@useatlas/create 0.0.6 → 0.0.7

package/templates/docker/src/lib/teams/store.ts

@@ -0,0 +1,216 @@
+/**
+ * Teams installation storage.
+ *
+ * Stores per-tenant authorization records in the internal database.
+ * In the platform OAuth flow, app credentials (TEAMS_APP_ID, TEAMS_APP_PASSWORD)
+ * come from env vars. In BYOT mode, the app password is stored per-tenant so
+ * workspace admins can connect without platform-level env vars.
+ */
+
+import { hasInternalDB, internalQuery } from "@atlas/api/lib/db/internal";
+import { createLogger } from "@atlas/api/lib/logger";
+import type { TeamsInstallation, TeamsInstallationWithSecret } from "@atlas/api/lib/integrations/types";
+
+export type { TeamsInstallation, TeamsInstallationWithSecret } from "@atlas/api/lib/integrations/types";
+
+const log = createLogger("teams-store");
+
+// ---------------------------------------------------------------------------
+// Shared row parser
+// ---------------------------------------------------------------------------
+
+/**
+ * Parse a DB row into a TeamsInstallationWithSecret, validating required fields.
+ * Returns null and logs a warning if the row is malformed.
+ */
+function parseInstallationRow(
+  row: Record<string, unknown>,
+  context: Record<string, unknown>,
+): TeamsInstallationWithSecret | null {
+  const tenantIdVal = row.tenant_id;
+  if (typeof tenantIdVal !== "string") {
+    log.warn(context, "Invalid Teams installation record in database");
+    return null;
+  }
+  return {
+    tenant_id: tenantIdVal,
+    org_id: typeof row.org_id === "string" ? row.org_id : null,
+    tenant_name: typeof row.tenant_name === "string" ? row.tenant_name : null,
+    app_password: typeof row.app_password === "string" ? row.app_password : null,
+    installed_at: typeof row.installed_at === "string" ? row.installed_at : new Date().toISOString(),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Read operations
+// ---------------------------------------------------------------------------
+
+/**
+ * Get the Teams installation for a tenant. Checks internal DB first, then
+ * falls back to env-based detection (TEAMS_APP_ID set = single-tenant mode).
+ */
+export async function getTeamsInstallation(
+  tenantId: string,
+): Promise<TeamsInstallationWithSecret | null> {
+  if (hasInternalDB()) {
+    try {
+      const rows = await internalQuery<Record<string, unknown>>(
+        "SELECT tenant_id, org_id, tenant_name, app_password, installed_at::text FROM teams_installations WHERE tenant_id = $1",
+        [tenantId],
+      );
+      if (rows.length > 0) {
+        return parseInstallationRow(rows[0], { tenantId });
+      }
+      return null;
+    } catch (err) {
+      log.error(
+        { err: err instanceof Error ? err.message : String(err), tenantId },
+        "Failed to query teams_installations",
+      );
+      throw err;
+    }
+  }
+
+  // Single-tenant mode: no internal DB configured, use env var presence
+  const envAppId = process.env.TEAMS_APP_ID;
+  if (envAppId) {
+    return {
+      tenant_id: tenantId,
+      org_id: null,
+      tenant_name: null,
+      app_password: null,
+      installed_at: new Date().toISOString(),
+    };
+  }
+
+  return null;
+}
+
+/**
+ * Get the Teams installation for an org. Returns null if not found or
+ * if no internal database is configured (org-scoped lookups require a DB).
+ */
+export async function getTeamsInstallationByOrg(
+  orgId: string,
+): Promise<TeamsInstallation | null> {
+  if (!hasInternalDB()) {
+    // Org-scoped installations require an internal database.
+    return null;
+  }
+
+  try {
+    const rows = await internalQuery<Record<string, unknown>>(
+      "SELECT tenant_id, org_id, tenant_name, app_password, installed_at::text FROM teams_installations WHERE org_id = $1",
+      [orgId],
+    );
+    if (rows.length > 0) {
+      const full = parseInstallationRow(rows[0], { orgId });
+      if (!full) return null;
+      const { app_password: _, ...pub } = full;
+      return pub;
+    }
+    return null;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), orgId },
+      "Failed to query teams_installations by org",
+    );
+    throw err;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Write operations
+// ---------------------------------------------------------------------------
+
+/**
+ * Save or update a Teams installation (admin consent flow or BYOT credential submission).
+ * Throws if the database write fails.
+ */
+export async function saveTeamsInstallation(
+  tenantId: string,
+  opts?: { orgId?: string; tenantName?: string; appPassword?: string },
+): Promise<void> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot save Teams installation — no internal database configured");
+  }
+
+  const orgId = opts?.orgId ?? null;
+  const tenantName = opts?.tenantName ?? null;
+  const appPassword = opts?.appPassword ?? null;
+
+  try {
+    // Atomic upsert with hijack protection — the WHERE clause rejects rows
+    // bound to a different org in one statement (no TOCTOU race).
+    const rows = await internalQuery<{ tenant_id: string }>(
+      `INSERT INTO teams_installations (tenant_id, org_id, tenant_name, app_password)
+       VALUES ($1, $2, $3, $4)
+       ON CONFLICT (tenant_id) DO UPDATE SET
+         org_id = COALESCE($2, teams_installations.org_id),
+         tenant_name = COALESCE($3, teams_installations.tenant_name),
+         app_password = COALESCE($4, teams_installations.app_password),
+         installed_at = now()
+       WHERE teams_installations.org_id IS NULL OR teams_installations.org_id = $2
+       RETURNING tenant_id`,
+      [tenantId, orgId, tenantName, appPassword],
+    );
+
+    if (rows.length === 0) {
+      throw new Error(
+        `Tenant ${tenantId} is already bound to a different organization. ` +
+        `Disconnect the existing installation first.`,
+      );
+    }
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), tenantId },
+      "Failed to save teams_installations",
+    );
+    throw err;
+  }
+}
+
+/**
+ * Remove a Teams installation by tenant ID.
+ * Throws if no internal DB or if the query fails.
+ */
+export async function deleteTeamsInstallation(tenantId: string): Promise<void> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot delete Teams installation — no internal database configured");
+  }
+
+  try {
+    await internalQuery("DELETE FROM teams_installations WHERE tenant_id = $1", [tenantId]);
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), tenantId },
+      "Failed to delete teams_installations",
+    );
+    throw err;
+  }
+}
+
+/**
+ * Remove the Teams installation for an org.
+ * Returns true if a row was deleted, false if no matching row found.
+ * Throws if no internal DB or if the query fails.
+ */
+export async function deleteTeamsInstallationByOrg(orgId: string): Promise<boolean> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot delete Teams installation — no internal database configured");
+  }
+
+  try {
+    const rows = await internalQuery<{ tenant_id: string }>(
+      "DELETE FROM teams_installations WHERE org_id = $1 RETURNING tenant_id",
+      [orgId],
+    );
+    return rows.length > 0;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), orgId },
+      "Failed to delete teams_installations by org",
+    );
+    throw err;
+  }
+}

package/templates/docker/src/lib/telegram/store.ts

@@ -0,0 +1,202 @@
+/**
+ * Telegram installation storage.
+ *
+ * Stores per-bot authorization records in the internal database.
+ * Unlike Discord/Teams, Telegram requires no platform-level env vars.
+ * Each workspace admin enters their own bot token from @BotFather (BYOT).
+ */
+
+import { hasInternalDB, internalQuery } from "@atlas/api/lib/db/internal";
+import { createLogger } from "@atlas/api/lib/logger";
+import type { TelegramInstallation, TelegramInstallationWithSecret } from "@atlas/api/lib/integrations/types";
+
+export type { TelegramInstallation, TelegramInstallationWithSecret } from "@atlas/api/lib/integrations/types";
+
+const log = createLogger("telegram-store");
+
+// ---------------------------------------------------------------------------
+// Shared row parser
+// ---------------------------------------------------------------------------
+
+/**
+ * Parse a DB row into a TelegramInstallationWithSecret, validating required fields.
+ * Returns null and logs a warning if the row is malformed.
+ */
+function parseInstallationRow(
+  row: Record<string, unknown>,
+  context: Record<string, unknown>,
+): TelegramInstallationWithSecret | null {
+  const botIdVal = row.bot_id;
+  const botTokenVal = row.bot_token;
+  if (typeof botIdVal !== "string" || !botIdVal || typeof botTokenVal !== "string" || !botTokenVal) {
+    log.warn(context, "Invalid Telegram installation record in database");
+    return null;
+  }
+  return {
+    bot_id: botIdVal,
+    bot_token: botTokenVal,
+    bot_username: typeof row.bot_username === "string" ? row.bot_username : null,
+    org_id: typeof row.org_id === "string" ? row.org_id : null,
+    installed_at: typeof row.installed_at === "string" ? row.installed_at : new Date().toISOString(),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Read operations
+// ---------------------------------------------------------------------------
+
+/**
+ * Get the Telegram installation for a bot ID.
+ */
+export async function getTelegramInstallation(
+  botId: string,
+): Promise<TelegramInstallationWithSecret | null> {
+  if (!hasInternalDB()) {
+    return null;
+  }
+
+  try {
+    const rows = await internalQuery<Record<string, unknown>>(
+      "SELECT bot_id, bot_token, bot_username, org_id, installed_at::text FROM telegram_installations WHERE bot_id = $1",
+      [botId],
+    );
+    if (rows.length > 0) {
+      return parseInstallationRow(rows[0], { botId });
+    }
+    return null;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), botId },
+      "Failed to query telegram_installations",
+    );
+    throw err;
+  }
+}
+
+/**
+ * Get the Telegram installation for an org. Returns null if not found or
+ * if no internal database is configured (org-scoped lookups require a DB).
+ */
+export async function getTelegramInstallationByOrg(
+  orgId: string,
+): Promise<TelegramInstallation | null> {
+  if (!hasInternalDB()) {
+    return null;
+  }
+
+  try {
+    const rows = await internalQuery<Record<string, unknown>>(
+      "SELECT bot_id, bot_token, bot_username, org_id, installed_at::text FROM telegram_installations WHERE org_id = $1",
+      [orgId],
+    );
+    if (rows.length > 0) {
+      const full = parseInstallationRow(rows[0], { orgId });
+      if (!full) return null;
+      const { bot_token: _, ...pub } = full;
+      return pub;
+    }
+    return null;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), orgId },
+      "Failed to query telegram_installations by org",
+    );
+    throw err;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Write operations
+// ---------------------------------------------------------------------------
+
+/**
+ * Save or update a Telegram installation (bot token submission).
+ * Throws if the bot is already bound to a different organization (hijack protection).
+ * Throws if the database write fails.
+ */
+export async function saveTelegramInstallation(
+  botId: string,
+  opts: { orgId?: string; botUsername?: string; botToken: string },
+): Promise<void> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot save Telegram installation — no internal database configured");
+  }
+
+  const orgId = opts.orgId ?? null;
+  const botUsername = opts.botUsername ?? null;
+
+  try {
+    // Atomic upsert with hijack protection — the WHERE clause rejects rows
+    // bound to a different org in one statement (no TOCTOU race).
+    const rows = await internalQuery<{ bot_id: string }>(
+      `INSERT INTO telegram_installations (bot_id, bot_token, bot_username, org_id)
+       VALUES ($1, $2, $3, $4)
+       ON CONFLICT (bot_id) DO UPDATE SET
+         bot_token = $2,
+         bot_username = COALESCE($3, telegram_installations.bot_username),
+         org_id = COALESCE($4, telegram_installations.org_id),
+         installed_at = now()
+       WHERE telegram_installations.org_id IS NULL OR telegram_installations.org_id = $4
+       RETURNING bot_id`,
+      [botId, opts.botToken, botUsername, orgId],
+    );
+
+    if (rows.length === 0) {
+      throw new Error(
+        `Bot ${botId} is already bound to a different organization. ` +
+        `Disconnect the existing installation first.`,
+      );
+    }
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), botId },
+      "Failed to save telegram_installations",
+    );
+    throw err;
+  }
+}
+
+/**
+ * Remove a Telegram installation by bot ID.
+ * Throws if no internal DB or if the query fails.
+ */
+export async function deleteTelegramInstallation(botId: string): Promise<void> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot delete Telegram installation — no internal database configured");
+  }
+
+  try {
+    await internalQuery("DELETE FROM telegram_installations WHERE bot_id = $1", [botId]);
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), botId },
+      "Failed to delete telegram_installations",
+    );
+    throw err;
+  }
+}
+
+/**
+ * Remove the Telegram installation for an org.
+ * Returns true if a row was deleted, false if no matching row found.
+ * Throws if no internal DB or if the query fails.
+ */
+export async function deleteTelegramInstallationByOrg(orgId: string): Promise<boolean> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot delete Telegram installation — no internal database configured");
+  }
+
+  try {
+    const rows = await internalQuery<{ bot_id: string }>(
+      "DELETE FROM telegram_installations WHERE org_id = $1 RETURNING bot_id",
+      [orgId],
+    );
+    return rows.length > 0;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), orgId },
+      "Failed to delete telegram_installations by org",
+    );
+    throw err;
+  }
+}

package/templates/docker/src/lib/telemetry.ts

@@ -0,0 +1,40 @@
+/**
+ * OpenTelemetry SDK initialization for the Atlas API server.
+ *
+ * Separated from tracing.ts (span helpers) so the SDK is only loaded when
+ * OTEL_EXPORTER_OTLP_ENDPOINT is set. Without this import, @opentelemetry/api
+ * returns no-op tracers — zero overhead.
+ *
+ * Import this module once during server startup:
+ *   if (process.env.OTEL_EXPORTER_OTLP_ENDPOINT) await import("@atlas/api/lib/telemetry");
+ */
+
+const { NodeSDK } = await import("@opentelemetry/sdk-node");
+const { OTLPTraceExporter } = await import(
+  "@opentelemetry/exporter-trace-otlp-http"
+);
+const { resourceFromAttributes } = await import("@opentelemetry/resources");
+const { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } = await import(
+  "@opentelemetry/semantic-conventions"
+);
+
+const resource = resourceFromAttributes({
+  [ATTR_SERVICE_NAME]: "atlas-api",
+  [ATTR_SERVICE_VERSION]: process.env.npm_package_version ?? "0.0.0",
+});
+
+const traceExporter = new OTLPTraceExporter({
+  url: `${process.env.OTEL_EXPORTER_OTLP_ENDPOINT}/v1/traces`,
+});
+
+const sdk = new NodeSDK({ resource, traceExporter });
+sdk.start();
+
+/**
+ * Flush pending spans and shut down the SDK.
+ * Called from the server's graceful shutdown sequence — not a standalone
+ * SIGTERM handler, to avoid racing with process.exit().
+ */
+export async function shutdownTelemetry(): Promise<void> {
+  await sdk.shutdown();
+}

package/templates/docker/src/lib/tools/actions/audit.ts

@@ -4,10 +4,10 @@
  * Structured pino logs for every action state transition.
  *
  * State transitions:
- * - pending -> approved -> executed | failed
+ * - pending -> approved -> executed | failed | timed_out
  * - pending -> denied
- * - pending -> auto_approved (executed inline) | failed
- * - pending -> timed_out (reserved, not yet implemented)
+ * - pending -> auto_approved (executed inline) | failed | timed_out
+ * - executed | auto_approved -> rolled_back (via rollback API)
  */
 
 import { createLogger } from "@atlas/api/lib/logger";
@@ -20,24 +20,27 @@ export interface ActionAuditEntry {
   actionType: string;
   status: ActionStatus;
   latencyMs?: number;
+  /** Configured timeout duration (logged when status is timed_out). */
+  timeoutMs?: number;
   userId?: string;
   approverId?: string;
   error?: string;
 }
 
 export function logActionAudit(entry: ActionAuditEntry): void {
-  const { actionId, actionType, status, latencyMs, userId, approverId, error } = entry;
+  const { actionId, actionType, status, latencyMs, timeoutMs, userId, approverId, error } = entry;
   const fields = {
     actionId,
     actionType,
     status,
     ...(latencyMs !== undefined && { latencyMs }),
+    ...(timeoutMs !== undefined && { timeoutMs }),
     ...(userId && { userId }),
     ...(approverId && { approverId }),
     ...(error && { error }),
   };
 
-  if (status === "failed") {
+  if (status === "failed" || status === "timed_out") {
     log.error(fields, `action_${status}`);
   } else if (status === "denied") {
     log.warn(fields, `action_${status}`);

package/templates/docker/src/lib/tools/actions/email.ts

@@ -101,10 +101,12 @@ export async function executeEmailSend(
       const errorBody = (await response.json()) as { message?: string };
       detail = errorBody.message ?? `HTTP ${response.status}`;
     } catch {
+      // intentionally ignored: JSON parse failed, fall through to text() attempt
       try {
         const text = await response.text();
         detail = text ? `HTTP ${response.status}: ${text.slice(0, 200)}` : `HTTP ${response.status}`;
       } catch {
+        // intentionally ignored: body may already be consumed
         detail = `HTTP ${response.status}`;
       }
     }
@@ -167,7 +169,7 @@ export const sendEmailReport: AtlasAction = {
       const domainCheck = validateAllowedDomains(recipients);
       if (!domainCheck.valid) {
         return {
-          status: "error" as const,
+          status: "failed" as const,
           error: `Recipient domain not allowed: ${domainCheck.blocked.join(", ")}. Allowed domains: ${process.env.ATLAS_EMAIL_ALLOWED_DOMAINS}`,
         };
       }