@superblocksteam/shared 0.9569.3 → 0.9571.0

package/src/types/audit/ocsf.ts

@@ -0,0 +1,121 @@
+/**
+ * OCSF (Open Cybersecurity Schema Framework) v1.3 types for audit events.
+ * See https://schema.ocsf.io/ for the full spec.
+ *
+ * We implement a subset relevant to Superblocks audit logging:
+ * - Category 3: Identity & Access Management
+ * - Category 6: Application Activity
+ */
+
+export enum OCSFCategoryUid {
+  IAM = 3,
+  APPLICATION_ACTIVITY = 6
+}
+
+export enum OCSFClassUid {
+  ACCOUNT_CHANGE = 3001,
+  AUTHENTICATION = 3002,
+  ENTITY_MANAGEMENT = 3004,
+  USER_ACCESS_MANAGEMENT = 3005,
+  APPLICATION_LIFECYCLE = 6002,
+  API_ACTIVITY = 6003
+}
+
+export enum OCSFActivityId {
+  UNKNOWN = 0,
+  CREATE = 1,
+  READ = 2,
+  UPDATE = 3,
+  DELETE = 4,
+  EXECUTE = 5,
+  LOGIN = 6,
+  LOGOUT = 7,
+  DEPLOY = 8,
+  GRANT = 9,
+  REVOKE = 10,
+  OTHER = 99
+}
+
+export enum OCSFStatusId {
+  UNKNOWN = 0,
+  SUCCESS = 1,
+  FAILURE = 2,
+  IN_PROGRESS = 99
+}
+
+export enum OCSFSeverityId {
+  UNKNOWN = 0,
+  INFORMATIONAL = 1,
+  LOW = 2,
+  MEDIUM = 3,
+  HIGH = 4,
+  CRITICAL = 5,
+  FATAL = 6
+}
+
+export interface OCSFActor {
+  user: {
+    uid: string;
+    name?: string;
+    email_addr?: string;
+    type?: string;
+  };
+  session?: {
+    uid: string;
+  };
+}
+
+export interface OCSFResource {
+  uid: string;
+  type: string;
+  name?: string;
+}
+
+export interface OCSFApi {
+  operation: string;
+  service: {
+    name: string;
+  };
+}
+
+export interface OCSFMetadata {
+  product: {
+    name: string;
+    vendor_name: string;
+  };
+  version: string;
+  log_name: string;
+}
+
+/**
+ * Core OCSF event shape stored in audit_event.data (jsonb).
+ * `type_uid` = class_uid * 100 + activity_id (OCSF convention).
+ */
+export interface OCSFAuditEvent {
+  category_uid: OCSFCategoryUid;
+  class_uid: OCSFClassUid;
+  activity_id: OCSFActivityId;
+  type_uid: number;
+  status_id: OCSFStatusId;
+  severity_id: OCSFSeverityId;
+  time: number;
+  duration?: number;
+  actor: OCSFActor;
+  resource: OCSFResource;
+  api?: OCSFApi;
+  metadata: OCSFMetadata;
+  unmapped?: Record<string, unknown>;
+}
+
+export function computeTypeUid(classUid: OCSFClassUid, activityId: OCSFActivityId): number {
+  return classUid * 100 + activityId;
+}
+
+const METADATA: Omit<OCSFMetadata, 'log_name'> = {
+  product: { name: 'Superblocks', vendor_name: 'Superblocks' },
+  version: '1.3.0'
+};
+
+export function buildOCSFMetadata(logName: string): OCSFMetadata {
+  return { ...METADATA, log_name: logName };
+}

package/src/types/billing/billing.ts

@@ -18,4 +18,7 @@ export type Billing = {
   daysLeft: number;
   billingInterval?: 'annual' | 'monthly' | null;
   interval?: 'annual' | 'monthly' | null;
+  cancelAt?: Date | null;
+  stripeSubStatus?: string | null;
+  showCcGateIfTrial?: boolean;
 };

package/src/types/common/file.test.ts

@@ -1,4 +1,5 @@
 import { describe, test, expect } from 'vitest';
+
 import { isReadableFileConstructor } from './file.js';
 
 describe('is readable file constructor', () => {

package/src/types/datasource/auth.test.ts

@@ -0,0 +1,64 @@
+import { describe, test, expect } from 'vitest';
+
+import { IntegrationAuthType, getDisplayName, extractPublic, getAuthId } from './auth.js';
+
+describe('getDisplayName', () => {
+  test('returns "IdP Token Passthrough" for OAUTH2_IDP_TOKEN_PASSTHROUGH', () => {
+    expect(getDisplayName(IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH)).toBe('IdP Token Passthrough');
+  });
+
+  test('returns "OAuth2 - On-Behalf-Of Token Exchange" for OAUTH2_TOKEN_EXCHANGE', () => {
+    expect(getDisplayName(IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE)).toBe('OAuth2 - On-Behalf-Of Token Exchange');
+  });
+
+  test('returns "None" for NONE', () => {
+    expect(getDisplayName(IntegrationAuthType.NONE)).toBe('None');
+  });
+});
+
+describe('extractPublic', () => {
+  test('returns empty object for OAUTH2_IDP_TOKEN_PASSTHROUGH (no secrets to expose)', () => {
+    const authConfig = { clientId: 'test' };
+    expect(extractPublic(IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH, authConfig)).toEqual({});
+  });
+
+  test('returns token exchange fields for OAUTH2_TOKEN_EXCHANGE', () => {
+    const authConfig = {
+      clientId: 'my-client',
+      clientSecret: 'my-secret',
+      tokenUrl: 'https://token.example.com',
+      audience: 'https://api.example.com',
+      scope: 'read write',
+      subjectTokenSource: 'SUBJECT_TOKEN_SOURCE_LOGIN_IDENTITY_PROVIDER',
+      subjectTokenSourceStaticToken: 'static'
+    };
+    const result = extractPublic(IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE, authConfig);
+    expect(result).toEqual({
+      clientId: 'my-client',
+      tokenUrl: 'https://token.example.com',
+      audience: 'https://api.example.com',
+      scope: 'read write',
+      subjectTokenSource: 'SUBJECT_TOKEN_SOURCE_LOGIN_IDENTITY_PROVIDER',
+      subjectTokenSourceStaticToken: 'static'
+    });
+    // clientSecret must not leak
+    expect(result).not.toHaveProperty('clientSecret');
+  });
+
+  test('throws for unknown auth type', () => {
+    expect(() => extractPublic('totally-unknown-type' as never, {})).toThrow('unknown auth type');
+  });
+});
+
+describe('getAuthId', () => {
+  test('uses unknown-client for OAUTH2_IDP_TOKEN_PASSTHROUGH (no client identity)', () => {
+    const authId = getAuthId(IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH, {}, 'int-1', 'cfg-1');
+    expect(authId).toBe('oauth-idp-token-passthrough.unknown-client');
+  });
+
+  test('uses clientId for OAUTH2_TOKEN_EXCHANGE', () => {
+    const authId = getAuthId(IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE, { clientId: 'my-client' }, 'int-1', 'cfg-1');
+    // Token exchange builds: `clientId-hashedFields` — clientId prefix present
+    expect(authId).toMatch(/^oauth-token-exchange\.my-client/);
+  });
+});

package/src/types/datasource/auth.ts

@@ -1,5 +1,6 @@
 import JSON5 from 'json5';
 import { isEmpty } from 'lodash';
+
 import { ClientAuthMethod } from '../../plugins/index.js';
 import { OAuthErrorResponse, OAuthTokenResponse } from '../auth/index.js';
 import { Property } from '../common/property.js';
@@ -102,6 +103,8 @@ export enum IntegrationAuthType {
   OAUTH2_TOKEN_EXCHANGE = 'oauth-token-exchange',
   // since proto does not support hyphens
   OAUTH2_TOKEN_EXCHANGE_PROTO = 'oauthTokenExchange',
+  /** Passes the user's SSO IdP access token through as {{ oauth.token }} — no OAuth client config needed. */
+  OAUTH2_IDP_TOKEN_PASSTHROUGH = 'oauth-idp-token-passthrough',
   FIREBASE = 'Firebase',
   BEARER = 'bearer',
   API_KEY = 'api-key',
@@ -199,6 +202,8 @@ export function getDisplayName(authType: AuthType): string {
       return 'OAuth2 - Authorization Code';
     case IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE:
       return 'OAuth2 - On-Behalf-Of Token Exchange';
+    case IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH:
+      return 'IdP Token Passthrough';
     case IntegrationAuthType.BEARER:
       return 'Bearer Token';
     case IntegrationAuthType.TOKEN_PREFIXED:
@@ -425,6 +430,7 @@ export const extractPublic = (authType: AuthType | undefined, authConfig: AuthCo
     case IntegrationAuthType.TOKEN_PREFIXED:
     case IntegrationAuthType.API_KEY:
     case IntegrationAuthType.API_KEY_FORM:
+    case IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH:
     case DatabaseAuthType.FIELDS:
     case DatabaseAuthType.OKTA:
     case DatabaseAuthType.KEY_PAIR:

package/src/types/datasource/index.test.ts

@@ -1,4 +1,5 @@
 import { describe, test, expect } from 'vitest';
+
 import { IntegrationAuthType } from './auth.js';
 import {
   DatasourceConfiguration,

package/src/types/datasource/index.ts

@@ -13,6 +13,7 @@ import {
   SmtpPluginV1 as SmtpPlugin
 } from '@superblocksteam/types';
 import { SecretsV1 as Secrets } from '@superblocksteam/types';
+
 import { Property } from '../common/property.js';
 import { Plugin, PluginMetadata } from '../plugin/index.js';
 import { CreatorDto } from '../rbac/index.js';

package/src/types/datasource/metadata/index.ts

@@ -7,6 +7,7 @@ import {
   KafkaV1,
   SalesforcePluginV1
 } from '@superblocksteam/types';
+
 import { ConnectedUserTokenDto } from '../../userToken/index.js';
 import { BucketMetadata } from './bucket.js';
 import { DatabaseSchemaMetadata } from './database.js';

package/src/types/datasource/test.ts

@@ -1,5 +1,5 @@
-import { Plugin } from '../plugin/index.js';
 import { DatasourceConfiguration } from '.';
+import { Plugin } from '../plugin/index.js';
 
 export type DatasourceTestRequest = {
   datasourceConfig: DatasourceConfiguration;

package/src/types/deployment/index.ts

@@ -1,5 +1,5 @@
 export interface DeploymentDto {
-  commitId: string;
+  commitId: string | null;
   previousCommitId?: string | null;
   entityId: string;
   deployer: {

package/src/types/event/index.ts

@@ -60,6 +60,7 @@ export enum EventAction {
   SHARED = 'shared',
   PERMISSION_REMOVED = 'permission_removed',
   DEPLOYED = 'deployed',
+  UNDEPLOYED = 'undeployed',
   IMPORTED = 'imported',
   EXECUTED = 'executed',
   EXPORTED = 'exported',

package/src/types/metadata/index.ts

@@ -1,4 +1,5 @@
 import { Timestamp } from '@bufbuild/protobuf';
+
 import { Metadata } from '@superblocksteam/types';
 
 export type ResourceMetadata = object;

package/src/types/organization/agent.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect } from 'vitest';
+
 import { compareSemVer } from './agent.js';
 
 describe('compareSemver', () => {

package/src/types/organization/agent.ts

@@ -1,4 +1,5 @@
 import * as semver from 'semver';
+
 import { SemVer } from '../plugin/index.js';
 
 export enum AgentType {

package/src/types/page/Dimension.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect } from 'vitest';
+
 import { Dimension } from './Dimension.js';
 
 describe('Dimension math functions', () => {

package/src/types/page/event.ts

@@ -1,4 +1,5 @@
 import { isArray, isPlainObject } from 'lodash';
+
 import { ApplicationScope } from '../../types/application/index.js';
 import { NotificationPosition } from './notification.js';
 import { WidgetTypes } from './widget.js';

package/src/types/page/layout.ts

@@ -1,7 +1,7 @@
 import { Dimension } from './Dimension.js';
+import { EventDefinitionLoose } from './event.js';
 import { Margin } from './Margin.js';
 import { Padding } from './Padding.js';
-import { EventDefinitionLoose } from './event.js';
 import { DynamicPath6, EntityWithBindings6 } from './shared.js';
 
 export interface WidgetProps4and5 {

package/src/types/plugin/evaluation.ts

@@ -1,8 +1,8 @@
-import { get, isFunction, isPlainObject } from 'lodash';
 import type { TreeCursor } from '@lezer/common';
 import type { LRParser } from '@lezer/lr';
 import type { Token, TokenizeOptions } from 'esprima';
 import type { SourceLocation } from 'estree';
+import { get, isFunction, isPlainObject } from 'lodash';
 
 export type EvaluationPair = {
   binding: string;

package/src/types/response/GetAuditLogsEntitiesResponseBody.ts

@@ -1,3 +1,4 @@
 import { AuditLogEntity } from '../audit/index.js';
 
+/** @deprecated Use GET /api/v2/audit/events which returns OCSFAuditEvent[]. */
 export type GetAuditLogsEntitiesResponseBody = AuditLogEntity[];

package/src/types/response/GetAuditLogsResponseBody.ts

@@ -1,3 +1,4 @@
 import { AuditLogDto } from '../audit/index.js';
 
+/** @deprecated Use GET /api/v2/audit/events which returns OCSFAuditEvent[]. */
 export type GetAuditLogsResponseBody = AuditLogDto[];

package/src/utils/apiv2.test.ts

@@ -1,7 +1,9 @@
 import { JsonValue } from '@bufbuild/protobuf';
-import { Api } from '@superblocksteam/types';
 import { cloneDeep } from 'lodash';
 import { describe, it, expect } from 'vitest';
+
+import { Api } from '@superblocksteam/types';
+
 import { sanitizeV2RequestBody } from './apiv2.js';
 
 describe('sanitizeV2RequestBody', () => {

package/src/utils/apiv2.ts

@@ -1,4 +1,5 @@
 import { Value as ValuePb } from '@bufbuild/protobuf';
+
 import { GraphQLIntegrationPlugin } from '../plugins/templates/graphqlintegration.js';
 import { GOOGLE_SHEETS_PLUGIN_ID } from '../plugins/templates/gsheets.js';
 import { MariaDBPlugin } from '../plugins/templates/mariadb.js';

package/src/utils/attachment-upload.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from 'vitest';
+
 import {
   buildAttachmentUploadMetadata,
   buildAttachmentUploadFormData,

package/src/utils/configuration.test.ts

@@ -1,5 +1,6 @@
 import { cloneDeep } from 'lodash';
 import { describe, test, expect } from 'vitest';
+
 import { PostgresPlugin, RestApiIntegrationPlugin } from '../plugins/index.js';
 import { PostgresDatasourceConfiguration, Property, RestApiDatasourceConfiguration } from '../types/index.js';
 import { MASKED_SECRET, maskSecrets, unmaskSecrets } from './configuration.js';

package/src/utils/configuration.ts

@@ -1,4 +1,5 @@
 import _ from 'lodash';
+
 import {
   FieldListFormItem,
   FormComponentType,
@@ -8,7 +9,6 @@ import {
   Property,
   getRowItemsFromSectionItem
 } from '../types/index.js';
-
 import { DatasourceConfiguration, InputDataType } from '../types/index.js';
 
 export const MASKED_SECRET = '<redacted>';

package/src/utils/env.test.ts

@@ -1,4 +1,5 @@
 import { describe, test, expect } from 'vitest';
+
 import { InvalidConfigurationError } from '../errors/index.js';
 import { EnvStore } from './env.js';
 

package/src/utils/environment.test.ts

@@ -1,4 +1,5 @@
 import { describe, test, expect } from 'vitest';
+
 import { BadRequestError } from '../errors/index.js';
 import { DatasourceEnvironments, ENVIRONMENT_ALL, ENVIRONMENT_PRODUCTION, ENVIRONMENT_STAGING } from '../types/index.js';
 import { checkEnvironment, getDefaultDatasourceEnvironment, getDefaultEnvironment } from './environment.js';

package/src/utils/git-url.test.ts

@@ -0,0 +1,102 @@
+import { describe, expect, it } from 'vitest';
+
+import { GITHUB_PAT_SETTINGS_URL, getGitHubCompareUrl, gitRemoteUrlToWeb, isGitHubUrl, isValidGitUrl } from './git-url.js';
+
+describe('isValidGitUrl', () => {
+  it.each([
+    'https://github.com/org/repo.git',
+    'https://github.com/org/repo',
+    'http://gitlab.com/org/repo.git',
+    'git@github.com:org/repo.git',
+    'git@gitlab.com:org/repo'
+  ])('returns true for %s', (url) => {
+    expect(isValidGitUrl(url)).toBe(true);
+  });
+
+  it.each(['', 'not-a-url', 'ftp://github.com/org/repo', 'https://'])('returns false for %j', (url) => {
+    expect(isValidGitUrl(url)).toBe(false);
+  });
+
+  it('trims whitespace', () => {
+    expect(isValidGitUrl('  https://github.com/org/repo  ')).toBe(true);
+  });
+});
+
+describe('isGitHubUrl', () => {
+  it.each(['https://github.com/org/repo.git', 'https://github.com/org/repo', 'git@github.com:org/repo.git'])(
+    'returns true for %s',
+    (url) => {
+      expect(isGitHubUrl(url)).toBe(true);
+    }
+  );
+
+  it.each(['https://gitlab.com/org/repo', 'git@bitbucket.org:org/repo.git', 'https://example.com/org/repo', 'not-a-url'])(
+    'returns false for %s',
+    (url) => {
+      expect(isGitHubUrl(url)).toBe(false);
+    }
+  );
+
+  it('is case-insensitive on the host', () => {
+    expect(isGitHubUrl('https://GitHub.COM/org/repo')).toBe(true);
+  });
+});
+
+describe('gitRemoteUrlToWeb', () => {
+  it.each<[string, string]>([
+    ['https://github.com/org/repo.git', 'https://github.com/org/repo'],
+    ['https://github.com/org/repo', 'https://github.com/org/repo'],
+    ['http://gitlab.com/org/repo.git', 'http://gitlab.com/org/repo'],
+    ['git@github.com:org/repo.git', 'https://github.com/org/repo'],
+    ['git@gitlab.com:group/sub/repo.git', 'https://gitlab.com/group/sub/repo']
+  ])('converts %s → %s', (input, expected) => {
+    expect(gitRemoteUrlToWeb(input)).toBe(expected);
+  });
+
+  it('returns null for unconvertible URLs', () => {
+    expect(gitRemoteUrlToWeb('not-a-url')).toBeNull();
+  });
+});
+
+describe('getGitHubCompareUrl', () => {
+  const base = { fromBranch: 'feature/cool', toBranch: 'main' };
+
+  it('builds a GitHub compare URL', () => {
+    expect(
+      getGitHubCompareUrl({
+        gitRemoteUrl: 'https://github.com/org/repo.git',
+        ...base
+      })
+    ).toBe('https://github.com/org/repo/compare/main...feature%2Fcool');
+  });
+
+  it('appends title and body', () => {
+    expect(
+      getGitHubCompareUrl({
+        gitRemoteUrl: 'https://github.com/org/repo.git',
+        ...base,
+        title: 'My PR',
+        body: '## Summary'
+      })
+    ).toBe('https://github.com/org/repo/compare/main...feature%2Fcool?expand=1&title=My+PR&body=%23%23+Summary');
+  });
+
+  it('returns null for non-GitHub URLs', () => {
+    expect(
+      getGitHubCompareUrl({
+        gitRemoteUrl: 'https://gitlab.com/org/repo',
+        ...base
+      })
+    ).toBeNull();
+  });
+
+  it('returns null for unconvertible URLs', () => {
+    expect(getGitHubCompareUrl({ gitRemoteUrl: 'not-a-url', ...base })).toBeNull();
+  });
+});
+
+describe('GITHUB_PAT_SETTINGS_URL', () => {
+  it('is a valid URL', () => {
+    expect(GITHUB_PAT_SETTINGS_URL).toBe('https://github.com/settings/tokens');
+  });
+});