patchwork-os 0.2.0-beta.6.canary.21 → 0.2.0-beta.6.canary.23

package/dist/connectors/elasticsearch.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Elasticsearch connector — read-only access to ES clusters via @elastic/elasticsearch.
+ *
+ * Auth precedence:
+ *   1. cloudId + apiKey   (Elastic Cloud)
+ *   2. node    + apiKey   (self-hosted with API key)
+ *   3. node    + username + password   (basic auth)
+ *
+ * Tools (READ-ONLY): listIndices, describeIndex, search, count, aggregate, clusterHealth.
+ *
+ * Query guard: every search/aggregate body is walked and rejected if it contains
+ *   `script`, `script_fields`, or `script_score` keys at any depth, or top-level
+ *   keys outside a strict allowlist. Defense against arbitrary code execution
+ *   via Painless scripting.
+ *
+ * Driver is loaded lazily so the bridge boots even when `@elastic/elasticsearch`
+ * is not installed. Use `__setEsModuleForTest` in tests to inject a stub.
+ */
+import { type AuthContext, BaseConnector, type ConnectorError, type ConnectorStatus } from "./baseConnector.js";
+export interface ElasticsearchTokens {
+    node?: string;
+    apiKey?: string;
+    username?: string;
+    password?: string;
+    cloudId?: string;
+    connected_at: string;
+}
+export interface EsClientLike {
+    ping(): Promise<unknown>;
+    close(): Promise<void>;
+    cat: {
+        indices(params: {
+            format: string;
+            h?: string;
+        }): Promise<unknown>;
+    };
+    indices: {
+        getMapping(params: {
+            index: string;
+        }): Promise<unknown>;
+        getSettings(params: {
+            index: string;
+        }): Promise<unknown>;
+    };
+    search(params: Record<string, unknown>): Promise<unknown>;
+    count(params: Record<string, unknown>): Promise<unknown>;
+    cluster: {
+        health(): Promise<unknown>;
+    };
+}
+export interface EsModuleLike {
+    Client: new (opts: Record<string, unknown>) => EsClientLike;
+    errors?: {
+        ResponseError?: new (...args: unknown[]) => Error;
+        ConnectionError?: new (...args: unknown[]) => Error;
+    };
+}
+/**
+ * Test hook — inject a stub `@elastic/elasticsearch` module so tests don't
+ * need the real driver installed. Pass `null` to reset.
+ */
+export declare function __setEsModuleForTest(mod: EsModuleLike | null): void;
+export declare function loadTokens(): ElasticsearchTokens | null;
+export declare function saveTokens(tokens: ElasticsearchTokens): void;
+export declare function clearTokens(): void;
+/**
+ * Recursive walker — returns null when safe, error string when rejected.
+ * Rejects any object containing keys matching `script`, `script_fields`, or
+ * `script_score` (case-insensitive) at any depth, including inside arrays.
+ */
+export declare function isReadOnlyEsQuery(obj: unknown): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Validate a full search body — checks top-level allowlist + script walker.
+ */
+export declare function validateSearchBody(body: Record<string, unknown>): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare class ElasticsearchConnector extends BaseConnector {
+    readonly providerName = "elasticsearch";
+    protected cachedTokens: ElasticsearchTokens | null;
+    private client;
+    protected getOAuthConfig(): null;
+    authenticate(): Promise<AuthContext>;
+    /**
+     * Build (or return cached) ES client based on stored credentials.
+     * Auth precedence: cloudId+apiKey > node+apiKey > node+username+password.
+     */
+    private getClient;
+    disconnect(): Promise<void>;
+    healthCheck(): Promise<{
+        ok: boolean;
+        error?: ConnectorError;
+    }>;
+    normalizeError(error: unknown): ConnectorError;
+    getStatus(): ConnectorStatus;
+    listIndices(): Promise<unknown>;
+    describeIndex(index: string): Promise<{
+        mapping: unknown;
+        settings: unknown;
+    }>;
+    search(index: string, query: Record<string, unknown>, size?: number, from?: number, sort?: unknown, _source?: unknown): Promise<unknown>;
+    count(index: string, query?: Record<string, unknown>): Promise<unknown>;
+    aggregate(index: string, aggs: Record<string, unknown>, query?: Record<string, unknown>): Promise<unknown>;
+    clusterHealth(): Promise<unknown>;
+}
+export declare function getElasticsearchConnector(): ElasticsearchConnector;
+export declare function resetElasticsearchConnector(): Promise<void>;
+export { loadTokens as isConnected };
+export declare const __testing: {
+    ALLOWED_TOP_LEVEL_KEYS: Set<string>;
+    MAX_SIZE: number;
+    MAX_AGG_SIZE: number;
+};
+export interface ConnectorHandlerResult {
+    status: number;
+    body: string;
+    contentType?: string;
+}
+/**
+ * POST /connections/elasticsearch/connect
+ * Body: { cloudId?, node?, apiKey?, username?, password? }
+ * Validates credential combo + pings the cluster, then stores the tokens.
+ */
+export declare function handleElasticsearchConnect(body: string): Promise<ConnectorHandlerResult>;
+/**
+ * POST /connections/elasticsearch/test
+ * Verifies stored credentials with ping().
+ */
+export declare function handleElasticsearchTest(): Promise<ConnectorHandlerResult>;
+/**
+ * DELETE /connections/elasticsearch
+ */
+export declare function handleElasticsearchDisconnect(): Promise<ConnectorHandlerResult>;