paperclip-github-plugin 0.9.0 → 0.9.1

package/dist/worker.js

@@ -1,9 +1,9 @@
 // src/worker.ts
 import { Buffer } from "node:buffer";
 import { realpathSync } from "node:fs";
-import { readFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Octokit } from "@octokit/rest";
 import {
@@ -1604,6 +1604,10 @@ function getErrorMessage(error) {
   }
   return String(error);
 }
+function isPluginSecretReferenceDisabledError(error) {
+  const message = getErrorMessage(error).toLowerCase();
+  return message.includes("plugin secret reference") && message.includes("disabled") || message.includes("company-scoped plugin config lands");
+}
 function getErrorCause(error) {
   if (!error || typeof error !== "object" || !("cause" in error)) {
     return void 0;
@@ -1974,6 +1978,20 @@ function normalizeGitHubTokenRefs(value) {
   }
   return Object.fromEntries(entries);
 }
+function normalizeGitHubTokensByCompanyId(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, token]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    const normalizedToken = normalizeGitHubToken(token);
+    return normalizedCompanyId && normalizedToken ? [normalizedCompanyId, normalizedToken] : null;
+  }).filter((entry) => entry !== null);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
 function formatUtcTimestamp(value) {
   const parsed = new Date(value);
   if (Number.isNaN(parsed.getTime())) {
@@ -3710,12 +3728,14 @@ function normalizeConfig(value) {
   const githubTokenRefs = normalizeGitHubTokenRefs(record.githubTokenRefs);
   const githubTokenRef = normalizeGitHubTokenRef(record.githubTokenRef);
   const githubToken = normalizeGitHubToken(record.githubToken);
+  const githubTokensByCompanyId = normalizeGitHubTokensByCompanyId(record.githubTokensByCompanyId);
   const paperclipBoardApiTokenRefs = normalizePaperclipBoardApiTokenRefs(record.paperclipBoardApiTokenRefs);
   const paperclipApiBaseUrl = normalizePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
   return {
     ...githubTokenRefs ? { githubTokenRefs } : {},
     ...githubTokenRef ? { githubTokenRef } : {},
     ...githubToken ? { githubToken } : {},
+    ...githubTokensByCompanyId ? { githubTokensByCompanyId } : {},
     ...paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs } : {},
     ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {}
   };
@@ -3791,6 +3811,55 @@ async function readExternalConfig(ctx) {
     return {};
   }
 }
+async function readExternalConfigRecordForWrite(ctx, filePath) {
+  try {
+    const rawConfig = await readFile(filePath, "utf8");
+    const parsedConfig = JSON.parse(rawConfig);
+    return parsedConfig && typeof parsedConfig === "object" && !Array.isArray(parsedConfig) ? { ...parsedConfig } : {};
+  } catch (error) {
+    const errorCode = error && typeof error === "object" && "code" in error ? error.code : void 0;
+    if (errorCode === "ENOENT") {
+      return {};
+    }
+    if (error instanceof SyntaxError) {
+      ctx.logger.warn("Ignoring the GitHub Sync worker-local token fallback config file because it is not valid JSON.", {
+        filePath,
+        error: error.message
+      });
+      return {};
+    }
+    throw error;
+  }
+}
+async function writeExternalCompanyGitHubTokenFallback(ctx, companyId, token) {
+  const externalConfigFilePath = getExternalConfigFilePath();
+  if (!externalConfigFilePath) {
+    throw new Error("Could not resolve a Paperclip home directory for the GitHub Sync fallback token config.");
+  }
+  const currentRecord = await readExternalConfigRecordForWrite(ctx, externalConfigFilePath);
+  const currentCompanyTokens = normalizeGitHubTokensByCompanyId(currentRecord.githubTokensByCompanyId) ?? {};
+  const nextRecord = {
+    ...currentRecord,
+    githubTokensByCompanyId: {
+      ...currentCompanyTokens,
+      [companyId]: token
+    }
+  };
+  await mkdir(dirname(externalConfigFilePath), { recursive: true });
+  await writeFile(externalConfigFilePath, `${JSON.stringify(nextRecord, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  try {
+    await chmod(externalConfigFilePath, 384);
+  } catch (error) {
+    ctx.logger.warn("GitHub Sync could not tighten permissions on the worker-local token fallback file.", {
+      filePath: externalConfigFilePath,
+      error: getErrorMessage(error)
+    });
+  }
+}
 function normalizePaperclipBoardApiTokenRefs(value) {
   if (!value || typeof value !== "object") {
     return void 0;
@@ -9985,6 +10054,7 @@ async function getResolvedConfig(ctx) {
 }
 function getConfiguredGithubTokenSource(settings, config, companyId) {
   const normalizedCompanyId = normalizeCompanyId(companyId);
+  const companyFallbackToken = normalizedCompanyId ? normalizeGitHubToken(config.githubTokensByCompanyId?.[normalizedCompanyId]) : void 0;
   const hasScopedGitHubTokenRefs = hasAnyScopedValue(settings?.githubTokenRefs) || hasAnyScopedValue(config.githubTokenRefs);
   const secretRef = normalizedCompanyId ? normalizeSecretRef(config.githubTokenRefs?.[normalizedCompanyId]) ?? normalizeSecretRef(settings?.githubTokenRefs?.[normalizedCompanyId]) ?? (!hasScopedGitHubTokenRefs ? normalizeGitHubTokenRef(config.githubTokenRef) ?? normalizeGitHubTokenRef(settings?.githubTokenRef) : void 0) : normalizeGitHubTokenRef(config.githubTokenRef) ?? normalizeGitHubTokenRef(settings?.githubTokenRef) ?? (() => {
     const configuredRefs = [
@@ -9995,14 +10065,17 @@ function getConfiguredGithubTokenSource(settings, config, companyId) {
     return uniqueRefs.length === 1 ? uniqueRefs[0] : void 0;
   })();
   if (secretRef) {
-    return { secretRef };
+    return {
+      secretRef,
+      ...companyFallbackToken ? { fallbackToken: companyFallbackToken } : {}
+    };
   }
-  const token = !normalizedCompanyId || !hasScopedGitHubTokenRefs ? normalizeGitHubToken(config.githubToken) : void 0;
+  const token = companyFallbackToken ?? (!normalizedCompanyId || !hasScopedGitHubTokenRefs ? normalizeGitHubToken(config.githubToken) : void 0);
   return token ? { token } : {};
 }
 function hasConfiguredGithubToken(settings, config, companyId) {
   const configuredTokenSource = getConfiguredGithubTokenSource(settings, config, companyId);
-  if (configuredTokenSource.secretRef ?? configuredTokenSource.token) {
+  if (configuredTokenSource.secretRef ?? configuredTokenSource.token ?? configuredTokenSource.fallbackToken) {
     return true;
   }
   if (normalizeCompanyId(companyId)) {
@@ -10012,6 +10085,18 @@ function hasConfiguredGithubToken(settings, config, companyId) {
     settings?.githubTokenRefs && Object.keys(settings.githubTokenRefs).length > 0 || config.githubTokenRefs && Object.keys(config.githubTokenRefs).length > 0
   );
 }
+function getSavedGitHubTokenRef(settings, companyId) {
+  if (!companyId) {
+    return void 0;
+  }
+  return normalizeSecretRef(settings?.githubTokenRefs?.[companyId]);
+}
+function getConfiguredGitHubTokenRef(config, companyId) {
+  if (!companyId) {
+    return void 0;
+  }
+  return normalizeSecretRef(config?.githubTokenRefs?.[companyId]);
+}
 function getSavedPaperclipBoardApiTokenRef(settings, companyId) {
   if (!companyId) {
     return void 0;
@@ -10095,7 +10180,23 @@ async function resolveGithubToken(ctx, options = {}) {
   const config = options.config ?? await getResolvedConfig(ctx);
   const configuredTokenSource = getConfiguredGithubTokenSource(settings, config, options.companyId);
   if (configuredTokenSource.secretRef) {
-    return ctx.secrets.resolve(configuredTokenSource.secretRef);
+    try {
+      const token = (await ctx.secrets.resolve(configuredTokenSource.secretRef)).trim();
+      if (token) {
+        return token;
+      }
+      return configuredTokenSource.fallbackToken ?? "";
+    } catch (error) {
+      if (configuredTokenSource.fallbackToken && isPluginSecretReferenceDisabledError(error)) {
+        ctx.logger.warn("GitHub Sync is using a worker-local company token fallback because plugin secret refs are unavailable in this host.", {
+          companyId: normalizeCompanyId(options.companyId),
+          secretRef: configuredTokenSource.secretRef,
+          error: getErrorMessage(error)
+        });
+        return configuredTokenSource.fallbackToken;
+      }
+      throw error;
+    }
   }
   return configuredTokenSource.token ?? "";
 }
@@ -15553,6 +15654,7 @@ var __testing = {
   formatPaperclipApiFetchErrorMessage,
   hasUnresolvedPaperclipIssueBlocker,
   isHealthyMaintainerWaitTransition,
+  resolveGithubToken,
   resolvePaperclipPullRequestIssueStatus,
   resolveSyncTransitionAssignee
 };
@@ -15569,6 +15671,8 @@ var plugin = definePlugin({
       const normalizedSettings = normalizeSettings(saved);
       const config = await getResolvedConfig(ctx);
       const githubTokenConfigured = hasConfiguredGithubToken(normalizedSettings, config, requestedCompanyId);
+      const configuredGitHubTokenRef = getConfiguredGitHubTokenRef(config, requestedCompanyId);
+      const savedGitHubTokenRef = getSavedGitHubTokenRef(normalizedSettings, requestedCompanyId);
       const configuredBoardTokenRef = getConfiguredPaperclipBoardApiTokenRef(config, requestedCompanyId);
       const savedBoardTokenRef = getSavedPaperclipBoardApiTokenRef(normalizedSettings, requestedCompanyId);
       const settingsForResponse = sanitizeSettingsForCurrentSetup(
@@ -15590,6 +15694,8 @@ var plugin = definePlugin({
         paperclipApiBaseUrlConfigured: Boolean(normalizePaperclipApiBaseUrl(config.paperclipApiBaseUrl)),
         githubTokenConfigured,
         paperclipBoardAccessConfigured: requestedCompanyId ? hasConfiguredPaperclipBoardAccess(settingsForResponse, config, requestedCompanyId) : hasConfiguredPaperclipBoardAccessForMappings(settingsForResponse, config, scopedMappings),
+        ...savedGitHubTokenRef ? { githubTokenConfigSyncRef: savedGitHubTokenRef } : {},
+        githubTokenNeedsConfigSync: Boolean(savedGitHubTokenRef && configuredGitHubTokenRef !== savedGitHubTokenRef),
         ...savedBoardTokenRef ? { paperclipBoardAccessConfigSyncRef: savedBoardTokenRef } : {},
         paperclipBoardAccessNeedsConfigSync: Boolean(savedBoardTokenRef && !configuredBoardTokenRef)
       };
@@ -15856,6 +15962,44 @@ var plugin = definePlugin({
       }
       return validateGithubToken(ctx, trimmedToken);
     });
+    ctx.actions.register("settings.ensureGitHubTokenAvailable", async (input) => {
+      const record = input && typeof input === "object" ? input : {};
+      const companyId = normalizeCompanyId(record.companyId);
+      const githubTokenRef = normalizeSecretRef(record.githubTokenRef);
+      const token = normalizeGitHubToken(record.token);
+      if (!companyId) {
+        throw new Error("Company context is required to verify worker access to the GitHub token.");
+      }
+      if (!githubTokenRef) {
+        throw new Error("A GitHub token secret ref is required to verify worker token access.");
+      }
+      if (!token) {
+        throw new Error("A validated GitHub token is required to prepare the worker token fallback.");
+      }
+      try {
+        const resolvedToken = (await ctx.secrets.resolve(githubTokenRef)).trim();
+        if (resolvedToken) {
+          return {
+            secretResolvable: true,
+            fallbackStored: false
+          };
+        }
+      } catch (error) {
+        if (!isPluginSecretReferenceDisabledError(error)) {
+          throw error;
+        }
+        await writeExternalCompanyGitHubTokenFallback(ctx, companyId, token);
+        return {
+          secretResolvable: false,
+          fallbackStored: true
+        };
+      }
+      await writeExternalCompanyGitHubTokenFallback(ctx, companyId, token);
+      return {
+        secretResolvable: false,
+        fallbackStored: true
+      };
+    });
     ctx.actions.register("project.pullRequests.createIssue", async (input) => {
       const record = input && typeof input === "object" ? input : {};
       return createProjectPullRequestPaperclipIssue(ctx, record);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paperclip-github-plugin",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Paperclip plugin for synchronizing GitHub issues into Paperclip projects.",
   "license": "Apache-2.0",
   "type": "module",