@useatlas/create 0.0.6 → 0.0.7

package/templates/nextjs-standalone/src/lib/sidecar-types.ts

@@ -7,6 +7,8 @@
 export interface SidecarExecRequest {
   command: string;
   timeout?: number;
+  /** Working directory override, relative to SEMANTIC_DIR (e.g. '.orgs/org123'). Must resolve to a path under SEMANTIC_DIR. */
+  cwd?: string;
 }
 
 export interface SidecarExecResponse {
@@ -25,3 +27,14 @@ export interface SidecarPythonRequest {
 
 /** Wire-format alias — canonical type lives in python.ts. */
 export type { PythonResult as SidecarPythonResponse } from "@atlas/api/lib/tools/python";
+
+// --- Python streaming execution ---
+
+/** NDJSON events emitted by the streaming Python endpoint. */
+export type SidecarPythonStreamEvent =
+  | { type: "stdout"; data: string }
+  | { type: "chart"; data: { base64: string; mimeType: "image/png" } }
+  | { type: "recharts"; data: { type: "line" | "bar" | "pie"; data: Record<string, unknown>[]; categoryKey: string; valueKeys: string[] } }
+  | { type: "table"; data: { columns: string[]; rows: unknown[][] } }
+  | { type: "done"; data: { success: true; exitCode: number } }
+  | { type: "error"; data: { error: string; output?: string } };

package/templates/nextjs-standalone/src/lib/slack/store.ts

@@ -7,41 +7,62 @@
 
 import { hasInternalDB, internalQuery, getInternalDB } from "@atlas/api/lib/db/internal";
 import { createLogger } from "@atlas/api/lib/logger";
+import type { SlackInstallation, SlackInstallationWithSecret } from "@atlas/api/lib/integrations/types";
+
+export type { SlackInstallation, SlackInstallationWithSecret } from "@atlas/api/lib/integrations/types";
 
 const log = createLogger("slack-store");
 
-export interface SlackInstallation {
-  team_id: string;
-  bot_token: string;
-  installed_at: string;
+/** Sentinel team_id for env-var-based installations (no real Slack team). */
+export const ENV_TEAM_ID = "env" as const;
+
+// ---------------------------------------------------------------------------
+// Shared row parser
+// ---------------------------------------------------------------------------
+
+/**
+ * Parse a DB row into a SlackInstallationWithSecret, validating required fields.
+ * Returns null and logs a warning if the row is malformed.
+ */
+function parseInstallationRow(
+  row: Record<string, unknown>,
+  context: Record<string, unknown>,
+): SlackInstallationWithSecret | null {
+  const teamIdVal = row.team_id;
+  const botToken = row.bot_token;
+  const installedAt = row.installed_at;
+  if (typeof teamIdVal !== "string" || typeof botToken !== "string" || !botToken) {
+    log.warn(context, "Invalid installation record in database");
+    return null;
+  }
+  return {
+    team_id: teamIdVal,
+    bot_token: botToken,
+    org_id: typeof row.org_id === "string" ? row.org_id : null,
+    workspace_name: typeof row.workspace_name === "string" ? row.workspace_name : null,
+    installed_at: typeof installedAt === "string" ? installedAt : new Date().toISOString(),
+  };
 }
 
+// ---------------------------------------------------------------------------
+// Read operations
+// ---------------------------------------------------------------------------
+
 /**
  * Get the bot token for a team. Checks internal DB first, then falls
  * back to SLACK_BOT_TOKEN env var.
  */
 export async function getInstallation(
   teamId: string,
-): Promise<SlackInstallation | null> {
+): Promise<SlackInstallationWithSecret | null> {
   if (hasInternalDB()) {
     try {
       const rows = await internalQuery<Record<string, unknown>>(
-        "SELECT team_id, bot_token, installed_at::text FROM slack_installations WHERE team_id = $1",
+        "SELECT team_id, bot_token, org_id, workspace_name, installed_at::text FROM slack_installations WHERE team_id = $1",
         [teamId],
       );
       if (rows.length > 0) {
-        const teamIdVal = rows[0].team_id;
-        const botToken = rows[0].bot_token;
-        const installedAt = rows[0].installed_at;
-        if (typeof teamIdVal !== "string" || typeof botToken !== "string" || !botToken) {
-          log.warn({ teamId }, "Invalid installation record in database");
-          return null;
-        }
-        return {
-          team_id: teamIdVal,
-          bot_token: botToken,
-          installed_at: typeof installedAt === "string" ? installedAt : new Date().toISOString(),
-        };
+        return parseInstallationRow(rows[0], { teamId });
       }
       return null;
     } catch (err) {
@@ -59,6 +80,8 @@ export async function getInstallation(
     return {
       team_id: teamId,
       bot_token: envToken,
+      org_id: null,
+      workspace_name: null,
       installed_at: new Date().toISOString(),
     };
   }
@@ -66,26 +89,86 @@ export async function getInstallation(
   return null;
 }
 
+/**
+ * Get the Slack installation for an org. Returns null if not found or
+ * if no internal database is configured (org-scoped lookups require a DB).
+ */
+export async function getInstallationByOrg(
+  orgId: string,
+): Promise<SlackInstallation | null> {
+  if (!hasInternalDB()) {
+    // Org-scoped installations require an internal database.
+    // Env-based status is reported separately via envConfigured flag.
+    return null;
+  }
+
+  try {
+    const rows = await internalQuery<Record<string, unknown>>(
+      "SELECT team_id, bot_token, org_id, workspace_name, installed_at::text FROM slack_installations WHERE org_id = $1",
+      [orgId],
+    );
+    if (rows.length > 0) {
+      const full = parseInstallationRow(rows[0], { orgId });
+      if (!full) return null;
+      const { bot_token: _, ...pub } = full;
+      return pub;
+    }
+    return null;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), orgId },
+      "Failed to query slack_installations by org",
+    );
+    throw err;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Write operations
+// ---------------------------------------------------------------------------
+
 /**
  * Save or update a Slack installation (OAuth flow).
  * Throws if the database write fails.
  */
-export async function saveInstallation(teamId: string, botToken: string): Promise<void> {
+export async function saveInstallation(
+  teamId: string,
+  botToken: string,
+  opts?: { orgId?: string; workspaceName?: string },
+): Promise<void> {
   if (!hasInternalDB()) {
     throw new Error("Cannot save Slack installation — no internal database configured");
   }
 
+  const orgId = opts?.orgId ?? null;
+  const workspaceName = opts?.workspaceName ?? null;
   const pool = getInternalDB();
-  await pool.query(
-    `INSERT INTO slack_installations (team_id, bot_token)
-     VALUES ($1, $2)
-     ON CONFLICT (team_id) DO UPDATE SET bot_token = $2, installed_at = now()`,
-    [teamId, botToken],
+
+  // Atomic upsert with hijack protection — the WHERE clause rejects rows
+  // bound to a different org in one statement (no TOCTOU race).
+  const result = await pool.query(
+    `INSERT INTO slack_installations (team_id, bot_token, org_id, workspace_name)
+     VALUES ($1, $2, $3, $4)
+     ON CONFLICT (team_id) DO UPDATE SET
+       bot_token = $2,
+       org_id = COALESCE($3, slack_installations.org_id),
+       workspace_name = COALESCE($4, slack_installations.workspace_name),
+       installed_at = now()
+     WHERE slack_installations.org_id IS NULL OR slack_installations.org_id = $3
+     RETURNING team_id`,
+    [teamId, botToken, orgId, workspaceName],
   );
+
+  if (result.rows.length === 0) {
+    throw new Error(
+      `Slack workspace ${teamId} is already bound to a different organization. ` +
+      `Disconnect the existing installation first.`,
+    );
+  }
 }
 
 /**
- * Remove a Slack installation.
+ * Remove a Slack installation by team ID.
  * Throws if the database delete fails.
  */
 export async function deleteInstallation(teamId: string): Promise<void> {
@@ -98,6 +181,32 @@ export async function deleteInstallation(teamId: string): Promise<void> {
   await pool.query("DELETE FROM slack_installations WHERE team_id = $1", [teamId]);
 }
 
+/**
+ * Remove the Slack installation for an org.
+ * Returns true if a row was deleted, false if no matching row found.
+ * Throws if no internal DB or if the query fails.
+ */
+export async function deleteInstallationByOrg(orgId: string): Promise<boolean> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot delete Slack installation — no internal database configured");
+  }
+
+  try {
+    const pool = getInternalDB();
+    const result = await pool.query(
+      "DELETE FROM slack_installations WHERE org_id = $1 RETURNING team_id",
+      [orgId],
+    );
+    return result.rows.length > 0;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), orgId },
+      "Failed to delete slack_installations by org",
+    );
+    throw err;
+  }
+}
+
 /**
  * Get the bot token for a team — convenience wrapper.
  */