paperclip-github-plugin 0.9.1 → 0.9.3

package/dist/worker.js

@@ -1992,6 +1992,20 @@ function normalizeGitHubTokensByCompanyId(value) {
   }
   return Object.fromEntries(entries);
 }
+function normalizePaperclipBoardApiTokensByCompanyId(value) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  const entries = Object.entries(value).map(([companyId, token]) => {
+    const normalizedCompanyId = normalizeCompanyId(companyId);
+    const normalizedToken = normalizeGitHubToken(token);
+    return normalizedCompanyId && normalizedToken ? [normalizedCompanyId, normalizedToken] : null;
+  }).filter((entry) => entry !== null);
+  if (entries.length === 0) {
+    return void 0;
+  }
+  return Object.fromEntries(entries);
+}
 function formatUtcTimestamp(value) {
   const parsed = new Date(value);
   if (Number.isNaN(parsed.getTime())) {
@@ -3730,6 +3744,7 @@ function normalizeConfig(value) {
   const githubToken = normalizeGitHubToken(record.githubToken);
   const githubTokensByCompanyId = normalizeGitHubTokensByCompanyId(record.githubTokensByCompanyId);
   const paperclipBoardApiTokenRefs = normalizePaperclipBoardApiTokenRefs(record.paperclipBoardApiTokenRefs);
+  const paperclipBoardApiTokensByCompanyId = normalizePaperclipBoardApiTokensByCompanyId(record.paperclipBoardApiTokensByCompanyId);
   const paperclipApiBaseUrl = normalizePaperclipApiBaseUrl(record.paperclipApiBaseUrl);
   return {
     ...githubTokenRefs ? { githubTokenRefs } : {},
@@ -3737,6 +3752,7 @@ function normalizeConfig(value) {
     ...githubToken ? { githubToken } : {},
     ...githubTokensByCompanyId ? { githubTokensByCompanyId } : {},
     ...paperclipBoardApiTokenRefs ? { paperclipBoardApiTokenRefs } : {},
+    ...paperclipBoardApiTokensByCompanyId ? { paperclipBoardApiTokensByCompanyId } : {},
     ...paperclipApiBaseUrl ? { paperclipApiBaseUrl } : {}
   };
 }
@@ -3860,6 +3876,80 @@ async function writeExternalCompanyGitHubTokenFallback(ctx, companyId, token) {
     });
   }
 }
+async function writeExternalCompanyPaperclipBoardApiTokenFallback(ctx, companyId, token) {
+  const externalConfigFilePath = getExternalConfigFilePath();
+  if (!externalConfigFilePath) {
+    throw new Error("Could not resolve a Paperclip home directory for the GitHub Sync fallback token config.");
+  }
+  const currentRecord = await readExternalConfigRecordForWrite(ctx, externalConfigFilePath);
+  const currentCompanyTokens = normalizePaperclipBoardApiTokensByCompanyId(currentRecord.paperclipBoardApiTokensByCompanyId) ?? {};
+  const nextRecord = {
+    ...currentRecord,
+    paperclipBoardApiTokensByCompanyId: {
+      ...currentCompanyTokens,
+      [companyId]: token
+    }
+  };
+  await mkdir(dirname(externalConfigFilePath), { recursive: true });
+  await writeFile(externalConfigFilePath, `${JSON.stringify(nextRecord, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  try {
+    await chmod(externalConfigFilePath, 384);
+  } catch (error) {
+    ctx.logger.warn("GitHub Sync could not tighten permissions on the worker-local token fallback file.", {
+      filePath: externalConfigFilePath,
+      error: getErrorMessage(error)
+    });
+  }
+}
+async function clearExternalCompanyPaperclipBoardApiTokenFallback(ctx, companyId) {
+  const externalConfigFilePath = getExternalConfigFilePath();
+  if (!externalConfigFilePath) {
+    return;
+  }
+  const currentRecord = await readExternalConfigRecordForWrite(ctx, externalConfigFilePath);
+  const currentCompanyTokens = normalizePaperclipBoardApiTokensByCompanyId(currentRecord.paperclipBoardApiTokensByCompanyId) ?? {};
+  if (!(companyId in currentCompanyTokens)) {
+    return;
+  }
+  const nextCompanyTokens = { ...currentCompanyTokens };
+  delete nextCompanyTokens[companyId];
+  const nextRecord = { ...currentRecord };
+  if (Object.keys(nextCompanyTokens).length > 0) {
+    nextRecord.paperclipBoardApiTokensByCompanyId = nextCompanyTokens;
+  } else {
+    delete nextRecord.paperclipBoardApiTokensByCompanyId;
+  }
+  await mkdir(dirname(externalConfigFilePath), { recursive: true });
+  await writeFile(externalConfigFilePath, `${JSON.stringify(nextRecord, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  try {
+    await chmod(externalConfigFilePath, 384);
+  } catch (error) {
+    ctx.logger.warn("GitHub Sync could not tighten permissions on the worker-local token fallback file.", {
+      filePath: externalConfigFilePath,
+      error: getErrorMessage(error)
+    });
+  }
+}
+async function shouldSeedExternalPaperclipBoardTokenFallback(ctx, companyId, secretRef) {
+  try {
+    return !(await ctx.secrets.resolve(secretRef)).trim();
+  } catch (error) {
+    ctx.logger.warn("Unable to resolve the saved Paperclip board API token while checking worker fallback necessity.", {
+      companyId,
+      secretRef,
+      error: getErrorMessage(error)
+    });
+    return true;
+  }
+}
 function normalizePaperclipBoardApiTokenRefs(value) {
   if (!value || typeof value !== "object") {
     return void 0;
@@ -10146,11 +10236,16 @@ async function resolvePaperclipApiAuthTokens(ctx, settings, config, mappings) {
   for (const companyId of companyIds) {
     const configuredSecretRef = getConfiguredPaperclipBoardApiTokenRef(config, companyId);
     const savedSecretRef = getSavedPaperclipBoardApiTokenRef(settings, companyId);
+    const fallbackToken = normalizeGitHubToken(config.paperclipBoardApiTokensByCompanyId?.[companyId]);
     const secretRef = configuredSecretRef ?? savedSecretRef;
     if (!secretRef) {
       continue;
     }
     if (!configuredSecretRef && savedSecretRef) {
+      if (fallbackToken) {
+        tokensByCompanyId.set(companyId, fallbackToken);
+        continue;
+      }
       ctx.logger.warn(
         "Paperclip board access is saved in plugin state but has not been mirrored into plugin config yet. Open plugin settings to finish migrating it, or reconnect board access, before retrying sync.",
         {
@@ -10166,6 +10261,15 @@ async function resolvePaperclipApiAuthTokens(ctx, settings, config, mappings) {
         tokensByCompanyId.set(companyId, token);
       }
     } catch (error) {
+      if (fallbackToken && isPluginSecretReferenceDisabledError(error)) {
+        ctx.logger.warn("GitHub Sync is using a worker-local Paperclip board token fallback because plugin secret refs are unavailable in this host.", {
+          companyId,
+          secretRef,
+          error: getErrorMessage(error)
+        });
+        tokensByCompanyId.set(companyId, fallbackToken);
+        continue;
+      }
       ctx.logger.warn("Unable to resolve the saved Paperclip board API token. Direct REST calls will continue without it.", {
         companyId,
         secretRef,
@@ -15654,6 +15758,7 @@ var __testing = {
   formatPaperclipApiFetchErrorMessage,
   hasUnresolvedPaperclipIssueBlocker,
   isHealthyMaintainerWaitTransition,
+  resolvePaperclipApiAuthTokens,
   resolveGithubToken,
   resolvePaperclipPullRequestIssueStatus,
   resolveSyncTransitionAssignee
@@ -15898,6 +16003,7 @@ var plugin = definePlugin({
         throw new Error("A company id is required to update Paperclip board access.");
       }
       const nextSecretRef = normalizeSecretRef(record.paperclipBoardApiTokenRef);
+      const nextBoardApiToken = normalizeGitHubToken(record.paperclipBoardApiToken);
       const nextPaperclipBoardApiTokenRefs = {
         ...previous.paperclipBoardApiTokenRefs ?? {}
       };
@@ -15909,10 +16015,18 @@ var plugin = definePlugin({
       };
       if (nextSecretRef) {
         nextPaperclipBoardApiTokenRefs[companyId] = nextSecretRef;
+        if (nextBoardApiToken) {
+          if (await shouldSeedExternalPaperclipBoardTokenFallback(ctx, companyId, nextSecretRef)) {
+            await writeExternalCompanyPaperclipBoardApiTokenFallback(ctx, companyId, nextBoardApiToken);
+          } else {
+            await clearExternalCompanyPaperclipBoardApiTokenFallback(ctx, companyId);
+          }
+        }
       } else {
         delete nextPaperclipBoardApiTokenRefs[companyId];
         delete nextPaperclipBoardAccessIdentityByCompanyId[companyId];
         delete nextPaperclipBoardAccessUserIdByCompanyId[companyId];
+        await clearExternalCompanyPaperclipBoardApiTokenFallback(ctx, companyId);
       }
       if ("paperclipBoardAccessIdentity" in record) {
         const nextIdentityLabel = normalizeOptionalString2(record.paperclipBoardAccessIdentity);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paperclip-github-plugin",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Paperclip plugin for synchronizing GitHub issues into Paperclip projects.",
   "license": "Apache-2.0",
   "type": "module",