@superblocksteam/shared 0.9608.3 → 0.9609.0

package/dist-esm/utils/launchDarkly.js

@@ -0,0 +1,18 @@
+/**
+ * Analytics events drive LaunchDarkly's per-context billing: monthly active users are
+ * counted from the unique context keys LaunchDarkly receives events for. Throwaway
+ * contexts, such as the per-run organizations created by end-to-end tests, each bill as
+ * an additional monthly active user, so events should be off outside real deployments.
+ *
+ * Events are on by default and only an explicit 'false' turns them off, matching
+ * SUPERBLOCKS_SERVER_LAUNCH_DARKLY_SEND_EVENTS_ENABLED on the server-side SDK. Any
+ * unrecognized value keeps events on so a malformed setting cannot silently disable
+ * reporting for a real deployment.
+ */
+export function shouldSendLaunchDarklyEvents(value) {
+    if (typeof value === 'boolean') {
+        return value;
+    }
+    return value?.trim().toLowerCase() !== 'false';
+}
+//# sourceMappingURL=launchDarkly.js.map

package/dist-esm/utils/launchDarkly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchDarkly.js","sourceRoot":"","sources":["../../src/utils/launchDarkly.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAoC;IAC/E,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;AACjD,CAAC"}

package/dist-esm/utils/launchDarkly.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=launchDarkly.test.d.ts.map

package/dist-esm/utils/launchDarkly.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchDarkly.test.d.ts","sourceRoot":"","sources":["../../src/utils/launchDarkly.test.ts"],"names":[],"mappings":""}

package/dist-esm/utils/launchDarkly.test.js

@@ -0,0 +1,22 @@
+import { describe, test, expect } from 'vitest';
+import { shouldSendLaunchDarklyEvents } from './launchDarkly.js';
+describe('shouldSendLaunchDarklyEvents', () => {
+    test('sends events by default when unset', () => {
+        expect(shouldSendLaunchDarklyEvents(undefined)).toBe(true);
+        expect(shouldSendLaunchDarklyEvents(null)).toBe(true);
+        expect(shouldSendLaunchDarklyEvents('')).toBe(true);
+    });
+    test('only an explicit false disables events', () => {
+        expect(shouldSendLaunchDarklyEvents('false')).toBe(false);
+        expect(shouldSendLaunchDarklyEvents('FALSE')).toBe(false);
+        expect(shouldSendLaunchDarklyEvents('  false  ')).toBe(false);
+        expect(shouldSendLaunchDarklyEvents(false)).toBe(false);
+    });
+    test('sends events for truthy and unrecognized values', () => {
+        expect(shouldSendLaunchDarklyEvents('true')).toBe(true);
+        expect(shouldSendLaunchDarklyEvents(true)).toBe(true);
+        expect(shouldSendLaunchDarklyEvents('0')).toBe(true);
+        expect(shouldSendLaunchDarklyEvents('no')).toBe(true);
+    });
+});
+//# sourceMappingURL=launchDarkly.test.js.map

package/dist-esm/utils/launchDarkly.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launchDarkly.test.js","sourceRoot":"","sources":["../../src/utils/launchDarkly.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEjE,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,IAAI,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superblocksteam/shared",
-  "version": "0.9608.3",
+  "version": "0.9609.0",
   "description": "Superblocks Shared Resources",
   "license": "Superblocks Community Software License",
   "repository": "https://github.com/superblocksteam/shared.git",

package/src/types/application/index.ts

@@ -472,6 +472,17 @@ export interface IApplicationV2Dto {
   removedProfiles?: Record<string, Array<{ id: string; key: string; displayName: string }>>;
 }
 
+export type DatabaseDisposition = 'delete' | 'retain';
+
+export type DatabaseRetirementEnqueueFailure = {
+  applicationId: string;
+  bindingKey: string;
+};
+
+export type DatabaseRetirementEnqueueResult = {
+  databaseRetirementEnqueueFailures: DatabaseRetirementEnqueueFailure[];
+};
+
 export interface IHomepageApplicationV2Dto extends IResourceMetadata {
   deployedAt?: Date | null;
   creator?: {

package/src/types/audit/ocsf.ts

@@ -289,7 +289,9 @@ export const AUDIT_EVENT_TYPE_CATALOG: AuditEventTypeEntry[] = [
       'reviewpolicy.allowlist.applications.added',
       'reviewpolicy.allowlist.applications.removed',
       'reviewpolicy.create',
-      'reviewpolicy.delete'
+      'reviewpolicy.delete',
+      'reviewpolicy.disable',
+      'reviewpolicy.enable'
     ]
   },
   {

package/src/types/datasource/auth.test.ts

@@ -5,6 +5,7 @@ import {
   TokenScope,
   extractPublic,
   getAuthId,
+  getAuthIdCandidates,
   getDisplayName,
   getOAuthCodeVerifierStorageKey,
   isPkceEnabled
@@ -229,6 +230,85 @@ describe('getAuthId normalizes boolean tokenScope in getClientId', () => {
   });
 });
 
+describe('getAuthIdCandidates', () => {
+  test('user-scoped config also probes the org-unique configId keying (recognizes a datasource->user flip)', () => {
+    const authConfig = { clientId: 'my-client', tokenScope: TokenScope.USER, scope: 'read' };
+    const candidates = getAuthIdCandidates(IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'cfg-1');
+    // The config's own current keying (user -> client id) PLUS the widened datasource keying (config id).
+    expect(candidates).toContain(getAuthId(IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'cfg-1'));
+    expect(candidates).toContain(
+      getAuthId(
+        IntegrationAuthType.OAUTH2_CODE,
+        { clientId: 'my-client', tokenScope: TokenScope.DATASOURCE, scope: 'read' },
+        'int-1',
+        'cfg-1'
+      )
+    );
+    expect(candidates).toHaveLength(2);
+    expect(candidates.some((c) => c.startsWith('oauth-code.cfg-1'))).toBe(true); // org-unique config id
+    expect(candidates.some((c) => c.startsWith('oauth-code.my-client'))).toBe(true); // its own current client-id key
+  });
+
+  test('datasource-scoped config widens ONLY to the configId keying, never synthesizes the client-id keying (SEC-73)', () => {
+    // The client-id keying is shared across tenants (many orgs can share a clientId + scope); synthesizing
+    // it for a datasource-scoped config would let one org witness ownership of another org's client-id-keyed
+    // shared token. It must never appear as a candidate for a datasource-scoped config.
+    const authConfig = { clientId: 'shared-client', tokenScope: TokenScope.DATASOURCE, scope: 'read' };
+    const candidates = getAuthIdCandidates(IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'cfg-1');
+    expect(candidates).toEqual([getAuthId(IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'cfg-1')]);
+    expect(candidates).toHaveLength(1);
+    expect(candidates[0]).toMatch(/^oauth-code\.cfg-1/); // org-unique config id
+    expect(candidates.some((c) => c.startsWith('oauth-code.shared-client'))).toBe(false); // no cross-tenant client-id key
+  });
+
+  test('collapses to one candidate when config id equals client id', () => {
+    const authConfig = { clientId: 'same', tokenScope: TokenScope.USER, scope: 'read' };
+    const candidates = getAuthIdCandidates(IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'same');
+    expect(candidates).toHaveLength(1);
+  });
+
+  test.each([IntegrationAuthType.OAUTH2_CLIENT_CREDS, IntegrationAuthType.OAUTH2_IMPLICIT])(
+    'OAuth-split type %s (user-scoped) also probes the configId keying',
+    (authType) => {
+      const authConfig = { clientId: 'my-client', tokenScope: TokenScope.USER, scope: 'read' };
+      const candidates = getAuthIdCandidates(authType, authConfig, 'int-1', 'cfg-1');
+      expect(candidates).toHaveLength(2);
+      expect(candidates).toContain(
+        getAuthId(authType, { clientId: 'my-client', tokenScope: TokenScope.DATASOURCE, scope: 'read' }, 'int-1', 'cfg-1')
+      );
+    }
+  );
+
+  test.each([IntegrationAuthType.BASIC, IntegrationAuthType.FIREBASE, IntegrationAuthType.OAUTH2_PASSWORD])(
+    'scope-invariant type %s returns a single candidate (tokenScope does not affect keying)',
+    (authType) => {
+      const authConfig = { clientId: 'my-client', apiKey: '{"projectId":"p"}', scope: 'read' };
+      const candidates = getAuthIdCandidates(authType, authConfig, 'int-1', 'cfg-1');
+      expect(candidates).toHaveLength(1);
+      expect(candidates[0]).toBe(getAuthId(authType, authConfig, 'int-1', 'cfg-1'));
+    }
+  );
+
+  test('scope-invariant auth type returns a single candidate (tokenScope does not affect keying)', () => {
+    const authConfig = {
+      subjectTokenSource: 'SUBJECT_TOKEN_SOURCE_STATIC_TOKEN',
+      subjectTokenSourceStaticToken: 't',
+      tokenUrl: 'https://idp.example.com/token',
+      scope: 'read',
+      audience: 'aud',
+      clientId: 'c'
+    };
+    const candidates = getAuthIdCandidates(IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE, authConfig, 'int-1', 'cfg-1');
+    expect(candidates).toHaveLength(1);
+    expect(candidates[0]).toBe(getAuthId(IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE, authConfig, 'int-1', 'cfg-1'));
+  });
+
+  test('undefined authConfig yields a single candidate', () => {
+    const candidates = getAuthIdCandidates(IntegrationAuthType.OAUTH2_CODE, undefined, 'int-1', 'cfg-1');
+    expect(candidates).toHaveLength(1);
+  });
+});
+
 describe('getAuthId', () => {
   test('uses unknown-client for OAUTH2_IDP_TOKEN_PASSTHROUGH (no client identity)', () => {
     const authId = getAuthId(IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH, {}, 'int-1', 'cfg-1');

package/src/types/datasource/auth.ts

@@ -60,6 +60,38 @@ export function getAuthId(
   return `${authType}.${getClientId(authType, authConfig, integrationId, integrationConfigurationId)}`;
 }
 
+// A token minted while a config's tokenScope was 'datasource' keys on the org-unique configuration id;
+// after the config is flipped to 'user' a fresh recompute keys on the client id instead and no longer
+// matches, false-denying the legitimate owner. getAuthIdCandidates returns the config's current-scope
+// authId PLUS the datasource (configuration-id) keying, so an ownership recompute recognizes a token
+// across a post-mint datasource->user flip.
+//
+// It widens ONLY toward the datasource keying, which is org-unique (the configuration id is a per-config
+// UUID). It deliberately does NOT synthesize the user (client-id) keying for a datasource-scoped config:
+// the client-id key is shared across tenants (multiple orgs can share a clientId + scope), so adding it
+// would let one org's config witness ownership of another org's client-id-keyed shared token. Recognizing
+// the reverse user->datasource flip would require matching that shared key, so it is intentionally not
+// done here; closing it safely needs org-scoped token storage, tracked separately. See SEC-73.
+export function getAuthIdCandidates(
+  authType: AuthType | undefined,
+  authConfig: AuthConfig | undefined,
+  integrationId?: string,
+  integrationConfigurationId?: string
+): AuthId[] {
+  const current = getAuthId(authType, authConfig, integrationId, integrationConfigurationId);
+  const asDatasource = getAuthId(authType, withTokenScope(authConfig, TokenScope.DATASOURCE), integrationId, integrationConfigurationId);
+  return current === asDatasource ? [current] : [current, asDatasource];
+}
+
+// Return a shallow copy of authConfig with tokenScope overridden, without mutating the caller's object.
+// undefined passes through so getAuthId falls back to its unknown-client key.
+function withTokenScope(authConfig: AuthConfig | undefined, tokenScope: TokenScope): AuthConfig | undefined {
+  if (!authConfig) {
+    return authConfig;
+  }
+  return { ...authConfig, tokenScope } as AuthConfig;
+}
+
 function getClientId(
   authType: AuthType | undefined,
   config: AuthConfig | undefined,

package/src/types/policyGate/index.ts

@@ -1,3 +1,5 @@
+import type { ReviewFindingCategory, ReviewFindingConfidence, ReviewFindingSeverity } from '../reviewPolicy/index.js';
+
 /**
  * @deprecated Use the `superblocks.policy-gates.security-scans.enabled` LaunchDarkly flag instead.
  * Kept as `false` to match the fail-closed LD default; create and enable the
@@ -141,3 +143,35 @@ export const POLICY_GATE_BLOCKED_ERROR = 'POLICY_GATE_BLOCKED';
  */
 export const POLICY_GATE_STALE_LIVE_EDIT_ERROR =
   'Policy gates can only run for the current app state. Deploy the current changes or restore to this commit and then deploy.';
+
+export type ScanScopeChangeType = 'added' | 'deleted' | 'modified';
+
+export type ScanScopeChangedFile = {
+  changeType: ScanScopeChangeType;
+  path: string;
+};
+
+export type ScanScopePriorFinding = {
+  blocking: boolean;
+  category: ReviewFindingCategory;
+  clarkRemediable?: boolean;
+  confidence?: ReviewFindingConfidence | null;
+  evidenceJson?: Record<string, unknown>;
+  fingerprint: string;
+  humanSummary?: string | null;
+  locations: unknown[];
+  remediationHintJson?: Record<string, unknown>;
+  severity: ReviewFindingSeverity;
+  technicalSummary?: string | null;
+  title: string;
+};
+
+export type ScanScopeJson = {
+  baseApplicationCommitId: string;
+  changedFiles: ScanScopeChangedFile[];
+  diffTruncated: boolean;
+  priorAiAgentRunId?: string;
+  priorFindings: ScanScopePriorFinding[];
+  priorReviewRunId?: string;
+  unifiedDiff: string;
+};

package/src/types/response/DeleteApplicationResponseBody.ts

@@ -1,3 +1,3 @@
-import { IApplicationV2Dto } from '../application/index.js';
+import type { DatabaseRetirementEnqueueResult, IApplicationV2Dto } from '../application/index.js';
 
-export type DeleteApplicationResponseBody = IApplicationV2Dto;
+export type DeleteApplicationResponseBody = IApplicationV2Dto & Partial<DatabaseRetirementEnqueueResult>;

package/src/utils/index.ts

@@ -6,6 +6,7 @@ export * from './configuration.js';
 export * from './env.js';
 export * from './environment.js';
 export * from './git-url.js';
+export * from './launchDarkly.js';
 export * from './maskCredential.js';
 export * from './normalize.js';
 export * from './normalizeRoleName.js';

package/src/utils/launchDarkly.test.ts

@@ -0,0 +1,25 @@
+import { describe, test, expect } from 'vitest';
+
+import { shouldSendLaunchDarklyEvents } from './launchDarkly.js';
+
+describe('shouldSendLaunchDarklyEvents', () => {
+  test('sends events by default when unset', () => {
+    expect(shouldSendLaunchDarklyEvents(undefined)).toBe(true);
+    expect(shouldSendLaunchDarklyEvents(null)).toBe(true);
+    expect(shouldSendLaunchDarklyEvents('')).toBe(true);
+  });
+
+  test('only an explicit false disables events', () => {
+    expect(shouldSendLaunchDarklyEvents('false')).toBe(false);
+    expect(shouldSendLaunchDarklyEvents('FALSE')).toBe(false);
+    expect(shouldSendLaunchDarklyEvents('  false  ')).toBe(false);
+    expect(shouldSendLaunchDarklyEvents(false)).toBe(false);
+  });
+
+  test('sends events for truthy and unrecognized values', () => {
+    expect(shouldSendLaunchDarklyEvents('true')).toBe(true);
+    expect(shouldSendLaunchDarklyEvents(true)).toBe(true);
+    expect(shouldSendLaunchDarklyEvents('0')).toBe(true);
+    expect(shouldSendLaunchDarklyEvents('no')).toBe(true);
+  });
+});

package/src/utils/launchDarkly.ts

@@ -0,0 +1,23 @@
+/**
+ * A LaunchDarkly send-events setting as it arrives from configuration: either an
+ * already-parsed boolean or the raw string form an env var carries.
+ */
+export type LaunchDarklySendEventsSetting = boolean | string | undefined | null;
+
+/**
+ * Analytics events drive LaunchDarkly's per-context billing: monthly active users are
+ * counted from the unique context keys LaunchDarkly receives events for. Throwaway
+ * contexts, such as the per-run organizations created by end-to-end tests, each bill as
+ * an additional monthly active user, so events should be off outside real deployments.
+ *
+ * Events are on by default and only an explicit 'false' turns them off, matching
+ * SUPERBLOCKS_SERVER_LAUNCH_DARKLY_SEND_EVENTS_ENABLED on the server-side SDK. Any
+ * unrecognized value keeps events on so a malformed setting cannot silently disable
+ * reporting for a real deployment.
+ */
+export function shouldSendLaunchDarklyEvents(value: LaunchDarklySendEventsSetting): boolean {
+  if (typeof value === 'boolean') {
+    return value;
+  }
+  return value?.trim().toLowerCase() !== 'false';
+}