specrails-desktop 2.3.0 → 2.4.0

package/server/dist/jira/jira-client.js

@@ -0,0 +1,279 @@
+"use strict";
+// Jira REST client. Single internal model rendered to the right dialect per
+// deployment: Cloud (REST v3, Basic auth, ADF bodies) vs Data Center/Server
+// (REST v2, Bearer PAT, plain wiki-string bodies). Every call returns a
+// normalised `JiraResult<T>` whose error `code` drives the outbox's
+// retry/dead-letter decisions. No throwing across the boundary.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JiraClient = void 0;
+exports.detectDeployment = detectDeployment;
+const jira_adf_1 = require("./jira-adf");
+function classify(status) {
+    if (status === 401)
+        return 'auth';
+    if (status === 403)
+        return 'permission';
+    if (status === 404)
+        return 'not_found';
+    if (status === 429)
+        return 'rate_limit';
+    if (status >= 400 && status < 500)
+        return 'validation';
+    return 'server';
+}
+class JiraClient {
+    cfg;
+    fetchImpl;
+    constructor(cfg) {
+        this.cfg = cfg;
+        // Node 18+ exposes a global fetch (undici); injectable for tests.
+        this.fetchImpl = cfg.fetchImpl ?? globalThis.fetch;
+    }
+    get deployment() {
+        return this.cfg.deployment;
+    }
+    authHeader() {
+        if (this.cfg.authScheme === 'bearer')
+            return `Bearer ${this.cfg.token}`;
+        const raw = `${this.cfg.accountEmail ?? ''}:${this.cfg.token}`;
+        return `Basic ${Buffer.from(raw, 'utf-8').toString('base64')}`;
+    }
+    url(path) {
+        const base = this.cfg.baseUrl.replace(/\/+$/, '');
+        return `${base}/rest/api/${this.cfg.apiVersion}${path}`;
+    }
+    /** Build a URL for a NON `/rest/api` endpoint (e.g. `/rest/dev-status/1.0/...`). */
+    urlRaw(restPath) {
+        return `${this.cfg.baseUrl.replace(/\/+$/, '')}${restPath}`;
+    }
+    /** REST v2/v3 request under `/rest/api/{version}`. */
+    request(method, path, body) {
+        return this.requestUrl(method, this.url(path), body);
+    }
+    /** Request to an absolute REST path (for APIs outside `/rest/api`). */
+    requestRaw(method, restPath, body) {
+        return this.requestUrl(method, this.urlRaw(restPath), body);
+    }
+    async requestUrl(method, fullUrl, body) {
+        const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;
+        const timeout = controller
+            ? setTimeout(() => controller.abort(), this.cfg.timeoutMs ?? 20000)
+            : null;
+        try {
+            const res = await this.fetchImpl(fullUrl, {
+                method,
+                headers: {
+                    Authorization: this.authHeader(),
+                    Accept: 'application/json',
+                    ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}),
+                },
+                ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+                ...(controller ? { signal: controller.signal } : {}),
+            });
+            if (res.ok) {
+                const text = await res.text();
+                const data = text ? JSON.parse(text) : undefined;
+                return { ok: true, data, status: res.status };
+            }
+            const errText = await res.text().catch(() => '');
+            const code = classify(res.status);
+            const retryAfter = res.headers.get('Retry-After');
+            const retryAfterMs = retryAfter ? parseRetryAfter(retryAfter) : undefined;
+            return { ok: false, status: res.status, code, error: truncate(errText), ...(retryAfterMs ? { retryAfterMs } : {}) };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return { ok: false, status: 0, code: 'network', error: msg };
+        }
+        finally {
+            if (timeout)
+                clearTimeout(timeout);
+        }
+    }
+    // ─── Connectivity / metadata ───────────────────────────────────────────────
+    /** GET /myself — validates the credential and identifies the account. */
+    myself() {
+        return this.request('GET', '/myself');
+    }
+    /** GET /project/{key} — validates the project and returns name/id for confirmation. */
+    getProject(keyOrId) {
+        return this.request('GET', `/project/${encodeURIComponent(keyOrId)}`);
+    }
+    /** GET /mypermissions — probe write capability so config-time warns the user. */
+    myPermissions(permissions, projectKey) {
+        const qp = new URLSearchParams({ permissions: permissions.join(',') });
+        if (projectKey)
+            qp.set('projectKey', projectKey);
+        return this.request('GET', `/mypermissions?${qp.toString()}`);
+    }
+    /** GET /project/{key}/statuses — the project's real status list per issue type. */
+    getProjectStatuses(keyOrId) {
+        return this.request('GET', `/project/${encodeURIComponent(keyOrId)}/statuses`);
+    }
+    /** GET /field — all fields; used to discover the sprint custom field id. */
+    getFields() {
+        return this.request('GET', '/field');
+    }
+    /**
+     * List projects the credential can see (for the setup wizard's project picker).
+     * Cloud: paginated GET /project/search. DC/Server: GET /project (full list).
+     */
+    async searchProjects(query) {
+        if (this.cfg.apiVersion === '2') {
+            const res = await this.request('GET', '/project');
+            if (!res.ok)
+                return res;
+            const filtered = query
+                ? res.data.filter((p) => `${p.key} ${p.name}`.toLowerCase().includes(query.toLowerCase()))
+                : res.data;
+            return { ok: true, data: filtered.slice(0, 50), status: res.status };
+        }
+        const qp = new URLSearchParams({ maxResults: '50' });
+        if (query)
+            qp.set('query', query);
+        const res = await this.request('GET', `/project/search?${qp.toString()}`);
+        if (!res.ok)
+            return res;
+        return { ok: true, data: res.data.values ?? [], status: res.status };
+    }
+    // ─── Search (inbound poll) ─────────────────────────────────────────────────
+    /**
+     * POST /search/jql — the current paginated search (legacy GET /search was
+     * removed Oct 2025). Always pass an explicit `fields` array; page via
+     * `nextPageToken`. On DC v2 this falls back to the classic /search.
+     */
+    searchJql(args) {
+        if (this.cfg.apiVersion === '2') {
+            // DC/Server: classic search with startAt/maxResults.
+            return this.request('POST', '/search', {
+                jql: args.jql,
+                fields: args.fields,
+                maxResults: args.maxResults ?? 100,
+                startAt: args.nextPageToken ? parseInt(args.nextPageToken, 10) || 0 : 0,
+            });
+        }
+        return this.request('POST', '/search/jql', {
+            jql: args.jql,
+            fields: args.fields,
+            maxResults: args.maxResults ?? 100,
+            ...(args.nextPageToken ? { nextPageToken: args.nextPageToken } : {}),
+            ...(args.reconcileIssues ? { reconcileIssues: args.reconcileIssues } : {}),
+        });
+    }
+    /** GET /issue/{idOrKey} — re-resolve by immutable id (key may have changed). */
+    getIssue(idOrKey, fields) {
+        const qp = fields ? `?fields=${encodeURIComponent(fields.join(','))}` : '';
+        return this.request('GET', `/issue/${encodeURIComponent(idOrKey)}${qp}`);
+    }
+    // ─── Lifecycle (outbound) ──────────────────────────────────────────────────
+    /** GET /issue/{id}/transitions?expand=transitions.fields — discover edges + screens. */
+    getTransitions(issueIdOrKey) {
+        return this.request('GET', `/issue/${encodeURIComponent(issueIdOrKey)}/transitions?expand=transitions.fields`);
+    }
+    /** POST /issue/{id}/transitions — apply a transition, optionally with fields. */
+    transitionIssue(issueIdOrKey, transitionId, fields) {
+        return this.request('POST', `/issue/${encodeURIComponent(issueIdOrKey)}/transitions`, {
+            transition: { id: transitionId },
+            ...(fields && Object.keys(fields).length > 0 ? { fields } : {}),
+        });
+    }
+    /** POST /issue — create an issue. Description rendered per deployment. */
+    createIssue(args) {
+        const fields = {
+            project: { key: args.projectKey },
+            issuetype: { name: args.issueType },
+            summary: args.summary.slice(0, 250),
+        };
+        if (args.description)
+            fields.description = (0, jira_adf_1.bodyForDeployment)(args.description, this.cfg.deployment);
+        if (args.labels && args.labels.length > 0)
+            fields.labels = args.labels;
+        if (args.priority)
+            fields.priority = { name: args.priority };
+        return this.request('POST', '/issue', { fields });
+    }
+    /**
+     * PUT /issue/{id} — update editable fields (summary/description/labels/
+     * priority) when a Jira-backed spec is edited locally. The `fields` object is
+     * already rendered for the deployment by the caller. 204 on success.
+     */
+    updateIssue(idOrKey, fields) {
+        return this.request('PUT', `/issue/${encodeURIComponent(idOrKey)}`, { fields });
+    }
+    /**
+     * POST /issue/{id}/comment — add a comment (ADF on Cloud, wiki on DC). The
+     * optional idempotency `marker` is stored as an INVISIBLE comment property
+     * (never in the body), so users never see it. Cloud + DC both accept the
+     * `properties` array on comment creation.
+     */
+    addComment(issueIdOrKey, text, marker) {
+        const payload = { body: (0, jira_adf_1.bodyForDeployment)(text, this.cfg.deployment) };
+        if (marker)
+            payload.properties = [{ key: jira_adf_1.SPECRAILS_COMMENT_PROP_KEY, value: { marker } }];
+        return this.request('POST', `/issue/${encodeURIComponent(issueIdOrKey)}/comment`, payload);
+    }
+    /**
+     * GET /issue/{id}/comment?expand=properties — used to dedup comments via the
+     * self-marker (invisible comment property, with a legacy body fallback).
+     */
+    getComments(issueIdOrKey) {
+        return this.request('GET', `/issue/${encodeURIComponent(issueIdOrKey)}/comment?expand=properties`);
+    }
+    // ─── Read-only details panel (issue fields + Development) ────────────────────
+    /** GET /issue/{id}?fields=*all — the full system + custom field map (untyped). */
+    getIssueRaw(idOrKey) {
+        return this.request('GET', `/issue/${encodeURIComponent(idOrKey)}?fields=*all`);
+    }
+    /** GET /field — full field metadata (name + schema) for the generic renderer. */
+    getFieldsFull() {
+        return this.request('GET', '/field');
+    }
+    /**
+     * GET /rest/dev-status/1.0/issue/summary?issueId=<numericId> — dev-panel counts
+     * + the connected applicationType(s). `issueId` MUST be the immutable numeric
+     * id (JiraLink.jiraIssueId), not the PROJ-123 key. No data => 200 zero counts.
+     */
+    getDevStatusSummary(issueId) {
+        return this.requestRaw('GET', `/rest/dev-status/1.0/issue/summary?issueId=${encodeURIComponent(issueId)}`);
+    }
+    /**
+     * GET /rest/dev-status/1.0/issue/detail — the actual PR/branch/repository
+     * records for one (applicationType, dataType). A wrong applicationType returns
+     * 200 with empty detail[]; derive it from getDevStatusSummary byInstanceType.
+     */
+    getDevStatusDetail(issueId, applicationType, dataType) {
+        const qp = new URLSearchParams({ issueId, applicationType, dataType });
+        return this.requestRaw('GET', `/rest/dev-status/1.0/issue/detail?${qp.toString()}`);
+    }
+}
+exports.JiraClient = JiraClient;
+function parseRetryAfter(value) {
+    const seconds = Number(value);
+    if (!Number.isNaN(seconds))
+        return Math.max(0, seconds * 1000);
+    const date = Date.parse(value);
+    if (!Number.isNaN(date))
+        return Math.max(0, date - Date.now());
+    return undefined;
+}
+function truncate(s, max = 500) {
+    return s.length > max ? `${s.slice(0, max)}…` : s;
+}
+/**
+ * Detect Cloud vs Data Center from the base URL host. `*.atlassian.net` ⇒ Cloud
+ * (v3, Basic, ADF); otherwise DC/Server (v2, Bearer, wiki). A `probe` caller can
+ * still override after hitting /myself, but the host heuristic is the default.
+ */
+function detectDeployment(baseUrl) {
+    let host = '';
+    try {
+        host = new URL(baseUrl).host.toLowerCase();
+    }
+    catch {
+        host = baseUrl.toLowerCase();
+    }
+    const isCloud = host.endsWith('.atlassian.net') || host.endsWith('.jira.com');
+    return isCloud
+        ? { deployment: 'cloud', apiVersion: '3', authScheme: 'basic' }
+        : { deployment: 'dc', apiVersion: '2', authScheme: 'bearer' };
+}

package/server/dist/jira/jira-credential-store.js

@@ -0,0 +1,103 @@
+"use strict";
+// Encrypted-at-rest credential store for Jira tokens.
+//
+// A Jira API token / PAT is a bearer credential with the user's full Jira
+// permissions, so it must not sit in plaintext SQLite (the webhook-HMAC bar).
+// v1: AES-256-GCM (node:crypto, no native plugin) under a per-install 0600
+// keyfile. v2 can swap the backend to a Tauri keychain/stronghold by replacing
+// `SecretStore` — every callsite goes through this single interface.
+//
+// The ciphertext lives in the per-project `jira_connection.encrypted_token`
+// column; the symmetric key lives once at `~/.specrails/jira-secret.key`.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyfileSecretStore = void 0;
+exports.defaultKeyfilePath = defaultKeyfilePath;
+exports.getOrCreateKey = getOrCreateKey;
+exports.getSecretStore = getSecretStore;
+exports.setSecretStore = setSecretStore;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+const ALGO = 'aes-256-gcm';
+const VERSION = 'v1';
+/** Resolve the keyfile path (override-able for tests). */
+function defaultKeyfilePath(homeDir = os_1.default.homedir()) {
+    return path_1.default.join(homeDir, '.specrails', 'jira-secret.key');
+}
+/**
+ * Load the 32-byte symmetric key, creating it (0600) on first use. The key is
+ * stored base64 in a single keyfile so the v2 keychain swap is one place.
+ */
+function getOrCreateKey(keyfilePath = defaultKeyfilePath()) {
+    try {
+        const raw = fs_1.default.readFileSync(keyfilePath, 'utf-8').trim();
+        const key = Buffer.from(raw, 'base64');
+        if (key.length === 32)
+            return key;
+    }
+    catch {
+        // Missing or corrupt — (re)create below.
+    }
+    const key = crypto_1.default.randomBytes(32);
+    const dir = path_1.default.dirname(keyfilePath);
+    fs_1.default.mkdirSync(dir, { recursive: true });
+    try {
+        fs_1.default.chmodSync(dir, 0o700);
+    }
+    catch {
+        /* best-effort (no-op on Windows) */
+    }
+    // Write 0600 atomically: write to a temp file then rename.
+    const tmp = `${keyfilePath}.tmp`;
+    fs_1.default.writeFileSync(tmp, key.toString('base64'), { mode: 0o600 });
+    fs_1.default.renameSync(tmp, keyfilePath);
+    try {
+        fs_1.default.chmodSync(keyfilePath, 0o600);
+    }
+    catch {
+        /* best-effort */
+    }
+    return key;
+}
+/** AES-256-GCM secret store backed by the keyfile. */
+class KeyfileSecretStore {
+    _key;
+    constructor(keyfilePath = defaultKeyfilePath()) {
+        this._key = getOrCreateKey(keyfilePath);
+    }
+    encrypt(plaintext) {
+        const iv = crypto_1.default.randomBytes(12);
+        const cipher = crypto_1.default.createCipheriv(ALGO, this._key, iv);
+        const ct = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return [VERSION, iv.toString('base64'), tag.toString('base64'), ct.toString('base64')].join(':');
+    }
+    decrypt(blob) {
+        const parts = blob.split(':');
+        if (parts.length !== 4 || parts[0] !== VERSION) {
+            throw new Error('jira-credential-store: malformed ciphertext');
+        }
+        const iv = Buffer.from(parts[1], 'base64');
+        const tag = Buffer.from(parts[2], 'base64');
+        const ct = Buffer.from(parts[3], 'base64');
+        const decipher = crypto_1.default.createDecipheriv(ALGO, this._key, iv);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(ct), decipher.final()]).toString('utf-8');
+    }
+}
+exports.KeyfileSecretStore = KeyfileSecretStore;
+/** Process-wide singleton (the keyfile is shared across all projects). */
+let _store = null;
+function getSecretStore() {
+    if (!_store)
+        _store = new KeyfileSecretStore();
+    return _store;
+}
+/** Test seam: inject a store (e.g. an in-memory one). */
+function setSecretStore(store) {
+    _store = store;
+}