   type StepSecretDto,
@@ -6,6 +6,11 @@ import {
   stepSecretsQuerySchema,
   stepSecretsResponseSchema,
 } from '@shipfox/api-secrets-dto';
+import {
+  type SecretsInterModuleClient,
+  secretsInterModuleContract,
+} from '@shipfox/api-secrets-dto/inter-module';
+import {isInterModuleKnownError} from '@shipfox/inter-module';
 import {captureException} from '@shipfox/node-error-monitoring';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {logger} from '@shipfox/node-opentelemetry';
@@ -14,72 +19,78 @@ import {loadRunningLeasedStep} from './leased-step.js';
 
 const secretBindingsSchema = z.array(materializedSecretBindingSchema);
 
-export const getStepSecretsRoute = defineRoute({
-  method: 'GET',
-  path: '/steps/:stepId/secrets',
-  description:
-    "Returns decrypted secret values referenced by the runner's currently leased running run step. The job scope and secret bindings are re-derived from server state; the runner supplies only the step id and current attempt.",
-  schema: {
-    params: stepSecretsParamsSchema,
-    querystring: stepSecretsQuerySchema,
-    response: {
-      200: stepSecretsResponseSchema,
+export function createGetStepSecretsRoute(
+  runners: RunnersInterModuleClient,
+  secretsClient: SecretsInterModuleClient,
+) {
+  return defineRoute({
+    method: 'GET',
+    path: '/steps/:stepId/secrets',
+    description:
+      "Returns decrypted secret values referenced by the runner's currently leased running run step. The job scope and secret bindings are re-derived from server state; the runner supplies only the step id and current attempt.",
+    schema: {
+      params: stepSecretsParamsSchema,
+      querystring: stepSecretsQuerySchema,
+      response: {
+        200: stepSecretsResponseSchema,
+      },
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof SecretDecryptionError) {
-      captureException(error);
-      throw new ClientError('Step secret could not be decrypted', 'secret-value-invalid', {
-        status: 409,
-        cause: error,
+    errorHandler: (error) => {
+      if (isInterModuleKnownError(secretsInterModuleContract.methods.getSecret, error)) {
+        captureException(error);
+        throw new ClientError('Step secret could not be decrypted', 'secret-value-invalid', {
+          status: 409,
+          cause: error,
+        });
+      }
+      throw error;
+    },
+    handler: async (request, reply) => {
+      const {stepId} = request.params;
+      const {attempt} = request.query;
+      const {leasedJob, step, workspaceId, projectId} = await loadRunningLeasedStep({
+        runners,
+        request,
+        stepId,
+        attempt,
       });
-    }
-    throw error;
-  },
-  handler: async (request, reply) => {
-    const {stepId} = request.params;
-    const {attempt} = request.query;
-    const {leasedJob, step, workspaceId, projectId} = await loadRunningLeasedStep({
-      request,
-      stepId,
-      attempt,
-    });
 
-    if (step.type !== 'run') {
-      throw new ClientError('Step is not a run step', 'step-not-run', {status: 409});
-    }
+      if (step.type !== 'run') {
+        throw new ClientError('Step is not a run step', 'step-not-run', {status: 409});
+      }
 
-    const secretBindings = parseSecretBindings(step.config.secret_bindings);
-    const references = distinctSecretReferences(secretBindings);
-    const secrets = await Promise.all(
-      references.map(async (reference): Promise<StepSecretDto> => {
-        const value = await getSecret({
-          workspaceId,
-          projectId,
-          namespace: '',
-          key: reference.key,
-          store: reference.store,
-        });
-        if (value === null) {
-          throw new ClientError('Secret not found', 'secret-not-found', {status: 422});
-        }
-        return {...reference, value};
-      }),
-    );
+      const secretBindings = parseSecretBindings(step.config.secret_bindings);
+      const references = distinctSecretReferences(secretBindings);
+      const secrets = await Promise.all(
+        references.map(async (reference): Promise<StepSecretDto> => {
+          const {value} = await secretsClient.getSecret({
+            workspaceId,
+            projectId,
+            namespace: '',
+            key: reference.key,
+            store: reference.store,
+          });
+          if (value === null) {
+            throw new ClientError('Secret not found', 'secret-not-found', {status: 422});
+          }
+          return {...reference, value};
+        }),
+      );
 
-    logger().info(
-      {jobId: leasedJob.jobId, workspaceId, stepId, keyCount: references.length},
-      'Resolved step secrets',
-    );
-    logger().debug(
-      {jobId: leasedJob.jobId, workspaceId, stepId, keys: references.map((ref) => ref.key)},
-      'Resolved step secret keys',
-    );
+      logger().info(
+        {jobId: leasedJob.jobId, workspaceId, stepId, keyCount: references.length},
+        'Resolved step secrets',
+      );
+      logger().debug(
+        {jobId: leasedJob.jobId, workspaceId, stepId, keys: references.map((ref) => ref.key)},
+        'Resolved step secret keys',
+      );
 
-    reply.header('cache-control', 'no-store');
-    return {secrets};
-  },
-});
+      reply.header('cache-control', 'no-store');
+      return {secrets};
+    },
+  });
+}
 
 function parseSecretBindings(value: unknown): z.infer<typeof secretBindingsSchema> {
   try {

package/src/presentation/routes/index.test.ts

@@ -7,7 +7,13 @@ import {
 } from '@shipfox/api-auth-context';
 import {type AuthMethod, ClientError, closeApp, createApp} from '@shipfox/node-fastify';
 import type {FastifyRequest} from 'fastify';
-import {workflowRoutes} from './index.js';
+import {agentTestClient} from '#test/fixtures/agent-inter-module.js';
+import {annotationsTestClient} from '#test/fixtures/annotations-inter-module.js';
+import {workflowsTestAuthClient} from '#test/fixtures/auth-inter-module.js';
+import {projectsTestClient} from '#test/fixtures/projects-inter-module.js';
+import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
+import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
+import {createWorkflowRoutes} from './index.js';
 
 const fakeUserAuth: AuthMethod = {
   name: AUTH_USER,
@@ -29,6 +35,15 @@ afterEach(async () => {
 });
 
 describe('workflow route auth', () => {
+  const workflowRoutes = createWorkflowRoutes({
+    agent: agentTestClient,
+    annotations: annotationsTestClient,
+    auth: workflowsTestAuthClient,
+    integrations: {} as never,
+    projects: projectsTestClient,
+    runners: runnersTestClient,
+    secrets: createTestSecretsClient(),
+  });
   test('uses user auth', () => {
     expect(workflowRoutes[0]?.auth).toBe(AUTH_USER);
   });

package/src/presentation/routes/index.ts

@@ -1,42 +1,67 @@
+import type {AnnotationsInterModuleClient} from '@shipfox/annotations-dto/inter-module';
+import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
 import {AUTH_LEASED_JOB, AUTH_USER} from '@shipfox/api-auth-context';
+import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
+import type {SecretsInterModuleClient} from '@shipfox/api-secrets-dto/inter-module';
 import type {RouteGroup} from '@shipfox/node-fastify';
-import {agentRuntimeConfigRoute} from './agent-runtime-config.js';
+import {createAgentRuntimeConfigRoute} from './agent-runtime-config.js';
 import {cancelRunRoute} from './cancel-run.js';
-import {checkoutTokenRoute} from './checkout-token.js';
+import {createCheckoutTokenRoute} from './checkout-token.js';
 import {getRunRoute} from './get-run.js';
 import {getRunAggregatesRoute} from './get-run-aggregates.js';
-import {getStepSecretsRoute} from './get-step-secrets.js';
+import {createGetStepSecretsRoute} from './get-step-secrets.js';
 import {listRunAttemptsRoute} from './list-run-attempts.js';
 import {listRunsRoute} from './list-runs.js';
-import {nextStepRoute} from './next-step.js';
-import {reportStepRoute} from './report-step.js';
+import {createNextStepRoute} from './next-step.js';
+import {createReportStepRoute} from './report-step.js';
 import {rerunRunRoute} from './rerun-run.js';
 
-export const leaseTokenRouteGroup: RouteGroup = {
-  // The lease token names the job, so the path carries no job id ("current").
-  prefix: '/runs/jobs/current',
-  auth: AUTH_LEASED_JOB,
-  routes: [
-    nextStepRoute,
-    reportStepRoute,
-    checkoutTokenRoute,
-    agentRuntimeConfigRoute,
-    getStepSecretsRoute,
-  ],
+type WorkflowRouteClients = {
+  agent: AgentInterModuleClient;
+  annotations: AnnotationsInterModuleClient;
+  auth: AuthInterModuleClient;
+  integrations: IntegrationsModuleClient;
+  projects: ProjectsModuleClient;
+  runners: RunnersInterModuleClient;
+  secrets: SecretsInterModuleClient;
 };
 
-export const workflowRoutes: RouteGroup[] = [
-  {
-    prefix: '/workflows/runs',
-    auth: AUTH_USER,
+export function createLeaseTokenRouteGroup(params: WorkflowRouteClients): RouteGroup {
+  return {
+    // The lease token names the job, so the path carries no job id ("current").
+    prefix: '/runs/jobs/current',
+    auth: AUTH_LEASED_JOB,
     routes: [
-      listRunsRoute,
-      getRunAggregatesRoute,
-      listRunAttemptsRoute,
-      getRunRoute,
-      cancelRunRoute,
-      rerunRunRoute,
+      createNextStepRoute(params),
+      createReportStepRoute(params.runners),
+      createCheckoutTokenRoute({
+        integrations: params.integrations,
+        projects: params.projects,
+        runners: params.runners,
+      }),
+      createAgentRuntimeConfigRoute(params),
+      createGetStepSecretsRoute(params.runners, params.secrets),
     ],
-  },
-  leaseTokenRouteGroup,
-];
+  };
+}
+
+export function createWorkflowRoutes(params: WorkflowRouteClients): RouteGroup[] {
+  return [
+    {
+      prefix: '/workflows/runs',
+      auth: AUTH_USER,
+      routes: [
+        listRunsRoute(params.projects),
+        getRunAggregatesRoute(params.projects),
+        listRunAttemptsRoute(params.projects),
+        getRunRoute(params.projects),
+        cancelRunRoute(params.projects),
+        rerunRunRoute(params.projects),
+      ],
+    },
+    createLeaseTokenRouteGroup(params),
+  ];
+}

package/src/presentation/routes/leased-step.ts

@@ -1,5 +1,5 @@
 import {type LeasedJobContext, requireLeasedJobContext} from '@shipfox/api-auth-context';
-import {isJobLeaseActive} from '@shipfox/api-runners';
+import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
 import {ClientError} from '@shipfox/node-fastify';
 import type {Step} from '#core/entities/step.js';
 import {getJobScope, getStepByIdForJobExecution} from '#db/index.js';
@@ -12,13 +12,14 @@ export interface LoadedRunningLeasedStep {
 }
 
 export async function loadRunningLeasedStep(params: {
+  runners: RunnersInterModuleClient;
   request: object;
   stepId: string;
   attempt: number;
 }): Promise<LoadedRunningLeasedStep> {
   const leasedJob = requireLeasedJobContext(params.request);
 
-  const leaseIsActive = await isJobLeaseActive({
+  const {active: leaseIsActive} = await params.runners.getLeaseState({
     jobId: leasedJob.jobId,
     jobExecutionId: leasedJob.jobExecutionId,
     runnerSessionId: leasedJob.runnerSessionId,

package/src/presentation/routes/list-run-attempts.test.ts

@@ -1,5 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
-import {requireProjectAccess} from '@shipfox/api-projects';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyInstance} from 'fastify';
 import Fastify from 'fastify';
@@ -14,16 +14,11 @@ import {listRunAttemptsRoute} from './list-run-attempts.js';
 
 const projectAccessState = vi.hoisted(() => ({workspaceId: ''}));
 
-vi.mock('@shipfox/api-projects', () => ({
-  requireProjectAccess: vi.fn(({projectId}) =>
-    Promise.resolve({
-      project: {id: projectId, workspaceId: projectAccessState.workspaceId},
-      workspaceId: projectAccessState.workspaceId,
-    }),
-  ),
-}));
-
-const mockRequireProjectAccess = vi.mocked(requireProjectAccess);
+const getProjectById = vi.fn();
+const projects = {
+  getProjectById,
+  requireProjectForWorkspace: vi.fn(),
+} as unknown as ProjectsModuleClient;
 
 describe('GET /api/workflows/runs/:id/attempts', () => {
   let app: FastifyInstance;
@@ -46,7 +41,7 @@ describe('GET /api/workflows/runs/:id/attempts', () => {
       );
       done();
     });
-    app.get('/api/workflows/runs/:id/attempts', listRunAttemptsRoute);
+    app.get('/api/workflows/runs/:id/attempts', listRunAttemptsRoute(projects));
     await app.ready();
   });
 
@@ -55,7 +50,7 @@ describe('GET /api/workflows/runs/:id/attempts', () => {
     projectId = crypto.randomUUID();
     definitionId = crypto.randomUUID();
     projectAccessState.workspaceId = workspaceId;
-    mockRequireProjectAccess.mockImplementation(({projectId: requestedProjectId}) =>
+    getProjectById.mockImplementation(({projectId: requestedProjectId}) =>
       Promise.resolve({
         project: {
           id: requestedProjectId,
@@ -63,10 +58,7 @@ describe('GET /api/workflows/runs/:id/attempts', () => {
           sourceConnectionId: crypto.randomUUID(),
           sourceExternalRepositoryId: `repo:${crypto.randomUUID()}`,
           name: 'Project',
-          createdAt: new Date(),
-          updatedAt: new Date(),
         },
-        workspaceId,
       }),
     );
   });
@@ -121,9 +113,7 @@ describe('GET /api/workflows/runs/:id/attempts', () => {
       url: `/api/workflows/runs/${crypto.randomUUID()}/attempts`,
     });
     const run = await createRun();
-    mockRequireProjectAccess.mockRejectedValueOnce(
-      new ClientError('Forbidden', 'forbidden', {status: 403}),
-    );
+    getProjectById.mockRejectedValueOnce(new ClientError('Forbidden', 'forbidden', {status: 403}));
 
     const inaccessible = await app.inject({
       method: 'GET',

package/src/presentation/routes/list-run-attempts.ts

@@ -1,3 +1,4 @@
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {workflowRunAttemptsResponseSchema} from '@shipfox/api-workflows-dto';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -5,23 +6,25 @@ import {listRunAttempts} from '#db/index.js';
 import {toRunAttemptDto} from '#presentation/dto/index.js';
 import {requireAccessibleRun} from './require-accessible-run.js';
 
-export const listRunAttemptsRoute = defineRoute({
-  method: 'GET',
-  path: '/:id/attempts',
-  description: 'List attempts in a workflow run lineage',
-  schema: {
-    params: z.object({
-      id: z.string().uuid(),
-    }),
-    response: {
-      200: workflowRunAttemptsResponseSchema,
+export function listRunAttemptsRoute(projects: ProjectsModuleClient) {
+  return defineRoute({
+    method: 'GET',
+    path: '/:id/attempts',
+    description: 'List attempts in a workflow run lineage',
+    schema: {
+      params: z.object({
+        id: z.string().uuid(),
+      }),
+      response: {
+        200: workflowRunAttemptsResponseSchema,
+      },
     },
-  },
-  handler: async (request) => {
-    const {id} = request.params;
-    const run = await requireAccessibleRun({request, id});
-    const attempts = await listRunAttempts({workflowRunId: run.id, projectId: run.projectId});
+    handler: async (request) => {
+      const {id} = request.params;
+      const run = await requireAccessibleRun({request, id, projects});
+      const attempts = await listRunAttempts({workflowRunId: run.id, projectId: run.projectId});
 
-    return {attempts: attempts.map(toRunAttemptDto)};
-  },
-});
+      return {attempts: attempts.map(toRunAttemptDto)};
+    },
+  });
+}

package/src/presentation/routes/list-runs.test.ts

@@ -1,4 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {encodeTimestampIdCursor} from '@shipfox/node-drizzle';
 import {eq} from 'drizzle-orm';
 import type {FastifyInstance} from 'fastify';
@@ -12,15 +13,20 @@ import {listRunsRoute} from './list-runs.js';
 
 const projectAccessState = vi.hoisted(() => ({workspaceId: ''}));
 
-vi.mock('@shipfox/api-projects', () => ({
-  ProjectNotFoundError: class ProjectNotFoundError extends Error {},
-  requireProjectAccess: vi.fn(({projectId}) =>
+const projects = {
+  getProjectById: vi.fn(({projectId}) =>
     Promise.resolve({
-      project: {id: projectId, workspaceId: projectAccessState.workspaceId},
-      workspaceId: projectAccessState.workspaceId,
+      project: {
+        id: projectId,
+        workspaceId: projectAccessState.workspaceId,
+        sourceConnectionId: crypto.randomUUID(),
+        sourceExternalRepositoryId: 'repo',
+        name: 'Project',
+      },
     }),
   ),
-}));
+  requireProjectForWorkspace: vi.fn(),
+} as unknown as ProjectsModuleClient;
 
 describe('GET /api/workflows/runs', () => {
   let app: FastifyInstance;
@@ -42,7 +48,7 @@ describe('GET /api/workflows/runs', () => {
       );
       done();
     });
-    app.get('/api/workflows/runs', listRunsRoute);
+    app.get('/api/workflows/runs', listRunsRoute(projects));
     await app.ready();
   });
 

package/src/presentation/routes/list-runs.ts

@@ -1,4 +1,4 @@
-import {ProjectNotFoundError, requireProjectAccess} from '@shipfox/api-projects';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {
   workflowRunListQuerySchema,
   workflowRunListResponseSchema,
@@ -8,76 +8,73 @@ import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {logger} from '@shipfox/node-opentelemetry';
 import {listWorkflowRuns} from '#db/index.js';
 import {toRunDto} from '#presentation/dto/index.js';
+import {requireProjectAccess} from './project-access.js';
 
-export const listRunsRoute = defineRoute({
-  method: 'GET',
-  path: '/',
-  description: 'List workflow runs for a project',
-  schema: {
-    querystring: workflowRunListQuerySchema,
-    response: {
-      200: workflowRunListResponseSchema,
+export function listRunsRoute(projects: ProjectsModuleClient) {
+  return defineRoute({
+    method: 'GET',
+    path: '/',
+    description: 'List workflow runs for a project',
+    schema: {
+      querystring: workflowRunListQuerySchema,
+      response: {
+        200: workflowRunListResponseSchema,
+      },
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof ProjectNotFoundError) {
-      throw new ClientError(error.message, 'project-not-found', {status: 404});
-    }
-    throw error;
-  },
-  handler: async (request) => {
-    const startedAt = performance.now();
-    const {
-      project_id: projectId,
-      limit,
-      cursor,
-      status,
-      definition_id: definitionId,
-      trigger_source: triggerSource,
-      created_from: createdFrom,
-      created_to: createdTo,
-    } = request.query;
-    const decodedCursor = decodeTimestampIdCursor(cursor);
-    if (cursor && !decodedCursor) {
-      throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});
-    }
-
-    const {project} = await requireProjectAccess({request, projectId});
+    handler: async (request) => {
+      const startedAt = performance.now();
+      const {
+        project_id: projectId,
+        limit,
+        cursor,
+        status,
+        definition_id: definitionId,
+        trigger_source: triggerSource,
+        created_from: createdFrom,
+        created_to: createdTo,
+      } = request.query;
+      const decodedCursor = decodeTimestampIdCursor(cursor);
+      if (cursor && !decodedCursor) {
+        throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});
+      }
 
-    const filters = {
-      status,
-      definitionId,
-      triggerSource,
-      createdFrom: createdFrom ? new Date(createdFrom) : undefined,
-      createdTo: createdTo ? new Date(createdTo) : undefined,
-    };
-    const result = await listWorkflowRuns({
-      projectId: project.id,
-      limit,
-      cursor: decodedCursor,
-      filters,
-      includeTotal: !decodedCursor,
-    });
+      const project = await requireProjectAccess(request, projectId, projects);
 
-    logger().info(
-      {
+      const filters = {
+        status,
+        definitionId,
+        triggerSource,
+        createdFrom: createdFrom ? new Date(createdFrom) : undefined,
+        createdTo: createdTo ? new Date(createdTo) : undefined,
+      };
+      const result = await listWorkflowRuns({
         projectId: project.id,
-        filterKeys: Object.entries(filters)
-          .filter(([, value]) => value !== undefined)
-          .map(([key]) => key),
         limit,
-        cursorPresent: Boolean(cursor),
-        resultCount: result.runs.length,
-        nextCursorPresent: Boolean(result.nextCursor),
-        durationMs: Math.round(performance.now() - startedAt),
-      },
-      'Listed workflow runs',
-    );
+        cursor: decodedCursor,
+        filters,
+        includeTotal: !decodedCursor,
+      });
+
+      logger().info(
+        {
+          projectId: project.id,
+          filterKeys: Object.entries(filters)
+            .filter(([, value]) => value !== undefined)
+            .map(([key]) => key),
+          limit,
+          cursorPresent: Boolean(cursor),
+          resultCount: result.runs.length,
+          nextCursorPresent: Boolean(result.nextCursor),
+          durationMs: Math.round(performance.now() - startedAt),
+        },
+        'Listed workflow runs',
+      );
 
-    return {
-      runs: result.runs.map((run) => toRunDto(run)),
-      next_cursor: result.nextCursor ? encodeTimestampIdCursor(result.nextCursor) : null,
-      filtered_total_count: result.filteredTotalCount,
-    };
-  },
-});
+      return {
+        runs: result.runs.map((run) => toRunDto(run)),
+        next_cursor: result.nextCursor ? encodeTimestampIdCursor(result.nextCursor) : null,
+        filtered_total_count: result.filteredTotalCount,
+      };
+    },
+  });
+}