@wildo-ai/saas-backend-lib 1.1.12 → 1.1.13

package/dist/esm/inbound/services/inbound-delivery-receiver.backend.service.js

@@ -42,18 +42,19 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
  * the endpoint's `answerChatSearch`, and stored nowhere.
  */
 import { inject, injectable, optional } from 'inversify';
-import { InboundChatInputKind, ChatBotOwnerScope, CoreResourceType, ErrorType, deriveInboundEndpointSecretEnvVarName, InboundDeliveryRejectionReason, InboundDeliveryUnroutableReason, InboundHandlerScopeMode, InboundResolvedScopeKind, InboundSenderAssurance, InboundSourceKind, isAuthorityConferringOrganizationStatus, PROVIDER_CONNECTION_ROUTING_FACT_PROVENANCES, isAuthorityConferringUserStatus, isWildoBackendError, jsonParsingSchemaOf, ResourcePrimaryScope, SortOrder, } from '@wildo-ai/saas-models';
+import { InboundChatInputKind, ChatBotOwnerScope, CoreResourceType, ErrorType, deriveInboundEndpointSecretEnvVarName, INBOUND_DELIVERY_MAX_BODY_BYTES, INBOUND_DELIVERY_MAX_STORED_BODY_BYTES, InboundDeliveryRejectionReason, InboundDeliveryUnroutableReason, InboundHandlerScopeMode, InboundResolvedScopeKind, InboundSenderAssurance, InboundSourceKind, isAuthorityConferringOrganizationStatus, PROVIDER_CONNECTION_ROUTING_FACT_PROVENANCES, isAuthorityConferringUserStatus, isWildoBackendError, jsonParsingSchemaOf, ResourcePrimaryScope, SortOrder, } from '@wildo-ai/saas-models';
 import { HOOK_REREAD_TRIGGER_DEFAULT_COALESCING_WINDOW_SECONDS, HOOK_REREAD_TRIGGER_DEFAULT_RATE_LIMIT, Hook_ContentType, isReReadTriggerEndpoint, Hook_ChatSearchAnswerKind, } from '@wildo-ai/external-connectors-models';
 import { chatConversationOrderingKeyOf } from '../../flows-actors/services/chat-conversation-store.backend.service.js';
 import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
 import { ProviderInboundRequestKind } from '../../notifications/webhooks/services/webhook-handler.backend.service.js';
-import { decodeInboundBody, inboundContentTypeOf, providerEndpointKeptHeaders } from '../../inbound/models/inbound-body-decoding.backend.js';
+import { decodeInboundBody, inboundContentTypeOf, providerEndpointKeptHeaders, storedInboundContentType } from '../../inbound/models/inbound-body-decoding.backend.js';
 import { projectCaughtErrorLogFields } from '../../errors/utils/error-log-level-classification.backend.utils.js';
 import { isMalformedIdLookupError } from '../../base-classes/services/repositories/resource-write-integrity.backend.js';
 import { inboundSourceKey, normalizeInboundSubjectKeys, scopesAdmittedByHandler, } from '../../inbound/models/inbound-handler.backend.definitions.js';
 import { InboundScopeStandingPolicy, inboundScopeStandingPolicyOf } from '../../inbound/models/inbound-engine-handler.backend.js';
 import { headersKeptForScheme, verifyInboundDelivery } from '../../inbound/verification/inbound-verification-schemes.backend.js';
-import { InboundDeliveryInsertOutcome } from './inbound-delivery-store.backend.service.js';
+import { InboundDeliveryInsertOutcome, inboundDeliveryIdFor, inboundDeliveryResourceTypeFor } from './inbound-delivery-store.backend.service.js';
+import { storedBodyFileIdOf } from './inbound-delivery-stored-body.backend.service.js';
 import { InboundDeliveryAudit } from './inbound-delivery-audit.backend.js';
 import { enqueueInboundDeliveryDispatch } from './inbound-delivery-dispatch-queue.backend.js';
 import { ChatSearchRouteKind } from '../../inbound/chat-commands/chat-search-lane.backend.service.js';
@@ -124,8 +125,9 @@ let InboundDeliveryReceiverBackendService = class InboundDeliveryReceiverBackend
     chatSearchLane;
     rateLimits;
     chatCommandFormLane;
+    storedBodies;
     audit;
-    constructor(logger, registry, store, repositoriesRegistry, resourcesRegistry, applicationIdentity, queue, auditLogs, webhookHandler, chatLinks, chatSearchLane, rateLimits, chatCommandFormLane) {
+    constructor(logger, registry, store, repositoriesRegistry, resourcesRegistry, applicationIdentity, queue, auditLogs, webhookHandler, chatLinks, chatSearchLane, rateLimits, chatCommandFormLane, storedBodies) {
         this.logger = logger;
         this.registry = registry;
         this.store = store;
@@ -138,6 +140,7 @@ let InboundDeliveryReceiverBackendService = class InboundDeliveryReceiverBackend
         this.chatSearchLane = chatSearchLane;
         this.rateLimits = rateLimits;
         this.chatCommandFormLane = chatCommandFormLane;
+        this.storedBodies = storedBodies;
         this.audit = new InboundDeliveryAudit(auditLogs);
     }
     /** The clock; a property so tests can pin time without DI trying to inject it. */
@@ -238,8 +241,9 @@ let InboundDeliveryReceiverBackendService = class InboundDeliveryReceiverBackend
             return reject(InboundDeliveryRejectionReason.BODY_TOO_LARGE, ANSWER.tooLarge);
         if (!request.rawBody)
             return reject(InboundDeliveryRejectionReason.MALFORMED, ANSWER.malformed);
-        // The endpoint's own cap, when its provider declares one: it is the ledger that stores the body.
-        if (endpoint.maxBodyBytes !== undefined && request.rawBody.length > endpoint.maxBodyBytes) {
+        // The endpoint's own cap, when its provider declares one, and never past the most any delivery may hold (#3395): a
+        // body over the row's size is stored outside it, but the whole body is verified in memory first.
+        if ((endpoint.maxBodyBytes !== undefined && request.rawBody.length > endpoint.maxBodyBytes) || request.rawBody.length > INBOUND_DELIVERY_MAX_BODY_BYTES) {
             return reject(InboundDeliveryRejectionReason.BODY_TOO_LARGE, ANSWER.tooLarge);
         }
         let verified;
@@ -578,10 +582,43 @@ let InboundDeliveryReceiverBackendService = class InboundDeliveryReceiverBackend
             });
             return ANSWER.retryLater;
         }
+        // #2665 S6 (plan V4), #2666 S7: stored, so READ withholds the body and the PROCESSED settle empties it, whatever the
+        // handler registry later holds. A COMMAND is decided by the verified request, which is what it is, never by the
+        // live list of verbs. Anything else is marked per ENDPOINT, not per request: a chat-conversation endpoint's other
+        // events (an edit, a file share) carry what a person wrote just the same, and so does a request to a command
+        // endpoint whose command the module could not read (review M5: unmarked, its text would never be emptied).
+        const chatInput = chatCommand
+            ? InboundChatInputKind.COMMAND
+            : this.isChatConversationEndpoint(handler) ? InboundChatInputKind.CONVERSATION_MESSAGE
+                : this.isChatCommandEndpoint(handler) ? InboundChatInputKind.COMMAND : undefined;
+        let applicationId;
+        let storedBody;
+        try {
+            applicationId = await this.applicationIdentity.getCanonicalApplicationId();
+            if (delivery.rawBody.length > INBOUND_DELIVERY_MAX_STORED_BODY_BYTES) {
+                // #3395: what a person wrote to the bot is never larger than a row, and its readers read it from the row; a body
+                // too large for the row is written outside it only where a backend can, and refused otherwise.
+                if (chatInput !== undefined || !this.storedBodies)
+                    return reject(InboundDeliveryRejectionReason.BODY_TOO_LARGE, ANSWER.tooLarge);
+                // A retried copy of an event already stored writes nothing: the ledger answers it without the upload.
+                if (await this.store.locate(inboundDeliveryIdFor(base.sourceKey, dedupKey)))
+                    return ANSWER.duplicate;
+                storedBody = await this.storedBodies.write({
+                    resourceType: inboundDeliveryResourceTypeFor(resolvedScope),
+                    deliveryId: inboundDeliveryIdFor(base.sourceKey, dedupKey),
+                    bytes: delivery.rawBody,
+                    mimeType: storedInboundContentType(delivery.headers),
+                    ownerRow: resolvedScope.kind === InboundResolvedScopeKind.ORGANIZATION ? { organizationId: resolvedScope.organizationId } : { applicationId },
+                });
+            }
+        }
+        catch (error) {
+            this.logger.error('Inbound delivery body could not be stored', { handlerRef: handler.ref, sourceKey: base.sourceKey, ...projectCaughtErrorLogFields(error) });
+            return ANSWER.retryLater;
+        }
         let inserted;
         try {
             // assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — one event, one stored delivery, at most one run (I2).
-            const applicationId = await this.applicationIdentity.getCanonicalApplicationId();
             inserted = await this.store.insert({
                 sourceKind: base.sourceKind,
                 sourceKey: base.sourceKey,
@@ -592,6 +629,7 @@ let InboundDeliveryReceiverBackendService = class InboundDeliveryReceiverBackend
                 ...(delivery.signedAt !== undefined ? { signedAt: delivery.signedAt } : {}),
                 receivedAt: delivery.receivedAt,
                 rawBody: delivery.rawBody,
+                ...(storedBody ? { storedBody } : {}),
                 headers: { ...delivery.headers },
                 ...(subjectKeys.length > 0 ? { subjectKeys } : {}),
                 resolvedScope,
@@ -600,21 +638,19 @@ let InboundDeliveryReceiverBackendService = class InboundDeliveryReceiverBackend
                     senderAssurance: InboundSenderAssurance.UNVERIFIED,
                     ...(reReadTrigger.notBefore ? { notBefore: reReadTrigger.notBefore } : {}),
                 } : {}),
-                // #2665 S6 (plan V4), #2666 S7: stored, so READ withholds the body and the PROCESSED settle empties it, whatever the
-                // handler registry later holds. A COMMAND is decided by the verified request, which is what it is, never by the
-                // live list of verbs. Anything else is marked per ENDPOINT, not per request: a chat-conversation endpoint's other
-                // events (an edit, a file share) carry what a person wrote just the same, and so does a request to a command
-                // endpoint whose command the module could not read (review M5: unmarked, its text would never be emptied).
-                ...(chatCommand
-                    ? { chatInput: InboundChatInputKind.COMMAND }
-                    : this.isChatConversationEndpoint(handler) ? { chatInput: InboundChatInputKind.CONVERSATION_MESSAGE }
-                        : this.isChatCommandEndpoint(handler) ? { chatInput: InboundChatInputKind.COMMAND } : {}),
+                ...(chatInput !== undefined ? { chatInput } : {}),
             }, applicationId);
         }
         catch (error) {
             this.logger.error('Inbound delivery could not be stored', { handlerRef: handler.ref, sourceKey: base.sourceKey, ...projectCaughtErrorLogFields(error) });
+            if (storedBody)
+                await this.storedBodies.discard(storedBody.fileId, 'insert_failed');
             return ANSWER.retryLater;
         }
+        // A body written for a row that was not stored (a concurrent copy won the key) or that does not name it is deleted.
+        if (storedBody && (inserted.outcome === InboundDeliveryInsertOutcome.DUPLICATE || storedBodyFileIdOf(inserted.row) !== storedBody.fileId)) {
+            await this.storedBodies.discard(storedBody.fileId, 'not_stored');
+        }
         if (inserted.outcome === InboundDeliveryInsertOutcome.DUPLICATE)
             return ANSWER.duplicate;
         if (inserted.row.resolvedScope.kind === InboundResolvedScopeKind.UNROUTABLE) {
@@ -870,7 +906,9 @@ InboundDeliveryReceiverBackendService = __decorate([
     __param(11, optional()),
     __param(12, inject(SAAS_SERVICE_TYPES.ChatCommandFormLane)),
     __param(12, optional()),
-    __metadata("design:paramtypes", [Function, Function, Function, Object, Object, Object, Object, Function, Function, Object, Object, Object, Object])
+    __param(13, inject(SAAS_SERVICE_TYPES.InboundDeliveryStoredBodyService)),
+    __param(13, optional()),
+    __metadata("design:paramtypes", [Function, Function, Function, Object, Object, Object, Object, Function, Function, Object, Object, Object, Object, Object])
 ], InboundDeliveryReceiverBackendService);
 export { InboundDeliveryReceiverBackendService };
 //# sourceMappingURL=inbound-delivery-receiver.backend.service.js.map