ocean-brain 0.13.3 → 0.14.0

package/server/dist/features/integration/service.js

@@ -0,0 +1,173 @@
+import { createHash } from "node:crypto";
+import models from "../../models.js";
+import { createAppError } from "../../modules/error-handler.js";
+import { issueIntegrationToken } from "../../modules/integration-token.js";
+import {
+  MCP_CONNECTION_ID,
+  NATIVE_INTEGRATIONS,
+  parseManifest,
+  parsePermissions,
+  validateGrants
+} from "./manifest.js";
+const resolveManifest = (row) => {
+  if (row.native) {
+    const definition = NATIVE_INTEGRATIONS.find((integration) => integration.connectionId === row.id);
+    if (definition) return definition.manifest;
+  }
+  return parseManifest(JSON.parse(row.manifest));
+};
+const toConnection = (row) => ({
+  id: row.id,
+  native: row.native,
+  manifest: resolveManifest(row),
+  grantedPermissions: parsePermissions(JSON.parse(row.grantedPermissions)),
+  enabled: row.enabled,
+  pinned: row.pinned,
+  createdAt: row.createdAt.toISOString(),
+  updatedAt: row.updatedAt.toISOString(),
+  token: row.credential ? {
+    id: row.credential.id,
+    createdAt: row.credential.createdAt.toISOString(),
+    lastUsedAt: row.credential.lastUsedAt?.toISOString() ?? null
+  } : null
+});
+const credentialSummary = { select: { id: true, createdAt: true, lastUsedAt: true } };
+const createIntegrationService = (db = models) => {
+  const get = async (id) => {
+    const row = await db.integrationConnection.findUnique({
+      where: { id },
+      include: { credential: credentialSummary }
+    });
+    if (!row) throw createAppError(404, "INTEGRATION_NOT_FOUND", "The integration connection was not found.");
+    return toConnection(row);
+  };
+  return {
+    get,
+    async ensureNativeConnections() {
+      for (const integration of NATIVE_INTEGRATIONS) {
+        await db.integrationConnection.upsert({
+          where: { id: integration.connectionId },
+          create: {
+            id: integration.connectionId,
+            integrationId: integration.manifest.id,
+            native: true,
+            manifest: JSON.stringify(integration.manifest),
+            grantedPermissions: JSON.stringify(integration.manifest.permissions)
+          },
+          // Keep the owner's grants, enabled state and credentials on upgrade.
+          update: {}
+        });
+      }
+    },
+    async list() {
+      const rows = await db.integrationConnection.findMany({
+        orderBy: [{ native: "desc" }, { createdAt: "asc" }],
+        include: { credential: credentialSummary }
+      });
+      return rows.map(toConnection);
+    },
+    async connect(input) {
+      const manifest = parseManifest(input.manifest);
+      if (manifest.id.startsWith("ocean-brain."))
+        throw createAppError(
+          400,
+          "RESERVED_INTEGRATION_ID",
+          "The ocean-brain namespace is reserved for native integrations."
+        );
+      const grantedPermissions = validateGrants(input.grantedPermissions ?? [], manifest);
+      const row = await db.integrationConnection.create({
+        data: {
+          integrationId: manifest.id,
+          manifest: JSON.stringify(manifest),
+          grantedPermissions: JSON.stringify(grantedPermissions)
+        },
+        include: { credential: credentialSummary }
+      });
+      return toConnection(row);
+    },
+    async update(id, input) {
+      return db.$transaction(async (tx) => {
+        const current = await tx.integrationConnection.findUnique({ where: { id } });
+        if (!current)
+          throw createAppError(404, "INTEGRATION_NOT_FOUND", "The integration connection was not found.");
+        if (input.manifest !== void 0 && current.native)
+          throw createAppError(
+            400,
+            "NATIVE_INTEGRATION_MANIFEST",
+            "Native integration manifests are managed by Ocean Brain."
+          );
+        const manifest = input.manifest === void 0 ? resolveManifest(current) : parseManifest(input.manifest);
+        if (manifest.id !== current.integrationId)
+          throw createAppError(400, "INTEGRATION_ID_CHANGED", "An upgrade cannot change the integration id.");
+        const previousGrants = parsePermissions(JSON.parse(current.grantedPermissions)).filter(
+          (permission) => manifest.permissions.includes(permission)
+        );
+        const grantedPermissions = validateGrants(input.grantedPermissions ?? previousGrants, manifest);
+        for (const key of ["enabled", "pinned"]) {
+          if (input[key] !== void 0 && typeof input[key] !== "boolean")
+            throw createAppError(400, "INVALID_INTEGRATION_SETTING", `${key} must be a boolean.`);
+        }
+        const row = await tx.integrationConnection.update({
+          where: { id },
+          data: {
+            manifest: JSON.stringify(manifest),
+            grantedPermissions: JSON.stringify(grantedPermissions),
+            ...typeof input.enabled === "boolean" ? { enabled: input.enabled } : {},
+            ...typeof input.pinned === "boolean" ? { pinned: input.pinned } : {}
+          },
+          include: { credential: credentialSummary }
+        });
+        return toConnection(row);
+      });
+    },
+    async disconnect(id) {
+      const connection = await get(id);
+      if (connection.native || id === MCP_CONNECTION_ID)
+        throw createAppError(
+          400,
+          "NATIVE_INTEGRATION_REQUIRED",
+          "Native integrations can be disabled, but cannot be disconnected."
+        );
+      await db.integrationConnection.delete({ where: { id } });
+    },
+    async rotateToken(id) {
+      await get(id);
+      const token = issueIntegrationToken();
+      await db.integrationCredential.upsert({
+        where: { connectionId: id },
+        create: { connectionId: id, tokenHash: token.hash },
+        update: { tokenHash: token.hash, createdAt: /* @__PURE__ */ new Date(), lastUsedAt: null }
+      });
+      return { token: token.plaintext };
+    },
+    async revokeToken(id) {
+      await get(id);
+      await db.integrationCredential.deleteMany({ where: { connectionId: id } });
+    },
+    async authenticate(token) {
+      const tokenHash = createHash("sha256").update(token, "utf8").digest("hex");
+      const credential = await db.integrationCredential.findUnique({
+        where: { tokenHash },
+        include: { connection: true }
+      });
+      if (!credential?.connection.enabled) return null;
+      const connection = credential.connection;
+      const touched = await db.integrationCredential.updateMany({
+        where: { connectionId: connection.id, tokenHash },
+        data: { lastUsedAt: /* @__PURE__ */ new Date() }
+      });
+      if (!touched.count) return null;
+      return {
+        connectionId: connection.id,
+        integrationId: connection.integrationId,
+        native: connection.native,
+        permissions: parsePermissions(JSON.parse(connection.grantedPermissions)).filter(
+          (permission) => resolveManifest(connection).permissions.includes(permission)
+        )
+      };
+    }
+  };
+};
+export {
+  createIntegrationService
+};

package/server/dist/features/mcp-admin/service.js

@@ -1,87 +1,23 @@
-import models from "../../models.js";
-import { issueMcpToken, verifyMcpToken } from "../../modules/mcp-token.js";
-const MCP_ENABLED_CACHE_KEY = "MCP_ENABLED";
-const toStatus = (enabled, activeToken) => {
-  if (!activeToken) {
-    return {
-      enabled,
-      hasActiveToken: false,
-      token: null
-    };
+import { MCP_CONNECTION_ID } from "../integration/manifest.js";
+import { createIntegrationService } from "../integration/service.js";
+const createMcpAdminService = (integrations = createIntegrationService()) => ({
+  async getStatus() {
+    const integration = await integrations.get(MCP_CONNECTION_ID);
+    return { enabled: integration.enabled, hasActiveToken: integration.token !== null, token: integration.token };
+  },
+  async setEnabled(enabled) {
+    await integrations.update(MCP_CONNECTION_ID, { enabled });
+  },
+  rotateToken: () => integrations.rotateToken(MCP_CONNECTION_ID),
+  revokeActiveToken: () => integrations.revokeToken(MCP_CONNECTION_ID),
+  async validatePresentedToken(token) {
+    const integration = await integrations.get(MCP_CONNECTION_ID);
+    if (!integration.token) return { ok: false, reason: "not_configured" };
+    const principal = await integrations.authenticate(token);
+    if (!principal || principal.connectionId !== MCP_CONNECTION_ID) return { ok: false, reason: "forbidden" };
+    return { ok: true, permissions: principal.permissions };
   }
-  return {
-    enabled,
-    hasActiveToken: true,
-    token: {
-      id: String(activeToken.id),
-      createdAt: activeToken.createdAt.toISOString(),
-      lastUsedAt: activeToken.lastUsedAt ? activeToken.lastUsedAt.toISOString() : null
-    }
-  };
-};
-const createMcpAdminService = (db = models) => {
-  return {
-    async getStatus() {
-      const enabledCache = await db.cache.findUnique({ where: { key: MCP_ENABLED_CACHE_KEY } });
-      const activeToken = await db.mcpToken.findFirst({
-        where: { revokedAt: null },
-        orderBy: { createdAt: "desc" }
-      });
-      return toStatus(enabledCache?.value === "true", activeToken);
-    },
-    async setEnabled(enabled) {
-      await db.cache.upsert({
-        where: { key: MCP_ENABLED_CACHE_KEY },
-        update: { value: String(enabled) },
-        create: {
-          key: MCP_ENABLED_CACHE_KEY,
-          value: String(enabled)
-        }
-      });
-    },
-    async rotateToken() {
-      const now = /* @__PURE__ */ new Date();
-      const issued = issueMcpToken();
-      await db.$transaction(async (transaction) => {
-        await transaction.mcpToken.updateMany({
-          where: { revokedAt: null },
-          data: { revokedAt: now }
-        });
-        await transaction.mcpToken.create({ data: { tokenHash: issued.hash } });
-      });
-      return { token: issued.plaintext };
-    },
-    async revokeActiveToken() {
-      await db.mcpToken.updateMany({
-        where: { revokedAt: null },
-        data: { revokedAt: /* @__PURE__ */ new Date() }
-      });
-    },
-    async validatePresentedToken(token) {
-      const activeToken = await db.mcpToken.findFirst({
-        where: { revokedAt: null },
-        orderBy: { createdAt: "desc" }
-      });
-      if (!activeToken) {
-        return {
-          ok: false,
-          reason: "not_configured"
-        };
-      }
-      if (!verifyMcpToken(activeToken.tokenHash, token)) {
-        return {
-          ok: false,
-          reason: "forbidden"
-        };
-      }
-      await db.mcpToken.update({
-        where: { id: activeToken.id },
-        data: { lastUsedAt: /* @__PURE__ */ new Date() }
-      });
-      return { ok: true };
-    }
-  };
-};
+});
 export {
   createMcpAdminService
 };

package/server/dist/features/note/graphql/note.field.resolver.js

@@ -4,7 +4,7 @@ import { renderNoteSnapshotContentAsMarkdown } from "../../../features/note/serv
 import models from "../../../models.js";
 const noteFieldResolvers = {
   tags: async (note) => models.tag.findMany({ where: { notes: { some: { id: note.id } } } }),
-  properties: async (note) => listNoteProperties(note.id),
+  properties: async (note, { keys }) => listNoteProperties(note.id, keys ?? note.selectedPropertyKeys),
   contentPreview: (note) => buildNoteContentPreview(note.content),
   contentAsMarkdown: async (note) => {
     const { blocksToMarkdown } = await import("../../../modules/blocknote.js");

package/server/dist/features/note/graphql/note.query.resolver.js

@@ -21,6 +21,7 @@ import {
 import { getTrashedNoteById, listTrashedNotes } from "../../../features/note/services/trash.js";
 import models from "../../../models.js";
 import { runDataMaintenanceInBackground } from "../../../modules/data-maintenance.js";
+import { readMarkdownRange } from "../services/markdown-read.js";
 const MAX_SQLITE_INT_ID = 2147483647;
 const isValidNoteIdString = (id) => {
   if (!/^[1-9]\d*$/.test(id)) {
@@ -386,6 +387,11 @@ const noteQueryResolvers = {
   }),
   backReferences: createBackReferencesQueryResolver(),
   note: createNoteQueryResolver(),
+  noteRead: async (_, { id, ...input }) => {
+    const note = await createNoteQueryResolver()(_, { id });
+    const { blocksToMarkdown } = await import("../../../modules/blocknote.js");
+    return { note, ...readMarkdownRange(await blocksToMarkdown(note.content), note.updatedAt, input) };
+  },
   noteCleanupCandidates: async (_, {
     query,
     pagination = {

package/server/dist/features/note/graphql/note.type-defs.js

@@ -106,7 +106,7 @@ const noteType = gql`
         order: Int!
         layout: NoteLayout!
         tags: [Tag!]!
-        properties: [NoteProperty!]!
+        properties(keys: [String!]): [NoteProperty!]!
     }
 
     type NoteProperty {
@@ -269,6 +269,17 @@ const noteQuery = gql`
         links: [GraphLink!]!
     }
 
+    type NoteContentRange { start: Int!, end: Int!, totalLength: Int!, sectionEnd: Int!, hasMore: Boolean!, nextOffset: Int }
+    type NoteHeadingCandidate { heading: String!, level: Int!, start: Int!, end: Int! }
+    type NoteReadResult {
+        status: String!
+        reason: String
+        message: String
+        note: Note!
+        markdown: String!
+        contentRange: NoteContentRange
+        candidates: [NoteHeadingCandidate!]!
+    }
     type Query {
         allNotes(searchFilter: SearchFilterInput, pagination: PaginationInput): Notes!
         tagNotes(searchFilter: SearchFilterInput, pagination: PaginationInput): Notes!
@@ -278,6 +289,7 @@ const noteQuery = gql`
         imageNotes(src: String!): [Note!]!
         backReferences(id: ID!): [Note]!
         note(id: ID!): Note!
+        noteRead(id: ID!, offset: Int, maxLength: Int, heading: String, expectedUpdatedAt: String): NoteReadResult!
         noteCleanupCandidates(query: String, pagination: PaginationInput): [NoteCleanupCandidate!]!
         noteCleanupPreview(id: ID!): NoteCleanupPreview
         noteSnapshots(id: ID!, limit: Int): [NoteSnapshot!]!