@undefineds.co/xpod 0.3.71-rc.8 → 0.3.71

package/dist/api/ai-gateway/connect/index.d.ts

@@ -125,6 +125,7 @@ type ConnectedCredentialDb = {
         };
     };
     findById<TRow>(resource: typeof credentialResource, id: string): Promise<TRow | null>;
+    deleteById(resource: typeof credentialResource, id: string): Promise<boolean>;
     updateById<TRow>(resource: typeof credentialResource, id: string, patch: unknown): Promise<TRow | null>;
     update(resource: typeof credentialResource): {
         set(patch: unknown): {
@@ -141,6 +142,7 @@ export interface PodConnectedCredentialRepositoryOptions {
     providerIds?: string[];
     dbFactory?: (input: {
         owner: string;
+        podUrl: string;
         auth?: AuthContext;
         fetch: typeof fetch;
         credential?: typeof credentialResource;

package/dist/api/ai-gateway/connect/index.js

@@ -43,7 +43,17 @@ class PodConnectedCredentialRepository {
             }
         }))).filter((row) => row !== null);
         return rows
-            .map((row) => recordFromCredentialRow(row, input.webId))
+            .flatMap((row) => {
+            try {
+                return [recordFromCredentialRow(row, input.webId)];
+            }
+            catch (error) {
+                if (error instanceof PlaintextCredentialPayload_1.UnsupportedCredentialStorageModeError) {
+                    return [];
+                }
+                throw error;
+            }
+        })
             .filter((record) => record.webId === input.webId)
             .filter((record) => record.deployment === input.deployment)
             .filter((record) => record.status === 'active')
@@ -69,7 +79,11 @@ class PodConnectedCredentialRepository {
         const { db, credential } = await this.dbForOwner(record.webId, context?.auth);
         const existing = await db.findById(credential, record.id);
         const existingVersion = existing ? versionFromRow(existing) : 0;
-        if (record.expectedVersion !== undefined && record.expectedVersion !== existingVersion) {
+        const replacesUnsupportedRecord = Boolean(existing)
+            && stringFrom(existing?.storageMode) !== PlaintextCredentialPayload_1.PLAINTEXT_CREDENTIAL_STORAGE_MODE;
+        if (!replacesUnsupportedRecord
+            && record.expectedVersion !== undefined
+            && record.expectedVersion !== existingVersion) {
             throw new Error('credential_version_conflict');
         }
         const nextVersion = existingVersion + 1;
@@ -78,10 +92,35 @@ class PodConnectedCredentialRepository {
             version: nextVersion,
         });
         if (existing) {
-            const updated = await db.updateById(credential, record.id, row);
-            return recordFromCredentialRow(updated ?? row, record.webId);
+            try {
+                const deleted = await db.deleteById(credential, record.id);
+                if (!deleted) {
+                    throw new Error('exact credential resource was not deleted');
+                }
+            }
+            catch (error) {
+                throw credentialPersistenceError('replace-delete', error);
+            }
+            try {
+                await db.insert(credential).values(row).execute();
+            }
+            catch (error) {
+                try {
+                    await db.insert(credential).values(existing).execute();
+                }
+                catch (rollbackError) {
+                    throw credentialPersistenceError('replace-insert-rollback', rollbackError);
+                }
+                throw credentialPersistenceError('replace-insert', error);
+            }
+            return recordFromCredentialRow(row, record.webId);
+        }
+        try {
+            await db.insert(credential).values(row).execute();
+        }
+        catch (error) {
+            throw credentialPersistenceError('insert', error);
         }
-        await db.insert(credential).values(row).execute();
         return recordFromCredentialRow(row, record.webId);
     }
     async markReauthRequired(input) {
@@ -119,7 +158,8 @@ class PodConnectedCredentialRepository {
         const trustedFetch = await this.resolveTrustedFetch(owner, auth);
         const credential = (0, drizzle_solid_1.alias)(this.credentialTemplate, 'credential');
         const aiProvider = (0, drizzle_solid_1.alias)(this.aiProviderTemplate, 'aiProvider');
-        const db = await this.dbFactory({ owner, auth, fetch: trustedFetch, credential, aiProvider });
+        const podUrl = podUrlFromHostedWebId(owner);
+        const db = await this.dbFactory({ owner, podUrl, auth, fetch: trustedFetch, credential, aiProvider });
         await db.init?.(credential, aiProvider);
         return { db, credential };
     }
@@ -643,17 +683,25 @@ class ProviderConnectService {
     }
     async listProviders(input) {
         return Promise.all(this.registry.listProviders().map(async (descriptor) => {
-            const credential = this.credentialRepository?.getCredential
-                ? await this.credentialRepository.getCredential({
-                    ...input,
-                    provider: descriptor.id,
-                })
-                : await this.credentialRepository?.getActiveCredential({
-                    ...input,
-                    provider: descriptor.id,
-                });
-            const active = credential?.status === 'active';
-            const reauthRequired = active && credential.reauthRequired === true;
+            let credential;
+            try {
+                credential = this.credentialRepository?.getCredential
+                    ? await this.credentialRepository.getCredential({
+                        ...input,
+                        provider: descriptor.id,
+                    })
+                    : await this.credentialRepository?.getActiveCredential({
+                        ...input,
+                        provider: descriptor.id,
+                    });
+            }
+            catch (error) {
+                if (!(error instanceof PlaintextCredentialPayload_1.UnsupportedCredentialStorageModeError)) {
+                    throw error;
+                }
+            }
+            const activeCredential = credential?.status === 'active' ? credential : undefined;
+            const reauthRequired = activeCredential?.reauthRequired === true;
             const modes = Array.from(new Set([
                 ...descriptor.authModes.filter((mode) => mode !== 'connectUnsupported'),
                 ...(descriptor.connect?.apiKeyManagementSupported ? ['apiKey'] : []),
@@ -662,15 +710,15 @@ class ProviderConnectService {
                 provider: descriptor.id,
                 status: reauthRequired
                     ? 'reauthRequired'
-                    : active
+                    : activeCredential
                         ? 'connected'
                         : 'disconnected',
-                authMode: active ? credential.authMode : undefined,
-                accountLabel: active ? credential.accountLabel : undefined,
-                expiresAt: active ? credential.expiresAt?.toISOString() : undefined,
+                authMode: activeCredential?.authMode,
+                accountLabel: activeCredential?.accountLabel,
+                expiresAt: activeCredential?.expiresAt?.toISOString(),
                 reauthRequired: reauthRequired || undefined,
-                credentialIri: active ? credential.credentialIri : undefined,
-                version: active ? credential.version : undefined,
+                credentialIri: activeCredential?.credentialIri,
+                version: activeCredential?.version,
                 connect: {
                     modes,
                     configured: descriptor.connect?.configured !== false,
@@ -754,14 +802,26 @@ function createDefaultConnectedCredentialDb(input) {
     const aiProvider = input.aiProvider ?? models_1.aiProviderResource;
     return Promise.resolve((0, drizzle_solid_1.drizzle)({
         fetch: input.fetch,
-        info: { webId: input.owner, isLoggedIn: true },
+        info: { webId: input.owner, podUrl: input.podUrl, isLoggedIn: true },
     }, {
         schema: {
             credential,
             aiProvider,
         },
+        podUrl: input.podUrl,
     }));
 }
+function podUrlFromHostedWebId(webId) {
+    const ownerUrl = new URL(webId);
+    if (ownerUrl.hash !== '#me' || !ownerUrl.pathname.endsWith('/profile/card')) {
+        throw new Error('hosted_pod_owner_url_invalid');
+    }
+    const podPath = ownerUrl.pathname.slice(0, -'profile/card'.length);
+    if (!podPath || !podPath.endsWith('/')) {
+        throw new Error('hosted_pod_owner_url_invalid');
+    }
+    return new URL(podPath, ownerUrl.origin).href;
+}
 function credentialRowFromRecord(record) {
     return {
         id: record.id,
@@ -825,6 +885,9 @@ function providerFromRelation(value) {
     const provider = fileName.replace(/\.ttl$/u, '');
     return provider ? normalizeProvider(provider) : undefined;
 }
+function credentialPersistenceError(stage, cause) {
+    return new Error(`credential_persistence_failed:${stage}`, { cause });
+}
 function isPodResourceNotFound(error) {
     if (!(error instanceof Error)) {
         return false;