@squadbase/vite-server 0.1.12-dev.a9ac647 → 0.1.17-dev.24af54e

package/dist/connectors/google-audit-log.js

@@ -1,48 +1,60 @@
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+
 // ../connectors/src/parameter-definition.ts
-var ParameterDefinition = class {
-  slug;
-  name;
-  description;
-  envVarBaseKey;
-  type;
-  secret;
-  required;
-  constructor(config) {
-    this.slug = config.slug;
-    this.name = config.name;
-    this.description = config.description;
-    this.envVarBaseKey = config.envVarBaseKey;
-    this.type = config.type;
-    this.secret = config.secret;
-    this.required = config.required;
-  }
-  /**
-   * Get the parameter value from a ConnectorConnectionObject.
-   */
-  getValue(connection2) {
-    const param = connection2.parameters.find(
-      (p) => p.parameterSlug === this.slug
-    );
-    if (!param || param.value == null) {
-      throw new Error(
-        `Parameter "${this.slug}" not found or has no value in connection "${connection2.id}"`
-      );
-    }
-    return param.value;
-  }
-  /**
-   * Try to get the parameter value. Returns undefined if not found (for optional params).
-   */
-  tryGetValue(connection2) {
-    const param = connection2.parameters.find(
-      (p) => p.parameterSlug === this.slug
-    );
-    if (!param || param.value == null) return void 0;
-    return param.value;
+var ParameterDefinition;
+var init_parameter_definition = __esm({
+  "../connectors/src/parameter-definition.ts"() {
+    "use strict";
+    ParameterDefinition = class {
+      slug;
+      name;
+      description;
+      envVarBaseKey;
+      type;
+      secret;
+      required;
+      constructor(config) {
+        this.slug = config.slug;
+        this.name = config.name;
+        this.description = config.description;
+        this.envVarBaseKey = config.envVarBaseKey;
+        this.type = config.type;
+        this.secret = config.secret;
+        this.required = config.required;
+      }
+      /**
+       * Get the parameter value from a ConnectorConnectionObject.
+       */
+      getValue(connection2) {
+        const param = connection2.parameters.find(
+          (p) => p.parameterSlug === this.slug
+        );
+        if (!param || param.value == null) {
+          throw new Error(
+            `Parameter "${this.slug}" not found or has no value in connection "${connection2.id}"`
+          );
+        }
+        return param.value;
+      }
+      /**
+       * Try to get the parameter value. Returns undefined if not found (for optional params).
+       */
+      tryGetValue(connection2) {
+        const param = connection2.parameters.find(
+          (p) => p.parameterSlug === this.slug
+        );
+        if (!param || param.value == null) return void 0;
+        return param.value;
+      }
+    };
   }
-};
+});
 
 // ../connectors/src/connectors/google-audit-log/parameters.ts
+init_parameter_definition();
 var parameters = {
   serviceAccountKeyJsonBase64: new ParameterDefinition({
     slug: "service-account-key-json-base64",
@@ -165,6 +177,28 @@ var ConnectorPlugin = class _ConnectorPlugin {
   tools;
   query;
   checkConnection;
+  /**
+   * SQPD-1212: Logic-based, rule-driven connection setup. Connectors that
+   * implement this expose a step-by-step exploration flow (database/schema/
+   * table/etc. discovery) that the dashboard backend drives via the
+   * `/connections/:connectionId/setup` endpoint. Implement by delegating to
+   * `runSetupFlow` from `setup-flow.ts`.
+   */
+  setup;
+  /**
+   * Opt-out of the default "verify before save" behavior on connection
+   * creation. The backend invokes `checkConnection` synchronously while
+   * creating the connection and aborts (no row inserted) if it fails — this
+   * flag disables that for connectors where the check cannot succeed pre-save:
+   *
+   *   - `squadbase-db` populates `connection-url` only after Neon provisioning
+   *   - OAuth connectors require an OAuth-aware proxyFetch keyed by the
+   *     connectionId, which doesn't exist until the row is saved
+   *
+   * Exceptions are the explicit position; new credential-input connectors get
+   * the default verify-on-create behavior without opt-in.
+   */
+  skipConnectionCheckOnCreate;
   constructor(config) {
     this.slug = config.slug;
     this.authType = config.authType;
@@ -181,6 +215,8 @@ var ConnectorPlugin = class _ConnectorPlugin {
     this.tools = config.tools;
     this.query = config.query;
     this.checkConnection = config.checkConnection;
+    this.setup = config.setup;
+    this.skipConnectionCheckOnCreate = config.skipConnectionCheckOnCreate;
   }
   get connectorKey() {
     return _ConnectorPlugin.deriveKey(this.slug, this.authType);
@@ -245,6 +281,51 @@ var ConnectorPlugin = class _ConnectorPlugin {
   }
 };
 
+// ../connectors/src/setup-flow.ts
+async function runSetupFlow(flow, params, ctx, config) {
+  const runtime = {
+    params,
+    language: ctx.language,
+    config
+  };
+  let state = flow.initialState();
+  let answerIdx = 0;
+  for (const step of flow.steps) {
+    const ans = ctx.answers[answerIdx];
+    if (ans && ans.questionSlug === step.slug) {
+      state = step.applyAnswer(state, ans.answer);
+      answerIdx += 1;
+      continue;
+    }
+    if (step.type === "text") {
+      return {
+        type: "nextQuestion",
+        questionSlug: step.slug,
+        question: step.question[ctx.language],
+        questionType: "text"
+      };
+    }
+    const options = step.fetchOptions ? await step.fetchOptions(state, runtime) : [];
+    if (options.length === 0) {
+      continue;
+    }
+    return {
+      type: "nextQuestion",
+      questionSlug: step.slug,
+      question: step.question[ctx.language],
+      questionType: step.type,
+      options
+    };
+  }
+  const dataInvestigationResult = await flow.finalize(state, runtime);
+  return { type: "fulfilled", dataInvestigationResult };
+}
+async function resolveSetupSelection(params) {
+  const { selected, allSentinel, fetchAll, limit } = params;
+  const resolved = selected.includes(allSentinel) ? await fetchAll() : selected.filter((v) => v !== allSentinel);
+  return resolved.slice(0, limit);
+}
+
 // ../connectors/src/auth-types.ts
 var AUTH_TYPES = {
   OAUTH: "oauth",
@@ -470,6 +551,221 @@ var googleAuditLogOnboarding = new ConnectorOnboarding({
   }
 });
 
+// ../connectors/src/connectors/google-audit-log/setup-flow.ts
+var ALL_APPLICATIONS = "__ALL_APPLICATIONS__";
+var GOOGLE_AUDIT_LOG_SETUP_MAX_APPS = 24;
+var APPLICATIONS = [
+  {
+    value: "access_transparency",
+    label: {
+      en: "Access Transparency \u2014 Google staff access events",
+      ja: "Access Transparency \u2014 Google \u30B9\u30BF\u30C3\u30D5\u306E\u30A2\u30AF\u30BB\u30B9\u8A18\u9332"
+    }
+  },
+  {
+    value: "admin",
+    label: {
+      en: "Admin \u2014 Workspace admin console actions",
+      ja: "Admin \u2014 \u7BA1\u7406\u30B3\u30F3\u30BD\u30FC\u30EB\u306E\u64CD\u4F5C"
+    }
+  },
+  {
+    value: "calendar",
+    label: {
+      en: "Calendar \u2014 calendar events and sharing changes",
+      ja: "Calendar \u2014 \u30AB\u30EC\u30F3\u30C0\u30FC\u30A4\u30D9\u30F3\u30C8\u3068\u5171\u6709\u8A2D\u5B9A\u306E\u5909\u66F4"
+    }
+  },
+  {
+    value: "chat",
+    label: {
+      en: "Chat \u2014 Google Chat messages and spaces",
+      ja: "Chat \u2014 Google Chat \u306E\u30E1\u30C3\u30BB\u30FC\u30B8\u3068\u30B9\u30DA\u30FC\u30B9"
+    }
+  },
+  {
+    value: "chrome",
+    label: {
+      en: "Chrome \u2014 Chrome browser/device management events",
+      ja: "Chrome \u2014 Chrome \u30D6\u30E9\u30A6\u30B6\u30FB\u30C7\u30D0\u30A4\u30B9\u7BA1\u7406\u30A4\u30D9\u30F3\u30C8"
+    }
+  },
+  {
+    value: "context_aware_access",
+    label: {
+      en: "Context-aware Access \u2014 access policy evaluations",
+      ja: "Context-aware Access \u2014 \u30A2\u30AF\u30BB\u30B9\u30DD\u30EA\u30B7\u30FC\u8A55\u4FA1"
+    }
+  },
+  {
+    value: "data_studio",
+    label: {
+      en: "Looker Studio \u2014 report/data source activity",
+      ja: "Looker Studio \u2014 \u30EC\u30DD\u30FC\u30C8 / \u30C7\u30FC\u30BF\u30BD\u30FC\u30B9\u306E\u64CD\u4F5C"
+    }
+  },
+  {
+    value: "drive",
+    label: {
+      en: "Drive \u2014 file create / share / download / delete",
+      ja: "Drive \u2014 \u30D5\u30A1\u30A4\u30EB\u306E\u4F5C\u6210\u30FB\u5171\u6709\u30FB\u30C0\u30A6\u30F3\u30ED\u30FC\u30C9\u30FB\u524A\u9664"
+    }
+  },
+  {
+    value: "gcp",
+    label: {
+      en: "GCP \u2014 Workspace-linked GCP project events",
+      ja: "GCP \u2014 Workspace \u306B\u7D10\u3065\u304F GCP \u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u306E\u30A4\u30D9\u30F3\u30C8"
+    }
+  },
+  {
+    value: "gplus",
+    label: {
+      en: "Currents/Google+ \u2014 community events (legacy)",
+      ja: "Currents/Google+ \u2014 \u30B3\u30DF\u30E5\u30CB\u30C6\u30A3\u30A4\u30D9\u30F3\u30C8 (\u30EC\u30AC\u30B7\u30FC)"
+    }
+  },
+  {
+    value: "groups",
+    label: {
+      en: "Groups \u2014 group membership and settings",
+      ja: "Groups \u2014 \u30B0\u30EB\u30FC\u30D7\u30E1\u30F3\u30D0\u30FC\u30B7\u30C3\u30D7\u3068\u8A2D\u5B9A"
+    }
+  },
+  {
+    value: "groups_enterprise",
+    label: {
+      en: "Groups Enterprise \u2014 enterprise group activity",
+      ja: "Groups Enterprise \u2014 \u30A8\u30F3\u30BF\u30FC\u30D7\u30E9\u30A4\u30BA\u30B0\u30EB\u30FC\u30D7\u306E\u30A2\u30AF\u30C6\u30A3\u30D3\u30C6\u30A3"
+    }
+  },
+  {
+    value: "jamboard",
+    label: {
+      en: "Jamboard \u2014 Jamboard device events",
+      ja: "Jamboard \u2014 Jamboard \u30C7\u30D0\u30A4\u30B9\u30A4\u30D9\u30F3\u30C8"
+    }
+  },
+  {
+    value: "keep",
+    label: {
+      en: "Keep \u2014 Keep notes activity",
+      ja: "Keep \u2014 Keep \u306E\u30E1\u30E2\u64CD\u4F5C"
+    }
+  },
+  {
+    value: "login",
+    label: {
+      en: "Login \u2014 user sign-in successes and failures",
+      ja: "Login \u2014 \u30E6\u30FC\u30B6\u30FC\u306E\u30B5\u30A4\u30F3\u30A4\u30F3\u6210\u5426"
+    }
+  },
+  {
+    value: "meet",
+    label: {
+      en: "Meet \u2014 meeting and recording events",
+      ja: "Meet \u2014 \u4F1A\u8B70\u30FB\u9332\u753B\u30A4\u30D9\u30F3\u30C8"
+    }
+  },
+  {
+    value: "mobile",
+    label: {
+      en: "Mobile \u2014 managed mobile device events",
+      ja: "Mobile \u2014 \u7BA1\u7406\u5BFE\u8C61\u30E2\u30D0\u30A4\u30EB\u30C7\u30D0\u30A4\u30B9\u306E\u30A4\u30D9\u30F3\u30C8"
+    }
+  },
+  {
+    value: "rules",
+    label: {
+      en: "Rules \u2014 automated rule triggers",
+      ja: "Rules \u2014 \u81EA\u52D5\u30EB\u30FC\u30EB\u306E\u767A\u706B"
+    }
+  },
+  {
+    value: "saml",
+    label: {
+      en: "SAML \u2014 SAML SSO sign-in events",
+      ja: "SAML \u2014 SAML SSO \u30B5\u30A4\u30F3\u30A4\u30F3\u30A4\u30D9\u30F3\u30C8"
+    }
+  },
+  {
+    value: "token",
+    label: {
+      en: "Token \u2014 OAuth token grants and revocations",
+      ja: "Token \u2014 OAuth \u30C8\u30FC\u30AF\u30F3\u306E\u4ED8\u4E0E\u30FB\u53D6\u308A\u6D88\u3057"
+    }
+  },
+  {
+    value: "user_accounts",
+    label: {
+      en: "User Accounts \u2014 end-user account self-service",
+      ja: "User Accounts \u2014 \u30A8\u30F3\u30C9\u30E6\u30FC\u30B6\u30FC\u306E\u30A2\u30AB\u30A6\u30F3\u30C8\u64CD\u4F5C"
+    }
+  },
+  {
+    value: "vault",
+    label: {
+      en: "Vault \u2014 eDiscovery / retention activity",
+      ja: "Vault \u2014 eDiscovery\u30FB\u30C7\u30FC\u30BF\u4FDD\u6301\u306E\u64CD\u4F5C"
+    }
+  }
+];
+var googleAuditLogSetupFlow = {
+  initialState: () => ({}),
+  steps: [
+    {
+      slug: "applications",
+      type: "multiSelect",
+      question: {
+        ja: "\u5BFE\u8C61\u306E Workspace \u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\uFF08\u76E3\u67FB\u5BFE\u8C61\uFF09\u3092\u9078\u3093\u3067\u304F\u3060\u3055\u3044\uFF08\u8907\u6570\u9078\u629E\u53EF\uFF09",
+        en: "Select target Workspace applications to audit (multi-select allowed)"
+      },
+      async fetchOptions(_state, rt) {
+        return [
+          {
+            value: ALL_APPLICATIONS,
+            label: rt.language === "ja" ? "\u3059\u3079\u3066\u306E\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3" : "All applications"
+          },
+          ...APPLICATIONS.map((a) => ({
+            value: a.value,
+            label: a.label[rt.language]
+          }))
+        ];
+      },
+      applyAnswer: (state, answer) => ({ ...state, applications: answer })
+    }
+  ],
+  async finalize(state, rt) {
+    if (!state.applications) {
+      throw new Error(
+        "Google Audit Log setup: incomplete state on finalize"
+      );
+    }
+    const targetApplications = await resolveSetupSelection({
+      selected: state.applications,
+      allSentinel: ALL_APPLICATIONS,
+      fetchAll: async () => APPLICATIONS.map((a) => a.value),
+      limit: GOOGLE_AUDIT_LOG_SETUP_MAX_APPS
+    });
+    const labelByValue = new Map(
+      APPLICATIONS.map((a) => [a.value, a.label[rt.language]])
+    );
+    const sections = ["## Google Workspace Audit Log", ""];
+    if (targetApplications.length === 0) {
+      sections.push("_No applications selected._", "");
+      return sections.join("\n");
+    }
+    sections.push("| Application | Description |");
+    sections.push("|-------------|-------------|");
+    for (const app of targetApplications) {
+      const desc = (labelByValue.get(app) ?? app).replace(/\|/g, "\\|");
+      sections.push(`| ${app} | ${desc} |`);
+    }
+    sections.push("");
+    return sections.join("\n");
+  }
+};
+
 // ../connectors/src/connectors/google-audit-log/index.ts
 var tools = { request_with_delegation: requestWithDelegationTool };
 var googleAuditLogConnector = new ConnectorPlugin({
@@ -661,7 +957,57 @@ export default async function handler(c: Context) {
 }
 \`\`\``
   },
-  tools
+  tools,
+  setup: (params, ctx, config) => runSetupFlow(googleAuditLogSetupFlow, params, ctx, config),
+  async checkConnection(params, _config) {
+    const keyJsonBase64 = params[parameters.serviceAccountKeyJsonBase64.slug];
+    if (!keyJsonBase64) {
+      return {
+        success: false,
+        error: "google-audit-log: missing service account key"
+      };
+    }
+    let sa;
+    try {
+      const decoded = Buffer.from(keyJsonBase64, "base64").toString("utf-8");
+      sa = JSON.parse(decoded);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return {
+        success: false,
+        error: `google-audit-log: failed to parse service account JSON: ${msg}`
+      };
+    }
+    if (!sa.client_email || !sa.private_key) {
+      return {
+        success: false,
+        error: "google-audit-log: service account JSON must contain client_email and private_key"
+      };
+    }
+    try {
+      const { GoogleAuth } = await import("google-auth-library");
+      const auth = new GoogleAuth({
+        credentials: {
+          client_email: sa.client_email,
+          private_key: sa.private_key
+        },
+        scopes: [
+          "https://www.googleapis.com/auth/admin.reports.audit.readonly"
+        ]
+      });
+      const token = await auth.getAccessToken();
+      if (!token) {
+        return {
+          success: false,
+          error: "google-audit-log: failed to obtain access token"
+        };
+      }
+      return { success: true };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return { success: false, error: msg };
+    }
+  }
 });
 
 // src/connectors/create-connector-sdk.ts
@@ -690,6 +1036,7 @@ function resolveEnvVarOptional(entry, key) {
 import { getContext } from "hono/context-storage";
 import { getCookie } from "hono/cookie";
 var APP_SESSION_COOKIE_NAME = "__Host-squadbase-session";
+var TABLEAU_SESSION_SENTINEL_URL = "squadbase://tableau-session/";
 function normalizeHeaders(input) {
   const out = {};
   if (!input) return out;
@@ -698,6 +1045,11 @@ function normalizeHeaders(input) {
   });
   return out;
 }
+function extractInputUrl(input) {
+  if (typeof input === "string") return input;
+  if (input instanceof URL) return input.href;
+  return input.url;
+}
 function createSandboxProxyFetch(connectionId) {
   return async (input, init) => {
     const token = process.env.INTERNAL_SQUADBASE_OAUTH_MACHINE_CREDENTIAL;
@@ -707,10 +1059,17 @@ function createSandboxProxyFetch(connectionId) {
         "Connection proxy is not configured. Please check your deployment settings."
       );
     }
-    const originalUrl = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    const originalUrl = extractInputUrl(input);
+    const baseDomain = process.env["SQUADBASE_PREVIEW_BASE_DOMAIN"] ?? "preview.app.squadbase.dev";
+    if (originalUrl === TABLEAU_SESSION_SENTINEL_URL) {
+      const sessionUrl = `https://${sandboxId}.${baseDomain}/_sqcore/connections/${connectionId}/tableau-session`;
+      return fetch(sessionUrl, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}` }
+      });
+    }
     const originalMethod = init?.method ?? "GET";
     const originalBody = init?.body ? JSON.parse(init.body) : void 0;
-    const baseDomain = process.env["SQUADBASE_PREVIEW_BASE_DOMAIN"] ?? "preview.app.squadbase.dev";
     const proxyUrl = `https://${sandboxId}.${baseDomain}/_sqcore/connections/${connectionId}/request`;
     return fetch(proxyUrl, {
       method: "POST",
@@ -736,10 +1095,9 @@ function createDeployedAppProxyFetch(connectionId) {
   }
   const baseDomain = process.env["SQUADBASE_APP_BASE_DOMAIN"] ?? "squadbase.app";
   const proxyUrl = `https://${projectId}.${baseDomain}/_sqcore/connections/${connectionId}/request`;
+  const sessionUrl = `https://${projectId}.${baseDomain}/_sqcore/connections/${connectionId}/tableau-session`;
   return async (input, init) => {
-    const originalUrl = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
-    const originalMethod = init?.method ?? "GET";
-    const originalBody = init?.body ? JSON.parse(init.body) : void 0;
+    const originalUrl = extractInputUrl(input);
     const c = getContext();
     const appSession = getCookie(c, APP_SESSION_COOKIE_NAME);
     if (!appSession) {
@@ -747,6 +1105,14 @@ function createDeployedAppProxyFetch(connectionId) {
         "No authentication method available for connection proxy."
       );
     }
+    if (originalUrl === TABLEAU_SESSION_SENTINEL_URL) {
+      return fetch(sessionUrl, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${appSession}` }
+      });
+    }
+    const originalMethod = init?.method ?? "GET";
+    const originalBody = init?.body ? JSON.parse(init.body) : void 0;
     return fetch(proxyUrl, {
       method: "POST",
       headers: {