atmn 2.0.35 → 2.0.37

package/src/actions/pull/webhooks/readWebhookEnvs.ts

@@ -0,0 +1,41 @@
+import { AutumnApiError } from "../../../generated/client";
+import type { RemoteWebhook } from "./types";
+import { ForeignOrgKeyError, type WebhookPullEnv } from "./webhookPullEnvs";
+
+const isRejectedKey = (error: unknown): boolean =>
+	error instanceof AutumnApiError &&
+	(error.status === 401 || error.status === 403);
+
+/**
+ * Lists every env in parallel. A rejected key, or one for another org, skips
+ * its env with one warning; any other failure fails the pull.
+ */
+export const readWebhookEnvs = async ({
+	envs,
+}: {
+	envs: WebhookPullEnv[];
+}): Promise<{
+	read: { envKey: string; list: RemoteWebhook[] }[];
+	skipped: string[];
+}> => {
+	const results = await Promise.all(
+		envs.map(async (env) => {
+			try {
+				const [envKey, { list }] = await Promise.all([
+					env.envKey(),
+					env.listWebhooks(),
+				]);
+				return { envKey, list };
+			} catch (error) {
+				if (error instanceof ForeignOrgKeyError)
+					return `⚠ webhooks: skipped ${env.label} (${env.keyName} belongs to another org)`;
+				if (!isRejectedKey(error)) throw error;
+				return `⚠ webhooks: skipped ${env.label} (${env.keyName} was rejected)`;
+			}
+		}),
+	);
+	return {
+		read: results.filter((result) => typeof result !== "string"),
+		skipped: results.filter((result) => typeof result === "string"),
+	};
+};

package/src/actions/pull/webhooks/webhookPullEnvs.ts

@@ -0,0 +1,84 @@
+import type { SecretKeyName } from "../../../env/resolveTarget";
+import { isSandboxKeyName } from "../../../env/sandboxKeyName";
+import { sandboxSlug } from "../../../generated/sandboxName";
+import type { OrgInfo } from "../../env/types/orgInfo";
+import type { RemoteWebhook } from "./types";
+
+/** One env a pull reads webhooks from, through that env's own key. */
+export type WebhookPullEnv = {
+	keyName: SecretKeyName;
+	/** How a skipped-env warning names it, before its key is known to work. */
+	label: string;
+	/** The `url` map key; a named sandbox's slug costs one lookup. */
+	envKey: () => Promise<string>;
+	listWebhooks: () => Promise<{ list: RemoteWebhook[] }>;
+};
+
+/** A key that works, but for another org than the one the pull targets. */
+export class ForeignOrgKeyError extends Error {}
+
+/** A sandbox reports the main org that made it; the main org is its own. */
+const mainOrgIdOf = (info: OrgInfo): string =>
+	info.is_sandbox && info.created_by ? info.created_by : info.id;
+
+/**
+ * Every env the loaded env files hold a key for. Live comes last, so when envs
+ * disagree on shared fields like `events`, prod's value is the one written.
+ */
+export const webhookPullEnvs = ({
+	env = process.env,
+	targetKeyName,
+	listWebhooks,
+	fetchOrgInfo,
+}: {
+	env?: Record<string, string | undefined>;
+	/** The key the pull targets: every other key must belong to its org. */
+	targetKeyName: SecretKeyName;
+	listWebhooks: (args: {
+		secretKey: string;
+	}) => Promise<{ list: RemoteWebhook[] }>;
+	fetchOrgInfo: (args: { secretKey: string }) => Promise<OrgInfo>;
+}): WebhookPullEnv[] => {
+	const infos = new Map<string, Promise<OrgInfo>>();
+	const infoOf = (secretKey: string) => {
+		if (!infos.has(secretKey))
+			infos.set(secretKey, fetchOrgInfo({ secretKey }));
+		return infos.get(secretKey) as Promise<OrgInfo>;
+	};
+	const targetKey = env[targetKeyName];
+	const targetOrg = async () =>
+		targetKey === undefined ? undefined : mainOrgIdOf(await infoOf(targetKey));
+	const named = Object.keys(env).filter(isSandboxKeyName).sort();
+	const keyNames: SecretKeyName[] = [
+		"AUTUMN_SECRET_KEY",
+		...named,
+		"AUTUMN_PROD_SECRET_KEY",
+	];
+	return keyNames.flatMap((keyName) => {
+		const secretKey = env[keyName];
+		if (!secretKey) return [];
+		const envKey = async () => {
+			if (keyName !== targetKeyName) {
+				const [info, org] = await Promise.all([infoOf(secretKey), targetOrg()]);
+				if (mainOrgIdOf(info) !== org) throw new ForeignOrgKeyError();
+			}
+			if (keyName === "AUTUMN_SECRET_KEY") return "sandbox";
+			if (keyName === "AUTUMN_PROD_SECRET_KEY") return "live";
+			return sandboxSlug((await infoOf(secretKey)).name);
+		};
+		const label =
+			keyName === "AUTUMN_SECRET_KEY"
+				? "sandbox"
+				: keyName === "AUTUMN_PROD_SECRET_KEY"
+					? "live"
+					: `sandbox ${keyName.slice("AUTUMN_SANDBOX_".length, -"_SECRET_KEY".length).toLowerCase()}`;
+		return [
+			{
+				keyName,
+				label,
+				envKey,
+				listWebhooks: () => listWebhooks({ secretKey }),
+			},
+		];
+	});
+};

package/src/actions/pull.ts

@@ -31,13 +31,14 @@ import {
 	scaffoldConfig,
 } from "./pull/scaffoldConfig";
 import { applyWebhooksPull } from "./pull/webhooks/applyWebhooksPull";
+import { readWebhookEnvs } from "./pull/webhooks/readWebhookEnvs";
 import type { StatedWebhook } from "./pull/webhooks/types";
+import type { WebhookPullEnv } from "./pull/webhooks/webhookPullEnvs";
 import { configSearchDirs } from "./push";
 import {
 	backfillInternalIds,
 	identityRowsFromCatalog,
 } from "./push/backfillInternalIds";
-import type { WebhookEnv } from "./webhooks/types/webhookEnv";
 
 export type PullResult = {
 	configPath: string;
@@ -67,8 +68,8 @@ export type PullOptions = {
 	yes?: boolean;
 	/** Asks where a first pull should put the config; headless by default. */
 	prompter?: Prompter;
-	/** The target env for the webhook lane; without it webhooks are not pulled. */
-	webhookEnv?: () => Promise<WebhookEnv>;
+	/** Every env the webhook lane reads, whatever the target; none when absent. */
+	webhookEnvs?: () => WebhookPullEnv[];
 };
 
 const OVERWRITE_HINT =
@@ -229,7 +230,7 @@ export const runPull = async ({
 	overwrite = false,
 	yes = false,
 	prompter = createPrompter({ interactive: false, write }),
-	webhookEnv,
+	webhookEnvs,
 }: PullOptions): Promise<PullResult> => {
 	const project = resolveProject({ cwd, configFlag });
 	if (overwrite && !yes) {
@@ -286,9 +287,7 @@ export const runPull = async ({
 			singletons.settings ?? { config: {} },
 		) as Promise<SettingsPreview>,
 		// Always listed, like settings: a webhook the config never named is pulled in.
-		webhookEnv === undefined
-			? undefined
-			: Promise.all([webhookEnv(), client.listWebhooks({})]),
+		readWebhookEnvs({ envs: webhookEnvs?.() ?? [] }),
 	]);
 
 	const files = new Map<string, string>();
@@ -374,15 +373,17 @@ export const runPull = async ({
 		);
 	}
 
-	const webhookWarnings: string[] = [];
-	if (webhooks !== undefined) {
-		const [env, { list }] = webhooks;
+	const webhookWarnings = [...webhooks.skipped];
+	let stated = lists.webhooks as StatedWebhook[] | undefined;
+	// Only an env whose list succeeded may remove its urls from the config.
+	for (const { envKey, list } of webhooks.read) {
 		const applied = applyWebhooksPull({
 			pull: { configPath, files },
 			remote: list,
-			stated: lists.webhooks as StatedWebhook[] | undefined,
-			envKey: env.key,
+			stated,
+			envKey,
 		});
+		stated = applied.stated;
 		lines.push(...applied.lines);
 		webhookWarnings.push(...applied.warnings);
 		unlocated.push(

package/src/cli.ts

@@ -14,6 +14,7 @@ import {
 	runKeylessLogin,
 } from "./actions/login/keyless";
 import { runPull } from "./actions/pull";
+import { webhookPullEnvs } from "./actions/pull/webhooks/webhookPullEnvs";
 import { pushExitCode, runPush } from "./actions/push";
 import { runReset } from "./actions/reset/runReset";
 import { runSandboxCreate } from "./actions/sandbox/createSandbox";
@@ -500,7 +501,18 @@ Linking a keyless org to an account:
 					overwrite: options.overwrite === true,
 					yes: options.yes === true,
 					prompter: prompterFor({ command }),
-					webhookEnv: webhookEnvFor({ target, command }),
+					webhookEnvs: () =>
+						webhookPullEnvs({
+							targetKeyName: target.secretKeyName,
+							listWebhooks: ({ secretKey }) =>
+								createClient({
+									secretKey,
+									fetch: autumnFetch,
+									...(target.baseUrl ? { baseUrl: target.baseUrl } : {}),
+								}).listWebhooks({}),
+							fetchOrgInfo: ({ secretKey }) =>
+								fetchOrgInfo({ baseUrl: targetBaseUrl({ target }), secretKey }),
+						}),
 				});
 				writeStaleSkillsHint({ command });
 			},

package/src/env/sandboxKeyName.ts

@@ -16,3 +16,9 @@ export const sandboxKeyName = ({
 
 /** The env var `atmn sandbox create --use` writes to pin a target sandbox. */
 export const SANDBOX_PIN_NAME = "AUTUMN_SANDBOX_ID";
+
+const SANDBOX_KEY_NAME = /^AUTUMN_SANDBOX_[A-Z0-9_]+_SECRET_KEY$/;
+
+/** Whether an env var is a named sandbox's key, as `sandboxKeyName` writes it. */
+export const isSandboxKeyName = (name: string): name is SandboxSecretKeyName =>
+	SANDBOX_KEY_NAME.test(name);

package/src/generated/apiRoutes.ts

@@ -2924,6 +2924,13 @@ export const API_ROUTES: readonly ApiRoute[] = [
 				required: false,
 				description: "Filter events by time range",
 			},
+			{
+				name: "range",
+				type: "string",
+				required: false,
+				description:
+					"Preset time range to filter events by, resolved the same way as in events.aggregate. Cannot be combined with custom_range",
+			},
 		],
 	},
 	{
@@ -2981,6 +2988,13 @@ export const API_ROUTES: readonly ApiRoute[] = [
 				description:
 					"Custom time range to aggregate events for. If provided, range must not be provided",
 			},
+			{
+				name: "timezone",
+				type: "string",
+				required: false,
+				description:
+					'IANA timezone (e.g. "America/New_York") that day, week and month bins are aligned to. Hour bins are always UTC. Defaults to UTC',
+			},
 			{
 				name: "filter_by",
 				type: "json",