@stigmer/server 3.30.0 → 3.31.0

package/dist/domain/oauthapp/refresolution/refresolution.d.ts

@@ -1,12 +0,0 @@
-import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import type { OAuthApp } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-import type { Logger } from "../../../boot/logger.js";
-import type { Store } from "../../../store/interface.js";
-/**
- * Resolves the OAuthApp the ref means (Go refresolution.Resolve). A ref
- * without a slug resolves to nothing — an McpServerAuth with no (or an
- * empty) oauth_app_ref is the DCR/manual-token arm, not a lookup. Store
- * errors propagate to the caller (Go returns them).
- */
-export declare function resolveOAuthAppRef(store: Store, ref: ApiResourceReference, logger: Logger): Promise<OAuthApp | undefined>;
-//# sourceMappingURL=refresolution.d.ts.map

package/dist/domain/oauthapp/refresolution/refresolution.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"refresolution.d.ts","sourceRoot":"","sources":["../../../../src/domain/oauthapp/refresolution/refresolution.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAElF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,oBAAoB,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA2C/B"}

package/dist/domain/oauthapp/refresolution/refresolution.js

@@ -1,79 +0,0 @@
-/**
- * OAuthApp ref resolution — ports pkg/domain/oauthapp/refresolution: the
- * ONE answer to "which OAuthApp does this `oauth_app_ref` mean?" (the
- * defaultinstance pattern — one small module holds a cross-domain semantic
- * so its consumers cannot drift apart, stigmer/stigmer#584).
- *
- * Consumers: the OAuthApp delete guard (this domain, #13); the OAuth
- * initiate path, the read-path oauth_status enricher, and the token-refresh
- * path arrive with the mcpserver connect/OAuth sub-project (#19) and MUST
- * route through this function — three hand-rolled divergent answers are
- * exactly what #584 removed.
- *
- * Resolution semantics (OSS has a flat OAuthApp store — no org-override
- * chain like the cloud's OAuthAppResolutionService, so the ref is the whole
- * resolution): matching is by slug, with the ref's org as a preference
- * rather than a gate:
- *
- *  1. An exact (org, slug) match wins — unique by the create pipeline's
- *     duplicate check.
- *  2. Otherwise a slug-only match is honored when it is UNIQUE. This lets
- *     a deployment satisfy a public server's ref pinned to
- *     `org: stigmer` with an OAuthApp applied in the user's own org (#584).
- *  3. Two or more slug matches with no exact hit resolve to nothing, with
- *     a WARN naming the candidate orgs: ambiguity is never silently
- *     collapsed into a credential pick.
- *
- * Returns undefined when nothing resolves; callers own the severity of that
- * outcome (the delete guard treats it as unreferenced; initiate will refuse
- * NOT_FOUND, refresh will error — #19).
- */
-import { fromBinary } from "@bufbuild/protobuf";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-/**
- * Resolves the OAuthApp the ref means (Go refresolution.Resolve). A ref
- * without a slug resolves to nothing — an McpServerAuth with no (or an
- * empty) oauth_app_ref is the DCR/manual-token arm, not a lookup. Store
- * errors propagate to the caller (Go returns them).
- */
-export async function resolveOAuthAppRef(store, ref, logger) {
-    if (ref.slug === "") {
-        return undefined;
-    }
-    const rows = await store.listResources(ApiResourceKind.oauth_app);
-    // Collect-then-decide: a single pass gathers every slug match so the
-    // outcome depends only on the store's contents, never on its iteration
-    // order (Go's earlier first-match-wins scan was nondeterministic when a
-    // slug existed in several orgs).
-    const slugMatches = [];
-    for (const data of rows) {
-        let app;
-        try {
-            app = fromBinary(OAuthAppSchema, data);
-        }
-        catch {
-            continue; // skip malformed rows, as Go does
-        }
-        if ((app.metadata?.slug ?? "") !== ref.slug) {
-            continue;
-        }
-        if (ref.org !== "" && app.metadata?.org === ref.org) {
-            return app; // exact match: unique by the create duplicate check
-        }
-        slugMatches.push(app);
-    }
-    if (slugMatches.length === 0) {
-        return undefined;
-    }
-    if (slugMatches.length === 1) {
-        return slugMatches[0];
-    }
-    logger.warn("oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick — pin the ref's org to resolve", {
-        oauthAppSlug: ref.slug,
-        refOrg: ref.org,
-        candidateOrgs: slugMatches.map((app) => app.metadata?.org ?? ""),
-    });
-    return undefined;
-}
-//# sourceMappingURL=refresolution.js.map

package/dist/domain/oauthapp/refresolution/refresolution.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"refresolution.js","sourceRoot":"","sources":["../../../../src/domain/oauthapp/refresolution/refresolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAMnF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY,EACZ,GAAyB,EACzB,MAAc;IAEd,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAElE,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,iCAAiC;IACjC,MAAM,WAAW,GAAe,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,kCAAkC;QAC9C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YACpD,OAAO,GAAG,CAAC,CAAC,oDAAoD;QAClE,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,IAAI,CACT,kIAAkI,EAClI;QACE,YAAY,EAAE,GAAG,CAAC,IAAI;QACtB,MAAM,EAAE,GAAG,CAAC,GAAG;QACf,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;KACjE,CACF,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/src/domain/oauthapp/refresolution/refresolution.ts

@@ -1,94 +0,0 @@
-/**
- * OAuthApp ref resolution — ports pkg/domain/oauthapp/refresolution: the
- * ONE answer to "which OAuthApp does this `oauth_app_ref` mean?" (the
- * defaultinstance pattern — one small module holds a cross-domain semantic
- * so its consumers cannot drift apart, stigmer/stigmer#584).
- *
- * Consumers: the OAuthApp delete guard (this domain, #13); the OAuth
- * initiate path, the read-path oauth_status enricher, and the token-refresh
- * path arrive with the mcpserver connect/OAuth sub-project (#19) and MUST
- * route through this function — three hand-rolled divergent answers are
- * exactly what #584 removed.
- *
- * Resolution semantics (OSS has a flat OAuthApp store — no org-override
- * chain like the cloud's OAuthAppResolutionService, so the ref is the whole
- * resolution): matching is by slug, with the ref's org as a preference
- * rather than a gate:
- *
- *  1. An exact (org, slug) match wins — unique by the create pipeline's
- *     duplicate check.
- *  2. Otherwise a slug-only match is honored when it is UNIQUE. This lets
- *     a deployment satisfy a public server's ref pinned to
- *     `org: stigmer` with an OAuthApp applied in the user's own org (#584).
- *  3. Two or more slug matches with no exact hit resolve to nothing, with
- *     a WARN naming the candidate orgs: ambiguity is never silently
- *     collapsed into a credential pick.
- *
- * Returns undefined when nothing resolves; callers own the severity of that
- * outcome (the delete guard treats it as unreferenced; initiate will refuse
- * NOT_FOUND, refresh will error — #19).
- */
-import { fromBinary } from "@bufbuild/protobuf";
-
-import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-import type { OAuthApp } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-
-import type { Logger } from "../../../boot/logger.js";
-import type { Store } from "../../../store/interface.js";
-
-/**
- * Resolves the OAuthApp the ref means (Go refresolution.Resolve). A ref
- * without a slug resolves to nothing — an McpServerAuth with no (or an
- * empty) oauth_app_ref is the DCR/manual-token arm, not a lookup. Store
- * errors propagate to the caller (Go returns them).
- */
-export async function resolveOAuthAppRef(
-  store: Store,
-  ref: ApiResourceReference,
-  logger: Logger,
-): Promise<OAuthApp | undefined> {
-  if (ref.slug === "") {
-    return undefined;
-  }
-
-  const rows = await store.listResources(ApiResourceKind.oauth_app);
-
-  // Collect-then-decide: a single pass gathers every slug match so the
-  // outcome depends only on the store's contents, never on its iteration
-  // order (Go's earlier first-match-wins scan was nondeterministic when a
-  // slug existed in several orgs).
-  const slugMatches: OAuthApp[] = [];
-  for (const data of rows) {
-    let app: OAuthApp;
-    try {
-      app = fromBinary(OAuthAppSchema, data);
-    } catch {
-      continue; // skip malformed rows, as Go does
-    }
-    if ((app.metadata?.slug ?? "") !== ref.slug) {
-      continue;
-    }
-    if (ref.org !== "" && app.metadata?.org === ref.org) {
-      return app; // exact match: unique by the create duplicate check
-    }
-    slugMatches.push(app);
-  }
-
-  if (slugMatches.length === 0) {
-    return undefined;
-  }
-  if (slugMatches.length === 1) {
-    return slugMatches[0];
-  }
-  logger.warn(
-    "oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick — pin the ref's org to resolve",
-    {
-      oauthAppSlug: ref.slug,
-      refOrg: ref.org,
-      candidateOrgs: slugMatches.map((app) => app.metadata?.org ?? ""),
-    },
-  );
-  return undefined;
-}