paperclip-github-plugin 0.9.0 → 0.9.2

package/dist/worker.js

@@ -1,9 +1,9 @@
 // src/worker.ts
 import { Buffer } from "node:buffer";
 import { realpathSync } from "node:fs";
-import { readFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Octokit } from "@octokit/rest";
 import {
@@ -1604,6 +1604,10 @@ function getErrorMessage(error) {
   }
   return String(error);
 }
+function isPluginSecretReferenceDisabledError(error) {
+  const message = getErrorMessage(error).toLowerCase();
+  return message.includes("plugin secret reference") && message.includes("disabled") || message.includes("company-scoped plugin config lands");
+}
 function getErrorCause(error) {
   if (!error || typeof error !== "object" || !("cause" in error)) {
     return void 0;
@@ -1974,6 +1978,34 @@ function normalizeGitHubTokenRefs(value) {
   }
   return Object.fromEntries(entries);
 }
+function normalizeGitHubTokensByCompanyId(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, token]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    const normalizedToken = normalizeGitHubToken(token);
+    return normalizedCompanyId && normalizedToken ? [normalizedCompanyId, normalizedToken] : null;
+  }).filter((entry) => entry !== null);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
+function normalizePaperclipBoardApiTokensByCompanyId(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, token]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    const normalizedToken = normalizeGitHubToken(token);
+    return normalizedCompanyId && normalizedToken ? [normalizedCompanyId, normalizedToken] : null;
+  }).filter((entry) => entry !== null);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
 function formatUtcTimestamp(value) {
   const parsed = new Date(value);
   if (Number.isNaN(parsed.getTime())) {
@@ -3710,13 +3742,17 @@ function normalizeConfig(value) {
   const githubTokenRefs = normalizeGitHubTokenRefs(record.githubTokenRefs);
   const githubTokenRef = normalizeGitHubTokenRef(record.githubTokenRef);
   const githubToken = normalizeGitHubToken(record.githubToken);
+  const githubTokensByCompanyId = normalizeGitHubTokensByCompanyId(record.githubTokensByCompanyId);
   const paperclipBoardApiTokenRefs = normalizePaperclipBoardApiTokenRefs(record.paperclipBoardApiTokenRefs);
+  const paperclipBoardApiTokensByCompanyId = normalizePaperclipBoardApiTokensByCompanyId(record.paperclipBoardApiTokensByCompanyId);
   const paperclipApiBaseUrl = normalizePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
   return {
     ...githubTokenRefs ? { githubTokenRefs } : {},
     ...githubTokenRef ? { githubTokenRef } : {},
     ...githubToken ? { githubToken } : {},
+    ...githubTokensByCompanyId ? { githubTokensByCompanyId } : {},
     ...paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs } : {},
+    ...paperclipBoardApiTokensByCompanyId ? { paperclipBoardApiTokensByCompanyId } : {},
     ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {}
   };
 }
@@ -3791,6 +3827,129 @@ async function readExternalConfig(ctx) {
     return {};
   }
 }
+async function readExternalConfigRecordForWrite(ctx, filePath) {
+  try {
+    const rawConfig = await readFile(filePath, "utf8");
+    const parsedConfig = JSON.parse(rawConfig);
+    return parsedConfig && typeof parsedConfig === "object" && !Array.isArray(parsedConfig) ? { ...parsedConfig } : {};
+  } catch (error) {
+    const errorCode = error && typeof error === "object" && "code" in error ? error.code : void 0;
+    if (errorCode === "ENOENT") {
+      return {};
+    }
+    if (error instanceof SyntaxError) {
+      ctx.logger.warn("Ignoring the GitHub Sync worker-local token fallback config file because it is not valid JSON.", {
+        filePath,
+        error: error.message
+      });
+      return {};
+    }
+    throw error;
+  }
+}
+async function writeExternalCompanyGitHubTokenFallback(ctx, companyId, token) {
+  const externalConfigFilePath = getExternalConfigFilePath();
+  if (!externalConfigFilePath) {
+    throw new Error("Could not resolve a Paperclip home directory for the GitHub Sync fallback token config.");
+  }
+  const currentRecord = await readExternalConfigRecordForWrite(ctx, externalConfigFilePath);
+  const currentCompanyTokens = normalizeGitHubTokensByCompanyId(currentRecord.githubTokensByCompanyId) ?? {};
+  const nextRecord = {
+    ...currentRecord,
+    githubTokensByCompanyId: {
+      ...currentCompanyTokens,
+      [companyId]: token
+    }
+  };
+  await mkdir(dirname(externalConfigFilePath), { recursive: true });
+  await writeFile(externalConfigFilePath, `${JSON.stringify(nextRecord, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  try {
+    await chmod(externalConfigFilePath, 384);
+  } catch (error) {
+    ctx.logger.warn("GitHub Sync could not tighten permissions on the worker-local token fallback file.", {
+      filePath: externalConfigFilePath,
+      error: getErrorMessage(error)
+    });
+  }
+}
+async function writeExternalCompanyPaperclipBoardApiTokenFallback(ctx, companyId, token) {
+  const externalConfigFilePath = getExternalConfigFilePath();
+  if (!externalConfigFilePath) {
+    throw new Error("Could not resolve a Paperclip home directory for the GitHub Sync fallback token config.");
+  }
+  const currentRecord = await readExternalConfigRecordForWrite(ctx, externalConfigFilePath);
+  const currentCompanyTokens = normalizePaperclipBoardApiTokensByCompanyId(currentRecord.paperclipBoardApiTokensByCompanyId) ?? {};
+  const nextRecord = {
+    ...currentRecord,
+    paperclipBoardApiTokensByCompanyId: {
+      ...currentCompanyTokens,
+      [companyId]: token
+    }
+  };
+  await mkdir(dirname(externalConfigFilePath), { recursive: true });
+  await writeFile(externalConfigFilePath, `${JSON.stringify(nextRecord, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  try {
+    await chmod(externalConfigFilePath, 384);
+  } catch (error) {
+    ctx.logger.warn("GitHub Sync could not tighten permissions on the worker-local token fallback file.", {
+      filePath: externalConfigFilePath,
+      error: getErrorMessage(error)
+    });
+  }
+}
+async function clearExternalCompanyPaperclipBoardApiTokenFallback(ctx, companyId) {
+  const externalConfigFilePath = getExternalConfigFilePath();
+  if (!externalConfigFilePath) {
+    return;
+  }
+  const currentRecord = await readExternalConfigRecordForWrite(ctx, externalConfigFilePath);
+  const currentCompanyTokens = normalizePaperclipBoardApiTokensByCompanyId(currentRecord.paperclipBoardApiTokensByCompanyId) ?? {};
+  if (!(companyId in currentCompanyTokens)) {
+    return;
+  }
+  const nextCompanyTokens = { ...currentCompanyTokens };
+  delete nextCompanyTokens[companyId];
+  const nextRecord = { ...currentRecord };
+  if (Object.keys(nextCompanyTokens).length > 0) {
+    nextRecord.paperclipBoardApiTokensByCompanyId = nextCompanyTokens;
+  } else {
+    delete nextRecord.paperclipBoardApiTokensByCompanyId;
+  }
+  await mkdir(dirname(externalConfigFilePath), { recursive: true });
+  await writeFile(externalConfigFilePath, `${JSON.stringify(nextRecord, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  try {
+    await chmod(externalConfigFilePath, 384);
+  } catch (error) {
+    ctx.logger.warn("GitHub Sync could not tighten permissions on the worker-local token fallback file.", {
+      filePath: externalConfigFilePath,
+      error: getErrorMessage(error)
+    });
+  }
+}
+async function shouldSeedExternalPaperclipBoardTokenFallback(ctx, companyId, secretRef) {
+  try {
+    return !(await ctx.secrets.resolve(secretRef)).trim();
+  } catch (error) {
+    ctx.logger.warn("Unable to resolve the saved Paperclip board API token while checking worker fallback necessity.", {
+      companyId,
+      secretRef,
+      error: getErrorMessage(error)
+    });
+    return true;
+  }
+}
 function normalizePaperclipBoardApiTokenRefs(value) {
   if (!value || typeof value !== "object") {
     return void 0;
@@ -9985,6 +10144,7 @@ async function getResolvedConfig(ctx) {
 }
 function getConfiguredGithubTokenSource(settings, config, companyId) {
   const normalizedCompanyId = normalizeCompanyId(companyId);
+  const companyFallbackToken = normalizedCompanyId ? normalizeGitHubToken(config.githubTokensByCompanyId?.[normalizedCompanyId]) : void 0;
   const hasScopedGitHubTokenRefs = hasAnyScopedValue(settings?.githubTokenRefs) || hasAnyScopedValue(config.githubTokenRefs);
   const secretRef = normalizedCompanyId ? normalizeSecretRef(config.githubTokenRefs?.[normalizedCompanyId]) ?? normalizeSecretRef(settings?.githubTokenRefs?.[normalizedCompanyId]) ?? (!hasScopedGitHubTokenRefs ? normalizeGitHubTokenRef(config.githubTokenRef) ?? normalizeGitHubTokenRef(settings?.githubTokenRef) : void 0) : normalizeGitHubTokenRef(config.githubTokenRef) ?? normalizeGitHubTokenRef(settings?.githubTokenRef) ?? (() => {
     const configuredRefs = [
@@ -9995,14 +10155,17 @@ function getConfiguredGithubTokenSource(settings, config, companyId) {
     return uniqueRefs.length === 1 ? uniqueRefs[0] : void 0;
   })();
   if (secretRef) {
-    return { secretRef };
+    return {
+      secretRef,
+      ...companyFallbackToken ? { fallbackToken: companyFallbackToken } : {}
+    };
   }
-  const token = !normalizedCompanyId || !hasScopedGitHubTokenRefs ? normalizeGitHubToken(config.githubToken) : void 0;
+  const token = companyFallbackToken ?? (!normalizedCompanyId || !hasScopedGitHubTokenRefs ? normalizeGitHubToken(config.githubToken) : void 0);
   return token ? { token } : {};
 }
 function hasConfiguredGithubToken(settings, config, companyId) {
   const configuredTokenSource = getConfiguredGithubTokenSource(settings, config, companyId);
-  if (configuredTokenSource.secretRef ?? configuredTokenSource.token) {
+  if (configuredTokenSource.secretRef ?? configuredTokenSource.token ?? configuredTokenSource.fallbackToken) {
     return true;
   }
   if (normalizeCompanyId(companyId)) {
@@ -10012,6 +10175,18 @@ function hasConfiguredGithubToken(settings, config, companyId) {
     settings?.githubTokenRefs && Object.keys(settings.githubTokenRefs).length > 0 || config.githubTokenRefs && Object.keys(config.githubTokenRefs).length > 0
   );
 }
+function getSavedGitHubTokenRef(settings, companyId) {
+  if (!companyId) {
+    return void 0;
+  }
+  return normalizeSecretRef(settings?.githubTokenRefs?.[companyId]);
+}
+function getConfiguredGitHubTokenRef(config, companyId) {
+  if (!companyId) {
+    return void 0;
+  }
+  return normalizeSecretRef(config?.githubTokenRefs?.[companyId]);
+}
 function getSavedPaperclipBoardApiTokenRef(settings, companyId) {
   if (!companyId) {
     return void 0;
@@ -10061,11 +10236,16 @@ async function resolvePaperclipApiAuthTokens(ctx, settings, config, mappings) {
   for (const companyId of companyIds) {
     const configuredSecretRef = getConfiguredPaperclipBoardApiTokenRef(config, companyId);
     const savedSecretRef = getSavedPaperclipBoardApiTokenRef(settings, companyId);
+    const fallbackToken = normalizeGitHubToken(config.paperclipBoardApiTokensByCompanyId?.[companyId]);
     const secretRef = configuredSecretRef ?? savedSecretRef;
     if (!secretRef) {
       continue;
     }
     if (!configuredSecretRef && savedSecretRef) {
+      if (fallbackToken) {
+        tokensByCompanyId.set(companyId, fallbackToken);
+        continue;
+      }
       ctx.logger.warn(
         "Paperclip board access is saved in plugin state but has not been mirrored into plugin config yet. Open plugin settings to finish migrating it, or reconnect board access, before retrying sync.",
         {
@@ -10081,6 +10261,15 @@ async function resolvePaperclipApiAuthTokens(ctx, settings, config, mappings) {
         tokensByCompanyId.set(companyId, token);
       }
     } catch (error) {
+      if (fallbackToken && isPluginSecretReferenceDisabledError(error)) {
+        ctx.logger.warn("GitHub Sync is using a worker-local Paperclip board token fallback because plugin secret refs are unavailable in this host.", {
+          companyId,
+          secretRef,
+          error: getErrorMessage(error)
+        });
+        tokensByCompanyId.set(companyId, fallbackToken);
+        continue;
+      }
       ctx.logger.warn("Unable to resolve the saved Paperclip board API token. Direct REST calls will continue without it.", {
         companyId,
         secretRef,
@@ -10095,7 +10284,23 @@ async function resolveGithubToken(ctx, options = {}) {
   const config = options.config ?? await getResolvedConfig(ctx);
   const configuredTokenSource = getConfiguredGithubTokenSource(settings, config, options.companyId);
   if (configuredTokenSource.secretRef) {
-    return ctx.secrets.resolve(configuredTokenSource.secretRef);
+    try {
+      const token = (await ctx.secrets.resolve(configuredTokenSource.secretRef)).trim();
+      if (token) {
+        return token;
+      }
+      return configuredTokenSource.fallbackToken ?? "";
+    } catch (error) {
+      if (configuredTokenSource.fallbackToken && isPluginSecretReferenceDisabledError(error)) {
+        ctx.logger.warn("GitHub Sync is using a worker-local company token fallback because plugin secret refs are unavailable in this host.", {
+          companyId: normalizeCompanyId(options.companyId),
+          secretRef: configuredTokenSource.secretRef,
+          error: getErrorMessage(error)
+        });
+        return configuredTokenSource.fallbackToken;
+      }
+      throw error;
+    }
   }
   return configuredTokenSource.token ?? "";
 }
@@ -15553,6 +15758,8 @@ var __testing = {
   formatPaperclipApiFetchErrorMessage,
   hasUnresolvedPaperclipIssueBlocker,
   isHealthyMaintainerWaitTransition,
+  resolvePaperclipApiAuthTokens,
+  resolveGithubToken,
   resolvePaperclipPullRequestIssueStatus,
   resolveSyncTransitionAssignee
 };
@@ -15569,6 +15776,8 @@ var plugin = definePlugin({
       const normalizedSettings = normalizeSettings(saved);
       const config = await getResolvedConfig(ctx);
       const githubTokenConfigured = hasConfiguredGithubToken(normalizedSettings, config, requestedCompanyId);
+      const configuredGitHubTokenRef = getConfiguredGitHubTokenRef(config, requestedCompanyId);
+      const savedGitHubTokenRef = getSavedGitHubTokenRef(normalizedSettings, requestedCompanyId);
       const configuredBoardTokenRef = getConfiguredPaperclipBoardApiTokenRef(config, requestedCompanyId);
       const savedBoardTokenRef = getSavedPaperclipBoardApiTokenRef(normalizedSettings, requestedCompanyId);
       const settingsForResponse = sanitizeSettingsForCurrentSetup(
@@ -15590,6 +15799,8 @@ var plugin = definePlugin({
         paperclipApiBaseUrlConfigured: Boolean(normalizePaperclipApiBaseUrl(config.paperclipApiBaseUrl)),
         githubTokenConfigured,
         paperclipBoardAccessConfigured: requestedCompanyId ? hasConfiguredPaperclipBoardAccess(settingsForResponse, config, requestedCompanyId) : hasConfiguredPaperclipBoardAccessForMappings(settingsForResponse, config, scopedMappings),
+        ...savedGitHubTokenRef ? { githubTokenConfigSyncRef: savedGitHubTokenRef } : {},
+        githubTokenNeedsConfigSync: Boolean(savedGitHubTokenRef && configuredGitHubTokenRef !== savedGitHubTokenRef),
         ...savedBoardTokenRef ? { paperclipBoardAccessConfigSyncRef: savedBoardTokenRef } : {},
         paperclipBoardAccessNeedsConfigSync: Boolean(savedBoardTokenRef && !configuredBoardTokenRef)
       };
@@ -15792,6 +16003,7 @@ var plugin = definePlugin({
         throw new Error("A company id is required to update Paperclip board access.");
       }
       const nextSecretRef = normalizeSecretRef(record.paperclipBoardApiTokenRef);
+      const nextBoardApiToken = normalizeGitHubToken(record.paperclipBoardApiToken);
       const nextPaperclipBoardApiTokenRefs = {
         ...previous.paperclipBoardApiTokenRefs ?? {}
       };
@@ -15803,10 +16015,18 @@ var plugin = definePlugin({
       };
       if (nextSecretRef) {
         nextPaperclipBoardApiTokenRefs[companyId] = nextSecretRef;
+        if (nextBoardApiToken) {
+          if (await shouldSeedExternalPaperclipBoardTokenFallback(ctx, companyId, nextSecretRef)) {
+            await writeExternalCompanyPaperclipBoardApiTokenFallback(ctx, companyId, nextBoardApiToken);
+          } else {
+            await clearExternalCompanyPaperclipBoardApiTokenFallback(ctx, companyId);
+          }
+        }
       } else {
         delete nextPaperclipBoardApiTokenRefs[companyId];
         delete nextPaperclipBoardAccessIdentityByCompanyId[companyId];
         delete nextPaperclipBoardAccessUserIdByCompanyId[companyId];
+        await clearExternalCompanyPaperclipBoardApiTokenFallback(ctx, companyId);
       }
       if ("paperclipBoardAccessIdentity" in record) {
         const nextIdentityLabel = normalizeOptionalString2(record.paperclipBoardAccessIdentity);
@@ -15856,6 +16076,44 @@ var plugin = definePlugin({
       }
       return validateGithubToken(ctx, trimmedToken);
     });
+    ctx.actions.register("settings.ensureGitHubTokenAvailable", async (input) => {
+      const record = input && typeof input === "object" ? input : {};
+      const companyId = normalizeCompanyId(record.companyId);
+      const githubTokenRef = normalizeSecretRef(record.githubTokenRef);
+      const token = normalizeGitHubToken(record.token);
+      if (!companyId) {
+        throw new Error("Company context is required to verify worker access to the GitHub token.");
+      }
+      if (!githubTokenRef) {
+        throw new Error("A GitHub token secret ref is required to verify worker token access.");
+      }
+      if (!token) {
+        throw new Error("A validated GitHub token is required to prepare the worker token fallback.");
+      }
+      try {
+        const resolvedToken = (await ctx.secrets.resolve(githubTokenRef)).trim();
+        if (resolvedToken) {
+          return {
+            secretResolvable: true,
+            fallbackStored: false
+          };
+        }
+      } catch (error) {
+        if (!isPluginSecretReferenceDisabledError(error)) {
+          throw error;
+        }
+        await writeExternalCompanyGitHubTokenFallback(ctx, companyId, token);
+        return {
+          secretResolvable: false,
+          fallbackStored: true
+        };
+      }
+      await writeExternalCompanyGitHubTokenFallback(ctx, companyId, token);
+      return {
+        secretResolvable: false,
+        fallbackStored: true
+      };
+    });
     ctx.actions.register("project.pullRequests.createIssue", async (input) => {
       const record = input && typeof input === "object" ? input : {};
       return createProjectPullRequestPaperclipIssue(ctx, record);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paperclip-github-plugin",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Paperclip plugin for synchronizing GitHub issues into Paperclip projects.",
   "license": "Apache-2.0",
   "type": "module",