create-feedbax 0.2.1 → 0.2.2

package/template/src/integration-runtime.test.ts

@@ -0,0 +1,365 @@
+import { afterEach, expect, it } from "vitest";
+import { Miniflare } from "miniflare";
+import { readFile, readdir } from "node:fs/promises";
+import { resolve } from "node:path";
+import type { FeedbaxConfig } from "@feedbax/config";
+import {
+  createGitHubFeedbackModule,
+  createGitHubServiceAccess,
+  signIntegrationRequest,
+} from "@feedbax/feedback";
+import { createPortalIntegration } from "./integration-runtime";
+
+const configuration: FeedbaxConfig = {
+  provider: "github",
+  product: {
+    name: "Acme",
+    description: "Feedback",
+    logo: "/logo.svg",
+    siteUrl: "https://portal.account.workers.dev",
+  },
+  theme: { preset: "lyra-neutral" },
+  github: {
+    installationId: "portal-acme",
+    serviceUrl: "https://service.example",
+    repository: { id: 123, owner: "acme", name: "feedback" },
+    botUserId: 456,
+  },
+  features: { voting: true, comments: true, changelog: false },
+  submissions: {
+    moderation: "required",
+    maxTitleLength: 160,
+    maxDescriptionLength: 5000,
+  },
+  turnstile: { enabled: false },
+};
+
+let runtime: Miniflare | undefined;
+afterEach(async () => {
+  await runtime?.dispose();
+});
+it("accepts one authenticated pairing/delivery, rejects replays and Participant requests, and revokes provider access", async () => {
+  runtime = new Miniflare({
+    modules: true,
+    script: "export default {}",
+    d1Databases: ["DB"],
+    compatibilityDate: "2026-07-30",
+  });
+  const database = await runtime.getD1Database("DB");
+  const directory = resolve(import.meta.dirname, "../migrations");
+  for (const file of (await readdir(directory)).sort())
+    await database.exec(
+      (await readFile(resolve(directory, file), "utf8"))
+        .replace(/--[^\n]*/g, "")
+        .replace(/\s+/g, " "),
+    );
+  const config = configuration;
+  const service = createPortalIntegration({
+    config,
+    database,
+    pairingSecret: "p".repeat(40),
+  });
+  const pair = signIntegrationRequest({
+    url: "https://portal.account.workers.dev/internal/integration/pair",
+    installationId: "portal-acme",
+    secret: "p".repeat(40),
+    body: JSON.stringify({
+      challenge: "c".repeat(43),
+      repositoryId: 123,
+      botUserId: 456,
+      credentials: {
+        portalSecret: "a".repeat(43),
+        deliverySecret: "b".repeat(43),
+      },
+    }),
+  });
+  const replayPair = pair.clone();
+  expect((await service.handle(pair))?.status).toBe(200);
+  expect((await service.handle(replayPair))?.status).toBe(401);
+  const url =
+    "https://portal.account.workers.dev/internal/integration/delivery";
+  expect(
+    (
+      await service.handle(
+        new Request(url, {
+          method: "POST",
+          headers: { Cookie: "participant=anything" },
+          body: JSON.stringify({ kind: "revoke" }),
+        }),
+      )
+    )?.status,
+  ).toBe(401);
+  const signed = signIntegrationRequest({
+    url,
+    installationId: "portal-acme",
+    secret: "b".repeat(43),
+    body: JSON.stringify({ eventId: "event-one", kind: "reconcile" }),
+  });
+  const replay = signed.clone();
+  expect((await service.handle(signed))?.status).toBe(202);
+  expect((await service.handle(replay))?.status).toBe(401);
+  expect(await service.portalSecret()).toBe("a".repeat(43));
+  if (config.provider !== "github") throw Error("GitHub fixture required");
+  const access = createGitHubServiceAccess({
+    config: config.github,
+    getSecret: service.portalSecret,
+    request: async () =>
+      Response.json({
+        token: "scoped-token",
+        expiresAt: new Date(Date.now() + 3600_000).toISOString(),
+        repositoryId: 123,
+        botUserId: 456,
+      }),
+  });
+  expect(await access()).toBe("scoped-token");
+  expect(
+    (
+      await service.handle(
+        signIntegrationRequest({
+          url,
+          installationId: "portal-acme",
+          secret: "b".repeat(43),
+          body: JSON.stringify({ eventId: "event-two", kind: "revoke" }),
+        }),
+      )
+    )?.status,
+  ).toBe(202);
+  await expect(service.portalSecret()).rejects.toThrow("revoked");
+  await expect(access()).rejects.toThrow("revoked");
+  expect(
+    (
+      await service.handle(
+        signIntegrationRequest({
+          url,
+          installationId: "portal-acme",
+          secret: "b".repeat(43),
+          body: JSON.stringify({
+            eventId: "after-revocation",
+            kind: "reconcile",
+          }),
+        }),
+      )
+    )?.status,
+  ).toBe(401);
+});
+
+it("backs off provider failures and fences concurrent portal reconciliation", async () => {
+  runtime = new Miniflare({
+    modules: true,
+    script: "export default {}",
+    d1Databases: ["DB"],
+    compatibilityDate: "2026-07-30",
+  });
+  const database = await runtime.getD1Database("DB");
+  const directory = resolve(import.meta.dirname, "../migrations");
+  for (const file of (await readdir(directory)).sort())
+    await database.exec(
+      (await readFile(resolve(directory, file), "utf8"))
+        .replace(/--[^\n]*/g, "")
+        .replace(/\s+/g, " "),
+    );
+  const github =
+    configuration.provider === "github" ? configuration.github : undefined;
+  if (!github) throw new Error("GitHub fixture required");
+  let time = Date.now();
+  let unavailable = false;
+  let reads = 0;
+  let release: (() => void) | undefined;
+  let observed: (() => void) | undefined;
+  let hold = false;
+  const started = new Promise<void>((resolve) => {
+    observed = resolve;
+  });
+  const issue = {
+    id: 1000,
+    number: 1,
+    user: { id: 456 },
+    labels: [],
+    body: "",
+    title: "",
+  };
+  const feedback = createGitHubFeedbackModule({
+    ...github,
+    database,
+    getToken: async () => "token",
+    request: async (input, init) => {
+      const url = String(input);
+      if (url.endsWith("/acme/feedback")) return Response.json({ id: 123 });
+      if (init?.method === "POST") {
+        Object.assign(issue, JSON.parse(String(init.body)));
+        return Response.json(issue);
+      }
+      reads++;
+      if (unavailable) return new Response(null, { status: 503 });
+      if (hold) {
+        observed?.();
+        await new Promise<void>((resolve) => {
+          release = resolve;
+        });
+      }
+      return Response.json(issue);
+    },
+  });
+  await feedback.submitPost({
+    title: "A draft",
+    description: "Details",
+    type: "General Feedback",
+    submitter: { name: "Alice", email: "alice@example.com" },
+  });
+  await database
+    .prepare(
+      "INSERT INTO integration_credentials(installation_id,portal_secret,delivery_secret,paired_at) VALUES(?,?,?,?)",
+    )
+    .bind(github.installationId, "a".repeat(43), "b".repeat(43), time)
+    .run();
+  const integration = createPortalIntegration({
+    config: configuration,
+    database,
+    now: () => time,
+  });
+  expect(
+    (
+      await integration.handle(
+        signIntegrationRequest({
+          url: `${configuration.product.siteUrl}/internal/integration/delivery`,
+          installationId: github.installationId,
+          secret: "b".repeat(43),
+          body: JSON.stringify({ eventId: "recovery", kind: "reconcile" }),
+        }),
+      )
+    )?.status,
+  ).toBe(202);
+  unavailable = true;
+  await integration.reconcile(feedback);
+  expect(reads).toBe(3);
+  await integration.reconcile(feedback);
+  expect(reads).toBe(3);
+  time += 70_000;
+  unavailable = false;
+  hold = true;
+  const active = integration.reconcile(feedback);
+  await started;
+  await integration.reconcile(feedback);
+  expect(reads).toBe(4);
+  release?.();
+  await active;
+});
+
+it("advances the existing cursor when a fresh polling receipt arrives on every pass", async () => {
+  runtime = new Miniflare({
+    modules: true,
+    script: "export default {}",
+    d1Databases: ["DB"],
+    compatibilityDate: "2026-07-30",
+  });
+  const database = await runtime.getD1Database("DB");
+  const directory = resolve(import.meta.dirname, "../migrations");
+  for (const file of (await readdir(directory)).sort())
+    await database.exec(
+      (await readFile(resolve(directory, file), "utf8"))
+        .replace(/--[^\n]*/g, "")
+        .replace(/\s+/g, " "),
+    );
+  if (configuration.provider !== "github")
+    throw Error("GitHub fixture required");
+  const github = configuration.github;
+  const issues: Record<string, unknown>[] = [];
+  const reads: string[] = [];
+  const feedback = createGitHubFeedbackModule({
+    ...github,
+    database,
+    getToken: async () => "token",
+    request: async (input, init) => {
+      const url = String(input);
+      if (url.endsWith("/acme/feedback")) return Response.json({ id: 123 });
+      if (init?.method === "POST") {
+        const issue = {
+          ...JSON.parse(String(init.body)),
+          id: 1000 + issues.length,
+          number: issues.length + 1,
+          user: { id: 456 },
+          labels: [],
+        };
+        issues.push(issue);
+        return Response.json(issue);
+      }
+      reads.push(url);
+      const number = Number(url.split("/").at(-1));
+      return Response.json(issues.find((issue) => issue.number === number));
+    },
+  });
+  for (const title of ["First", "Second"])
+    await feedback.submitPost({
+      title,
+      description: "Details",
+      type: "General Feedback",
+      submitter: { name: "Alice", email: "alice@example.com" },
+    });
+  let time = Date.now();
+  await database
+    .prepare(
+      "INSERT INTO integration_credentials(installation_id,portal_secret,delivery_secret,paired_at) VALUES(?,?,?,?)",
+    )
+    .bind(github.installationId, "a".repeat(43), "b".repeat(43), time)
+    .run();
+  const integration = createPortalIntegration({
+    config: configuration,
+    database,
+    now: () => time,
+  });
+  for (let pass = 0; pass < 2; pass++) {
+    expect(
+      (
+        await integration.handle(
+          signIntegrationRequest({
+            url: `${configuration.product.siteUrl}/internal/integration/delivery`,
+            installationId: github.installationId,
+            secret: "b".repeat(43),
+            now: time,
+            body: JSON.stringify({
+              eventId: `poll-${pass}`,
+              kind: "reconcile",
+            }),
+          }),
+        )
+      )?.status,
+    ).toBe(202);
+    await integration.reconcile(feedback);
+    time += 300_000;
+  }
+  expect(reads).toHaveLength(2);
+  expect(new Set(reads).size).toBe(2);
+});
+
+it("expires terminal diagnostics even when no work is eligible", async () => {
+  const { createFeedbackModule } = await import("@feedbax/feedback");
+  runtime = new Miniflare({
+    modules: true,
+    script: "export default {}",
+    d1Databases: ["DB"],
+    compatibilityDate: "2026-07-30",
+  });
+  const database = await runtime.getD1Database("DB");
+  const directory = resolve(import.meta.dirname, "../migrations");
+  for (const file of (await readdir(directory)).sort())
+    await database.exec(
+      (await readFile(resolve(directory, file), "utf8"))
+        .replace(/--[^\n]*/g, "")
+        .replace(/\s+/g, " "),
+    );
+  const time = Date.now();
+  await database
+    .prepare(
+      "INSERT INTO integration_receipts(installation_id,event_id,kind,state,received_at,failure_code) VALUES(?,?,?,'failed',?,'provider_unavailable')",
+    )
+    .bind("portal-acme", "expired-work", "reconcile", time - 31 * 86400_000)
+    .run();
+  const integration = createPortalIntegration({
+    config: configuration,
+    database,
+    now: () => time,
+  });
+  expect((await integration.status()).terminalFailures).toBe(1);
+  await integration.reconcile(createFeedbackModule());
+  expect((await integration.status()).terminalFailures).toBe(0);
+});

package/template/src/integration-runtime.ts

@@ -0,0 +1,289 @@
+import { createHmac, randomUUID } from "node:crypto";
+import type { FeedbaxConfig } from "@feedbax/config";
+import {
+  boundedBody,
+  signIntegrationRequest,
+  verifyIntegrationRequest,
+  type ConnectedDatabase,
+  type FeedbackModule,
+} from "@feedbax/feedback";
+
+interface Credential {
+  portal_secret: string;
+  delivery_secret: string;
+  revoked: number;
+}
+export function createPortalIntegration(options: {
+  config: FeedbaxConfig;
+  database: ConnectedDatabase;
+  pairingSecret?: string;
+  now?: () => number;
+}) {
+  const { config, database } = options;
+  const now = options.now ?? Date.now;
+  const github = config.provider === "github" ? config.github : undefined;
+  const credential = () =>
+    github
+      ? database
+          .prepare(
+            "SELECT * FROM integration_credentials WHERE installation_id=?",
+          )
+          .bind(github.installationId)
+          .first<Credential>()
+      : Promise.resolve(null);
+  const json = (body: unknown, status = 200) =>
+    Response.json(body, {
+      status,
+      headers: {
+        "Cache-Control": "no-store",
+        "Referrer-Policy": "no-referrer",
+      },
+    });
+  return {
+    async portalSecret() {
+      const row = await credential();
+      if (!row || row.revoked)
+        throw new Error(
+          "GitHub Portal Binding is missing or revoked. Pair the Installation again.",
+        );
+      return row.portal_secret;
+    },
+    async handle(request: Request): Promise<Response | undefined> {
+      const url = new URL(request.url);
+      if (!url.pathname.startsWith("/internal/integration/")) return;
+      if (
+        !github ||
+        !config.product.siteUrl ||
+        url.origin !== new URL(config.product.siteUrl).origin
+      )
+        return json({ error: "Not found." }, 404);
+      if (request.method !== "POST")
+        return json({ error: "Method not allowed." }, 405);
+      try {
+        const body = await boundedBody(request, 4096);
+        const pairing = url.pathname === "/internal/integration/pair";
+        const stored = pairing ? null : await credential();
+        const secret = pairing
+          ? options.pairingSecret
+          : stored?.delivery_secret;
+        if (
+          !secret ||
+          request.headers.get("X-Feedbax-Installation") !==
+            github.installationId ||
+          !verifyIntegrationRequest(request, body, secret, now())
+        )
+          return json({ error: "Unauthorized." }, 401);
+        const input = JSON.parse(body) as Record<string, unknown>;
+        if (!input || typeof input !== "object" || Array.isArray(input))
+          return json({ error: "Invalid delivery." }, 400);
+        const nonce = database
+          .prepare(
+            "INSERT INTO portal_integration_nonces(installation_id,nonce,expires_at) VALUES(?,?,?)",
+          )
+          .bind(
+            github.installationId,
+            request.headers.get("X-Feedbax-Nonce"),
+            now() + 600_000,
+          );
+        if (pairing) {
+          const keys = input.credentials as
+            { portalSecret?: unknown; deliverySecret?: unknown } | undefined;
+          if (
+            typeof input.challenge !== "string" ||
+            !/^[A-Za-z0-9_-]{43}$/.test(input.challenge) ||
+            input.repositoryId !== github.repository.id ||
+            input.botUserId !== github.botUserId ||
+            !keys ||
+            typeof keys.portalSecret !== "string" ||
+            typeof keys.deliverySecret !== "string" ||
+            !/^[A-Za-z0-9_-]{43}$/.test(keys.portalSecret) ||
+            !/^[A-Za-z0-9_-]{43}$/.test(keys.deliverySecret) ||
+            keys.portalSecret === keys.deliverySecret
+          )
+            return json(
+              { error: "Pairing does not match this Installation." },
+              400,
+            );
+          await database.batch([
+            nonce,
+            database
+              .prepare(
+                "INSERT INTO integration_credentials(installation_id,portal_secret,delivery_secret,paired_at) VALUES(?,?,?,?) ON CONFLICT(installation_id) DO UPDATE SET portal_secret=excluded.portal_secret,delivery_secret=excluded.delivery_secret,paired_at=excluded.paired_at,revoked=0",
+              )
+              .bind(
+                github.installationId,
+                keys.portalSecret,
+                keys.deliverySecret,
+                now(),
+              ),
+          ]);
+          const proof = createHmac("sha256", secret)
+            .update(
+              JSON.stringify([
+                "feedbax-pair-v1",
+                github.installationId,
+                url.origin,
+                github.serviceUrl,
+                input.challenge,
+              ]),
+            )
+            .digest("hex");
+          return json({ proof });
+        }
+        if (url.pathname !== "/internal/integration/delivery")
+          return json({ error: "Not found." }, 404);
+        if (
+          typeof input.eventId !== "string" ||
+          !/^[A-Za-z0-9:_-]{1,200}$/.test(input.eventId) ||
+          !["reconcile", "revoke"].includes(String(input.kind))
+        )
+          return json({ error: "Invalid delivery." }, 400);
+        if (stored?.revoked && input.kind !== "revoke")
+          return json({ error: "Unauthorized." }, 401);
+        await database.batch([
+          nonce,
+          database
+            .prepare(
+              "INSERT OR IGNORE INTO integration_receipts(installation_id,event_id,kind,received_at) VALUES(?,?,?,?)",
+            )
+            .bind(github.installationId, input.eventId, input.kind, now()),
+          ...(input.kind === "revoke"
+            ? [
+                database
+                  .prepare(
+                    "UPDATE integration_credentials SET revoked=1 WHERE installation_id=?",
+                  )
+                  .bind(github.installationId),
+              ]
+            : []),
+        ]);
+        return json({ accepted: true }, 202);
+      } catch {
+        return json(
+          {
+            error:
+              "Delivery was not accepted. Retry with a fresh authenticated request.",
+          },
+          401,
+        );
+      }
+    },
+    async reconcile(feedback: FeedbackModule, limit = 1) {
+      if (!github) return;
+      if (!Number.isInteger(limit) || limit < 1 || limit > 10)
+        throw new Error("Reconciliation work limit must be 1–10.");
+      await database.batch([
+        database
+          .prepare("DELETE FROM portal_integration_nonces WHERE expires_at<?")
+          .bind(now()),
+        database
+          .prepare(
+            "UPDATE integration_receipts SET failure_code=NULL WHERE received_at<?",
+          )
+          .bind(now() - 30 * 86400_000),
+      ]);
+      const time = now();
+      const candidate = await database
+        .prepare(
+          "SELECT event_id FROM integration_receipts WHERE installation_id=? AND state='pending' AND next_attempt<=? AND lease_until<=? ORDER BY received_at,event_id LIMIT 1",
+        )
+        .bind(github.installationId, time, time)
+        .first<{ event_id: string }>();
+      if (!candidate) return;
+      const lease = randomUUID();
+      const work = await database
+        .prepare(
+          "UPDATE integration_receipts SET lease_token=?,lease_until=?,attempts=attempts+1,last_checked_at=? WHERE installation_id=? AND event_id=? AND state='pending' AND next_attempt<=? AND lease_until<=? RETURNING event_id,cursor,attempts",
+        )
+        .bind(
+          lease,
+          time + 60_000,
+          time,
+          github.installationId,
+          candidate.event_id,
+          time,
+          time,
+        )
+        .first<{ event_id: string; cursor: string; attempts: number }>();
+      if (!work) return;
+      const record = await credential();
+      if (!record || record.revoked) {
+        await database
+          .prepare(
+            "UPDATE integration_receipts SET state='complete',last_checked_at=?,lease_until=0 WHERE installation_id=? AND event_id=? AND lease_token=?",
+          )
+          .bind(now(), github.installationId, work.event_id, lease)
+          .run();
+        return;
+      }
+      try {
+        const posts = (
+          await database
+            .prepare(
+              "SELECT post_id,slug FROM github_posts WHERE installation_id=? AND repository_id=? AND state='ready' AND post_id>? ORDER BY post_id LIMIT ?",
+            )
+            .bind(
+              github.installationId,
+              github.repository.id,
+              work.cursor,
+              limit,
+            )
+            .all<{ post_id: string; slug: string }>()
+        ).results;
+        for (const post of posts) await feedback.getPublicPost(post.slug);
+        await database
+          .prepare(
+            "UPDATE integration_receipts SET cursor=?,state=?,last_checked_at=?,failure_code=NULL,attempts=0,lease_until=0 WHERE installation_id=? AND event_id=? AND cursor=? AND lease_token=?",
+          )
+          .bind(
+            posts.at(-1)?.post_id ?? work.cursor,
+            posts.length < limit ? "complete" : "pending",
+            now(),
+            github.installationId,
+            work.event_id,
+            work.cursor,
+            lease,
+          )
+          .run();
+      } catch {
+        const delay =
+          Math.min(3600_000, 60_000 * 2 ** Math.min(work.attempts - 1, 6)) +
+          Math.floor(Math.random() * 10_000);
+        await database
+          .prepare(
+            "UPDATE integration_receipts SET state=?,failure_code='provider_unavailable',next_attempt=?,lease_until=0 WHERE installation_id=? AND event_id=? AND lease_token=?",
+          )
+          .bind(
+            work.attempts >= 5 ? "failed" : "pending",
+            time + delay,
+            github.installationId,
+            work.event_id,
+            lease,
+          )
+          .run();
+      }
+    },
+    async status() {
+      if (!github) return { pending: 0, terminalFailures: 0 };
+      const summary = await database
+        .prepare(
+          "SELECT SUM(CASE WHEN state='pending' THEN 1 ELSE 0 END) AS pending,SUM(CASE WHEN state='failed' AND failure_code IS NOT NULL THEN 1 ELSE 0 END) AS failures FROM integration_receipts WHERE installation_id=?",
+        )
+        .bind(github.installationId)
+        .first<{ pending: number | null; failures: number | null }>();
+      return {
+        pending: summary?.pending ?? 0,
+        terminalFailures: summary?.failures ?? 0,
+      };
+    },
+    signedRequest(path: "/v1/status" | "/v1/revoke", secret: string) {
+      if (!github) throw new Error("GitHub is not configured.");
+      return signIntegrationRequest({
+        url: `${github.serviceUrl}${path}`,
+        installationId: github.installationId,
+        secret,
+        body: "{}",
+      });
+    },
+  };
+}