thinkwork-cli 0.13.1 → 0.13.2

package/dist/terraform/modules/app/agentcore-identity/scripts/delete_twenty_identity.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${AWS_REGION:?AWS_REGION is required}"
+: "${TWENTY_CREDENTIAL_PROVIDER_NAME:?TWENTY_CREDENTIAL_PROVIDER_NAME is required}"
+
+if aws bedrock-agentcore-control get-oauth2-credential-provider \
+  --region "$AWS_REGION" \
+  --name "$TWENTY_CREDENTIAL_PROVIDER_NAME" >/dev/null 2>&1; then
+  aws bedrock-agentcore-control delete-oauth2-credential-provider \
+    --region "$AWS_REGION" \
+    --name "$TWENTY_CREDENTIAL_PROVIDER_NAME" >/dev/null
+fi
+
+printf 'AgentCore Twenty provider deleted: provider=%s\n' \
+  "$TWENTY_CREDENTIAL_PROVIDER_NAME"

package/dist/terraform/modules/app/agentcore-identity/scripts/read_identity.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+input="$(cat)"
+region="$(jq -r '.region // empty' <<<"$input")"
+workload_name="$(jq -r '.workload_identity_name // empty' <<<"$input")"
+provider_name="$(jq -r '.credential_provider_name // empty' <<<"$input")"
+twenty_provider_name="$(jq -r '.twenty_credential_provider_name // empty' <<<"$input")"
+if [[ -z "$region" || -z "$workload_name" || -z "$provider_name" || -z "$twenty_provider_name" ]]; then
+  printf '%s\n' '{"error":"region and identity names are required"}' >&2
+  exit 1
+fi
+
+workload_json="$(aws bedrock-agentcore-control get-workload-identity \
+  --region "$region" --name "$workload_name" --output json)"
+provider_json="$(aws bedrock-agentcore-control get-oauth2-credential-provider \
+  --region "$region" --name "$provider_name" --output json)"
+twenty_provider_json="$(aws bedrock-agentcore-control get-oauth2-credential-provider \
+  --region "$region" --name "$twenty_provider_name" --output json)"
+
+jq -n \
+  --arg workload_identity_arn "$(jq -r '.workloadIdentityArn // empty' <<<"$workload_json")" \
+  --arg credential_provider_arn "$(jq -r '.credentialProviderArn // empty' <<<"$provider_json")" \
+  --arg credential_secret_arn "$(jq -r '
+    if (.clientSecretArn | type) == "object"
+    then .clientSecretArn.secretArn // empty
+    else .clientSecretArn // empty
+    end
+  ' <<<"$provider_json")" \
+  --arg twenty_credential_provider_arn "$(jq -r '.credentialProviderArn // empty' <<<"$twenty_provider_json")" \
+  --arg twenty_oauth_callback_url "$(jq -r '.callbackUrl // empty' <<<"$twenty_provider_json")" \
+  'if ($workload_identity_arn == "" or $credential_provider_arn == "" or $credential_secret_arn == "" or $twenty_credential_provider_arn == "" or $twenty_oauth_callback_url == "")
+   then error("AgentCore Identity readback omitted required ARNs")
+   else {
+     workload_identity_arn: $workload_identity_arn,
+     credential_provider_arn: $credential_provider_arn,
+     credential_secret_arn: $credential_secret_arn,
+     twenty_credential_provider_arn: $twenty_credential_provider_arn,
+     twenty_oauth_callback_url: $twenty_oauth_callback_url
+   } end'

package/dist/terraform/modules/app/agentcore-identity/scripts/reconcile_identity.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${AWS_REGION:?AWS_REGION is required}"
+: "${WORKLOAD_IDENTITY_NAME:?WORKLOAD_IDENTITY_NAME is required}"
+: "${CREDENTIAL_PROVIDER_NAME:?CREDENTIAL_PROVIDER_NAME is required}"
+: "${OAUTH_ISSUER:?OAUTH_ISSUER is required}"
+: "${OAUTH_CLIENT_ID:?OAUTH_CLIENT_ID is required}"
+: "${OAUTH_CLIENT_SECRET:?OAUTH_CLIENT_SECRET is required}"
+: "${OAUTH_RETURN_URL:?OAUTH_RETURN_URL is required}"
+
+if aws bedrock-agentcore-control get-workload-identity \
+  --region "$AWS_REGION" \
+  --name "$WORKLOAD_IDENTITY_NAME" >/dev/null 2>&1; then
+  aws bedrock-agentcore-control update-workload-identity \
+    --region "$AWS_REGION" \
+    --name "$WORKLOAD_IDENTITY_NAME" \
+    --allowed-resource-oauth2-return-urls "$OAUTH_RETURN_URL" >/dev/null
+else
+  aws bedrock-agentcore-control create-workload-identity \
+    --region "$AWS_REGION" \
+    --name "$WORKLOAD_IDENTITY_NAME" \
+    --allowed-resource-oauth2-return-urls "$OAUTH_RETURN_URL" \
+    --tags '{"purpose":"think-316-proof","managed-by":"terraform"}' >/dev/null
+fi
+
+payload_file="$(mktemp)"
+trap 'rm -f "$payload_file"' EXIT
+jq -n \
+  --arg name "$CREDENTIAL_PROVIDER_NAME" \
+  --arg issuer "$OAUTH_ISSUER" \
+  --arg authorizationEndpoint "$OAUTH_ISSUER/authorize" \
+  --arg tokenEndpoint "$OAUTH_ISSUER/token" \
+  --arg clientId "$OAUTH_CLIENT_ID" \
+  --arg clientSecret "$OAUTH_CLIENT_SECRET" \
+  '{
+    name: $name,
+    credentialProviderVendor: "CustomOauth2",
+    oauth2ProviderConfigInput: {
+      customOauth2ProviderConfig: {
+        oauthDiscovery: {
+          authorizationServerMetadata: {
+            issuer: $issuer,
+            authorizationEndpoint: $authorizationEndpoint,
+            tokenEndpoint: $tokenEndpoint,
+            responseTypes: ["code"]
+          }
+        },
+        clientId: $clientId,
+        clientSecret: $clientSecret,
+        clientAuthenticationMethod: "CLIENT_SECRET_BASIC",
+        onBehalfOfTokenExchangeConfig: {
+          grantType: "TOKEN_EXCHANGE",
+          tokenExchangeGrantTypeConfig: {actorTokenContent: "NONE"}
+        }
+      }
+    }
+  }' >"$payload_file"
+
+if aws bedrock-agentcore-control get-oauth2-credential-provider \
+  --region "$AWS_REGION" \
+  --name "$CREDENTIAL_PROVIDER_NAME" >/dev/null 2>&1; then
+  aws bedrock-agentcore-control update-oauth2-credential-provider \
+    --region "$AWS_REGION" \
+    --cli-input-json "file://$payload_file" >/dev/null
+else
+  aws bedrock-agentcore-control create-oauth2-credential-provider \
+    --region "$AWS_REGION" \
+    --cli-input-json "file://$payload_file" >/dev/null
+fi
+
+printf 'AgentCore Identity proof resources reconciled: workload=%s provider=%s\n' \
+  "$WORKLOAD_IDENTITY_NAME" "$CREDENTIAL_PROVIDER_NAME"

package/dist/terraform/modules/app/agentcore-identity/scripts/reconcile_twenty_identity.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${AWS_REGION:?AWS_REGION is required}"
+: "${WORKLOAD_IDENTITY_NAME:?WORKLOAD_IDENTITY_NAME is required}"
+: "${OAUTH_RETURN_URLS_JSON:?OAUTH_RETURN_URLS_JSON is required}"
+: "${TWENTY_CREDENTIAL_PROVIDER_NAME:?TWENTY_CREDENTIAL_PROVIDER_NAME is required}"
+: "${TWENTY_CLIENT_SECRET_ARN:?TWENTY_CLIENT_SECRET_ARN is required}"
+: "${TWENTY_OAUTH_ISSUER:?TWENTY_OAUTH_ISSUER is required}"
+: "${TWENTY_OAUTH_RESOURCE:?TWENTY_OAUTH_RESOURCE is required}"
+
+jq -e 'type == "array" and length > 0 and all(.[]; type == "string" and length > 0)' \
+  <<<"$OAUTH_RETURN_URLS_JSON" >/dev/null
+
+# The core lifecycle owns this workload. Extend its allowlist in place; never
+# delete or recreate it while adding a downstream user-federation provider.
+aws bedrock-agentcore-control update-workload-identity \
+  --region "$AWS_REGION" \
+  --name "$WORKLOAD_IDENTITY_NAME" \
+  --allowed-resource-oauth2-return-urls "$OAUTH_RETURN_URLS_JSON" >/dev/null
+
+client_record="$(aws secretsmanager get-secret-value \
+  --region "$AWS_REGION" \
+  --secret-id "$TWENTY_CLIENT_SECRET_ARN" \
+  --query SecretString \
+  --output text 2>/dev/null || true)"
+if [[ -z "$client_record" ]]; then
+  client_record='{}'
+fi
+client_id="$(jq -r '.client_id // empty' <<<"$client_record")"
+if [[ -z "$client_id" ]] ||
+  ! jq -e '.client_secret | type == "string" and length > 0' \
+    <<<"$client_record" >/dev/null 2>&1; then
+  printf '%s\n' \
+    'Twenty confidential client is not bootstrapped; run bootstrap_twenty_oauth_client.sh with an authenticated administrator token secret' >&2
+  exit 1
+fi
+
+provider_payload="$(jq -n \
+  --arg region "$AWS_REGION" \
+  --arg name "$TWENTY_CREDENTIAL_PROVIDER_NAME" \
+  --arg issuer "$TWENTY_OAUTH_ISSUER" \
+  --arg authorizationEndpoint "${TWENTY_OAUTH_ISSUER%/}/authorize" \
+  --arg tokenEndpoint "${TWENTY_OAUTH_ISSUER%/}/oauth/token" \
+  --arg clientId "$client_id" \
+  --arg secretArn "$TWENTY_CLIENT_SECRET_ARN" \
+  '{
+    region: $region,
+    name: $name,
+    issuer: $issuer,
+    authorizationEndpoint: $authorizationEndpoint,
+    tokenEndpoint: $tokenEndpoint,
+    clientId: $clientId,
+    secretArn: $secretArn
+  }')"
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+provider_response="$(printf '%s' "$provider_payload" | \
+  node "$script_dir/reconcile_twenty_provider.mjs")"
+callback_url="$(jq -r '.callbackUrl // empty' <<<"$provider_response")"
+if [[ -z "$callback_url" || "$callback_url" == "None" ]]; then
+  printf '%s\n' 'AgentCore Identity did not return the Twenty callback URL' >&2
+  exit 1
+fi
+
+registered_callback="$(jq -r '.redirect_uris[0] // empty' <<<"$client_record")"
+if [[ "$registered_callback" != "$callback_url" ]]; then
+  printf 'Twenty callback mismatch: registered=%s agentcore=%s\n' \
+    "$registered_callback" "$callback_url" >&2
+  exit 1
+fi
+
+printf 'AgentCore Twenty provider reconciled: workload=%s provider=%s resource=%s\n' \
+  "$WORKLOAD_IDENTITY_NAME" "$TWENTY_CREDENTIAL_PROVIDER_NAME" "$TWENTY_OAUTH_RESOURCE"

package/dist/terraform/modules/app/agentcore-identity/scripts/reconcile_twenty_provider.mjs

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+
+import {
+  BedrockAgentCoreControlClient,
+  CreateOauth2CredentialProviderCommand,
+  GetOauth2CredentialProviderCommand,
+  ResourceNotFoundException,
+  UpdateOauth2CredentialProviderCommand,
+} from "@aws-sdk/client-bedrock-agentcore-control";
+
+const chunks = [];
+for await (const chunk of process.stdin) chunks.push(chunk);
+const input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+
+const client = new BedrockAgentCoreControlClient({ region: input.region });
+const providerInput = {
+  name: input.name,
+  credentialProviderVendor: "CustomOauth2",
+  oauth2ProviderConfigInput: {
+    customOauth2ProviderConfig: {
+      oauthDiscovery: {
+        authorizationServerMetadata: {
+          issuer: input.issuer,
+          authorizationEndpoint: input.authorizationEndpoint,
+          tokenEndpoint: input.tokenEndpoint,
+          responseTypes: ["code"],
+        },
+      },
+      clientId: input.clientId,
+      clientSecretConfig: {
+        secretId: input.secretArn,
+        jsonKey: "client_secret",
+      },
+      clientSecretSource: "EXTERNAL",
+      clientAuthenticationMethod: "CLIENT_SECRET_POST",
+    },
+  },
+};
+
+let exists = false;
+try {
+  await client.send(
+    new GetOauth2CredentialProviderCommand({ name: input.name }),
+  );
+  exists = true;
+} catch (error) {
+  if (!(error instanceof ResourceNotFoundException)) throw error;
+}
+
+const response = exists
+  ? await client.send(new UpdateOauth2CredentialProviderCommand(providerInput))
+  : await client.send(new CreateOauth2CredentialProviderCommand(providerInput));
+
+process.stdout.write(
+  JSON.stringify({
+    name: response.name,
+    callbackUrl: response.callbackUrl,
+    credentialProviderArn: response.credentialProviderArn,
+    clientSecretSource: response.clientSecretSource,
+  }),
+);

package/dist/terraform/modules/app/agentcore-identity/variables.tf

@@ -0,0 +1,54 @@
+variable "enabled" {
+  description = "Reconcile the non-production THINK-316 Identity proof resources."
+  type        = bool
+  default     = false
+}
+
+variable "stage" {
+  description = "Deployment stage."
+  type        = string
+}
+
+variable "region" {
+  description = "AWS region."
+  type        = string
+}
+
+variable "account_id" {
+  description = "AWS account id used to scope the external OAuth client-secret policy."
+  type        = string
+}
+
+variable "oauth_issuer" {
+  description = "Synthetic provider issuer URL exposed through the owned HTTP API."
+  type        = string
+}
+
+variable "oauth_client_id" {
+  description = "Synthetic OAuth client id."
+  type        = string
+}
+
+variable "oauth_client_secret" {
+  description = "Synthetic OAuth client secret; passed to the reconciler through its environment only."
+  type        = string
+  sensitive   = true
+}
+
+variable "user_federation_return_urls" {
+  description = "Exact ThinkWork callbacks AgentCore may redirect to after user-federation authorization."
+  type        = list(string)
+  default     = []
+}
+
+variable "twenty_oauth_issuer" {
+  description = "Twenty OAuth authorization-server issuer."
+  type        = string
+  default     = "https://crm.thinkwork.ai"
+}
+
+variable "twenty_oauth_resource" {
+  description = "RFC 8707 resource identifier requested for the Twenty MCP server."
+  type        = string
+  default     = "https://crm.thinkwork.ai/mcp"
+}

package/dist/terraform/modules/app/appsync-subscriptions/main.tf

@@ -18,21 +18,19 @@
 
 resource "aws_appsync_graphql_api" "subscriptions" {
   name                = "thinkwork-${var.stage}-subscriptions"
-  authentication_type = "API_KEY"
+  authentication_type = "AWS_LAMBDA"
   xray_enabled        = false
 
   schema = var.subscription_schema
 
-  additional_authentication_provider {
-    authentication_type = "AWS_IAM"
+  lambda_authorizer_config {
+    authorizer_uri                   = "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-appsync-subscription-authorizer"
+    authorizer_result_ttl_in_seconds = 0
+    identity_validation_expression   = "^twsub1_[A-Za-z0-9_-]+$"
   }
 
   additional_authentication_provider {
-    authentication_type = "AMAZON_COGNITO_USER_POOLS"
-
-    user_pool_config {
-      user_pool_id = var.user_pool_id
-    }
+    authentication_type = "AWS_IAM"
   }
 
   tags = {
@@ -40,19 +38,6 @@ resource "aws_appsync_graphql_api" "subscriptions" {
   }
 }
 
-################################################################################
-# API Key — 365 day expiry
-################################################################################
-
-resource "aws_appsync_api_key" "main" {
-  api_id  = aws_appsync_graphql_api.subscriptions.id
-  expires = timeadd(timestamp(), "8760h")
-
-  lifecycle {
-    ignore_changes = [expires]
-  }
-}
-
 ################################################################################
 # NONE Data Source (passthrough for notification mutations)
 ################################################################################
@@ -84,6 +69,20 @@ locals {
     "notifyEvalRunUpdate",
     "notifyWorkspaceAccessRevoked",
   ]
+  subscription_scopes = {
+    onAgentStatusChanged     = { argument = "tenantId", kind = "tenant" }
+    onNewMessage             = { argument = "threadId", kind = "thread" }
+    onHeartbeatActivity      = { argument = "tenantId", kind = "tenant" }
+    onThreadUpdated          = { argument = "tenantId", kind = "tenant" }
+    onThreadActivity         = { argument = "userId", kind = "user" }
+    onInboxItemStatusChanged = { argument = "tenantId", kind = "tenant" }
+    onThreadTurnUpdated      = { argument = "tenantId", kind = "tenant" }
+    onThreadTurnStep         = { argument = "threadId", kind = "thread" }
+    onOrgUpdated             = { argument = "tenantId", kind = "tenant" }
+    onCostRecorded           = { argument = "tenantId", kind = "tenant" }
+    onEvalRunUpdated         = { argument = "tenantId", kind = "tenant" }
+    onWorkspaceAccessRevoked = { argument = "userId", kind = "user" }
+  }
 }
 
 resource "aws_appsync_resolver" "notifications" {
@@ -113,6 +112,113 @@ resource "aws_appsync_resolver" "notifications" {
   EOF
 }
 
+################################################################################
+# Subscription registration filters + active-connection invalidation
+################################################################################
+
+resource "aws_appsync_resolver" "subscription_admission" {
+  for_each = local.subscription_scopes
+
+  api_id      = aws_appsync_graphql_api.subscriptions.id
+  type        = "Subscription"
+  field       = each.key
+  data_source = aws_appsync_datasource.none.name
+
+  runtime {
+    name            = "APPSYNC_JS"
+    runtime_version = "1.0.0"
+  }
+
+  code = <<-JS
+    import { util, extensions } from '@aws-appsync/utils';
+
+    export function request() {
+      return { payload: null };
+    }
+
+    export function response(ctx) {
+      const identity = (ctx.identity && ctx.identity.resolverContext) || {};
+      const tenantId = identity.tenantId;
+      const userId = identity.stableUserId;
+      const resourceKind = identity.resourceKind;
+      const resourceId = identity.resourceId;
+      if (!tenantId || !userId || !resourceKind || !resourceId) {
+        util.unauthorized();
+      }
+
+      extensions.setSubscriptionFilter(util.transform.toSubscriptionFilter({
+        ${each.value.argument}: { eq: ctx.args.${each.value.argument} },
+      }));
+      extensions.setSubscriptionInvalidationFilter({
+        filterGroup: [
+          { filters: [
+            { fieldName: 'scope', operator: 'eq', value: 'tenant' },
+            { fieldName: 'tenantId', operator: 'eq', value: tenantId },
+          ]},
+          { filters: [
+            { fieldName: 'scope', operator: 'eq', value: 'user' },
+            { fieldName: 'tenantId', operator: 'eq', value: tenantId },
+            { fieldName: 'userId', operator: 'eq', value: userId },
+          ]},
+          { filters: [
+            { fieldName: 'scope', operator: 'eq', value: 'resource' },
+            { fieldName: 'tenantId', operator: 'eq', value: tenantId },
+            { fieldName: 'userId', operator: 'eq', value: userId },
+            { fieldName: 'resourceKind', operator: 'eq', value: resourceKind },
+            { fieldName: 'resourceId', operator: 'eq', value: resourceId },
+          ]},
+        ],
+      });
+      return null;
+    }
+  JS
+}
+
+resource "aws_appsync_resolver" "subscription_invalidation" {
+  api_id      = aws_appsync_graphql_api.subscriptions.id
+  type        = "Mutation"
+  field       = "invalidateSubscription"
+  data_source = aws_appsync_datasource.none.name
+
+  runtime {
+    name            = "APPSYNC_JS"
+    runtime_version = "1.0.0"
+  }
+
+  code = <<-JS
+    import { util, extensions } from '@aws-appsync/utils';
+
+    const fields = {
+      ON_AGENT_STATUS_CHANGED: 'onAgentStatusChanged',
+      ON_NEW_MESSAGE: 'onNewMessage',
+      ON_HEARTBEAT_ACTIVITY: 'onHeartbeatActivity',
+      ON_THREAD_UPDATED: 'onThreadUpdated',
+      ON_THREAD_ACTIVITY: 'onThreadActivity',
+      ON_INBOX_ITEM_STATUS_CHANGED: 'onInboxItemStatusChanged',
+      ON_THREAD_TURN_UPDATED: 'onThreadTurnUpdated',
+      ON_THREAD_TURN_STEP: 'onThreadTurnStep',
+      ON_ORG_UPDATED: 'onOrgUpdated',
+      ON_COST_RECORDED: 'onCostRecorded',
+      ON_EVAL_RUN_UPDATED: 'onEvalRunUpdated',
+      ON_WORKSPACE_ACCESS_REVOKED: 'onWorkspaceAccessRevoked',
+    };
+
+    export function request(ctx) {
+      return { payload: { ...ctx.args, subscriptionField: fields[ctx.args.subscriptionField] } };
+    }
+
+    export function response(ctx) {
+      const payload = ctx.result;
+      if (!payload.subscriptionField) util.error('Invalid subscription field');
+      extensions.invalidateSubscriptions({
+        subscriptionField: payload.subscriptionField,
+        payload,
+      });
+      return payload;
+    }
+  JS
+}
+
 ################################################################################
 # Custom Domain (optional)
 ################################################################################

package/dist/terraform/modules/app/appsync-subscriptions/outputs.tf

@@ -17,9 +17,3 @@ output "graphql_realtime_url" {
   description = "AppSync realtime WebSocket URL (used by frontend subscription clients)"
   value       = aws_appsync_graphql_api.subscriptions.uris["REALTIME"]
 }
-
-output "graphql_api_key" {
-  description = "AppSync API key"
-  value       = aws_appsync_api_key.main.key
-  sensitive   = true
-}

package/dist/terraform/modules/app/appsync-subscriptions/variables.tf

@@ -8,6 +8,11 @@ variable "region" {
   type        = string
 }
 
+variable "account_id" {
+  description = "AWS account ID hosting the AppSync authorizer Lambda"
+  type        = string
+}
+
 variable "user_pool_id" {
   description = "Cognito user pool ID for authentication"
   type        = string