web-comments 1.0.1 → 1.0.2

package/dist/connectors/linear.js

@@ -1,47 +1,76 @@
 import "../chunks/chunk-WSFCRVEQ.js";
 
+// src/connectors/linear/icon.ts
+var icon = "data:image/svg+xml;base64,PHN2ZyB2aWV3Qm94PSIwIDAgMjQgMjQiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHBhdGggZD0iTTIuODg2IDQuMThBMTEuOTgyIDExLjk4MiAwIDAgMSAxMS45OSAwQzE4LjYyNCAwIDI0IDUuMzc2IDI0IDEyLjAwOWMwIDMuNjQtMS42MiA2LjkwMy00LjE4IDkuMTA1TDIuODg3IDQuMThaTTEuODE3IDUuNjI2bDE2LjU1NiAxNi41NTZjLS41MjQuMzMtMS4wNzUuNjItMS42NS44NjZMLjk1MSA3LjI3N2MuMjQ3LS41NzUuNTM3LTEuMTI2Ljg2Ni0xLjY1Wk0uMzIyIDkuMTYzbDE0LjUxNSAxNC41MTVjLS43MS4xNzItMS40NDMuMjgyLTIuMTk1LjMyMkwwIDExLjM1OGExMiAxMiAwIDAgMSAuMzIyLTIuMTk1Wm0tLjE3IDQuODYyIDkuODIzIDkuODI0YTEyLjAyIDEyLjAyIDAgMCAxLTkuODI0LTkuODI0WiIvPjwvc3ZnPg==";
+
 // src/connectors/linear/index.ts
 var API = "https://api.linear.app/graphql";
 var TOKEN_URL = "https://api.linear.app/oauth/token";
+var REVOKE_URL = "https://api.linear.app/oauth/revoke";
+var AUTHORIZE_URL = "https://linear.app/oauth/authorize";
 var DAY = 24 * 60 * 60;
 var MAX_REPLY = 1e4;
 function linear(options) {
   const optionsFor = (env) => typeof options === "function" ? options(env) : options;
+  const notFound = () => Response.json({ error: "not_found" }, { status: 404 });
   return {
     name: "linear",
     async onEvent(event, context) {
       const settings = optionsFor(context.env);
-      if (settings) await mirror(event, context, settings, client(context, settings));
+      if (!settings) return;
+      await remember(context, event.actor);
+      await mirror(event, context, settings);
     },
     async fetch(request, context) {
-      const { pathname } = new URL(request.url);
       const settings = optionsFor(context.env);
-      if (!settings || pathname !== `${new URL(context.url).pathname}/webhook`) {
-        return Response.json({ error: "not_found" }, { status: 404 });
+      if (!settings) return notFound();
+      const path = new URL(request.url).pathname.slice(new URL(context.url).pathname.length);
+      if (path === "/webhook") {
+        if (request.method !== "POST") {
+          return new Response(null, { status: 405, headers: { allow: "POST" } });
+        }
+        return webhook(request, context, settings);
+      }
+      if (path === "/connect" && request.method === "GET") {
+        return connect(request, context, settings);
+      }
+      if (path === "/callback" && request.method === "GET") {
+        return callback(request, context, settings);
       }
-      if (request.method !== "POST")
-        return new Response(null, { status: 405, headers: { allow: "POST" } });
-      return webhook(request, context, settings);
+      return notFound();
+    },
+    async panel(who, context) {
+      const settings = optionsFor(context.env);
+      return settings ? panelFor(who, context, settings) : null;
+    },
+    async action(action, who, _input, context) {
+      const settings = optionsFor(context.env);
+      if (settings && action === "disconnect") await disconnect(who, context);
     }
   };
 }
-function client(context, options) {
+var LinearAuthError = class extends Error {
+};
+function client(context, options, person) {
   const url = options.apiUrl ?? API;
   return async function call(query, variables = {}, retried = false) {
     const response = await fetch(url, {
       method: "POST",
       headers: {
         "content-type": "application/json",
-        authorization: await authorization(context, options, retried)
+        authorization: person ? `Bearer ${await personToken(context, options, person)}` : await authorization(context, options, retried)
       },
       body: JSON.stringify({ query, variables })
     });
-    if (response.status === 401 && "clientId" in options.auth && !retried) {
-      return call(
-        query,
-        variables,
-        true
-      );
+    if (response.status === 401) {
+      if (person) throw new LinearAuthError("Linear: the person's token was refused");
+      if ("clientId" in options.auth && !retried) {
+        return call(
+          query,
+          variables,
+          true
+        );
+      }
     }
     const body = await response.json().catch(() => null);
     if (!response.ok || !body?.data || body.errors?.length) {
@@ -57,24 +86,31 @@ async function authorization(context, options, fresh) {
   if ("accessToken" in auth) return `Bearer ${auth.accessToken}`;
   const cached = fresh ? null : await context.storage.get("app-token");
   if (cached) return `Bearer ${cached}`;
+  const body = await tokenRequest(options, {
+    grant_type: "client_credentials",
+    scope: "read,write,issues:create,comments:create"
+  });
+  if (!body?.access_token) throw new Error("Linear: couldn't get an app token");
+  const ttl = Math.max(60, (body.expires_in ?? 30 * DAY) - DAY);
+  await context.storage.set("app-token", body.access_token, { ttlSeconds: ttl });
+  return `Bearer ${body.access_token}`;
+}
+async function tokenRequest(options, params) {
+  const app = oauthApp(options);
+  if (!app) return null;
   const response = await fetch(TOKEN_URL, {
     method: "POST",
     headers: {
       "content-type": "application/x-www-form-urlencoded",
-      authorization: `Basic ${btoa(`${auth.clientId}:${auth.clientSecret}`)}`
+      authorization: `Basic ${btoa(`${app.clientId}:${app.clientSecret}`)}`
     },
-    body: new URLSearchParams({
-      grant_type: "client_credentials",
-      scope: "read,write,issues:create,comments:create"
-    })
+    body: new URLSearchParams(params)
   });
   const body = await response.json().catch(() => null);
-  if (!response.ok || !body?.access_token) {
-    throw new Error(`Linear: couldn't get an app token (HTTP ${response.status})`);
-  }
-  const ttl = Math.max(60, (body.expires_in ?? 30 * DAY) - DAY);
-  await context.storage.set("app-token", body.access_token, { ttlSeconds: ttl });
-  return `Bearer ${body.access_token}`;
+  return response.ok ? body : null;
+}
+function oauthApp(options) {
+  return "clientId" in options.auth ? options.auth : null;
 }
 var actsAsApp = (options) => "clientId" in options.auth;
 async function teamOf(context, options, call) {
@@ -126,30 +162,272 @@ async function upload(context, call, thread, kind) {
     return null;
   }
 }
+async function readJson(context, key) {
+  const value = await context.storage.get(key);
+  return value === null ? null : JSON.parse(value);
+}
+var personKey = (identityId) => `person:${identityId}`;
+var byLinearKey = (linearId) => `by-linear:${linearId}`;
+var byEmailKey = (email) => `by-email:${email.toLowerCase()}`;
+async function personToken(context, options, person) {
+  if (!person.expiresAt || person.expiresAt > Date.now() + 6e4 || !person.refreshToken) {
+    return person.accessToken;
+  }
+  const body = await tokenRequest(options, {
+    grant_type: "refresh_token",
+    refresh_token: person.refreshToken
+  });
+  if (!body?.access_token) throw new LinearAuthError("Linear: couldn't refresh the person's token");
+  person.accessToken = body.access_token;
+  person.refreshToken = body.refresh_token ?? person.refreshToken;
+  person.expiresAt = body.expires_in ? Date.now() + body.expires_in * 1e3 : null;
+  const identity = await readJson(context, byLinearKey(person.linearId));
+  if (identity) await context.storage.set(personKey(identity.id), JSON.stringify(person));
+  return person.accessToken;
+}
+async function remember(context, actor) {
+  if (actor.kind !== "human" || !actor.email) return;
+  const key = byEmailKey(actor.email);
+  const value = JSON.stringify({
+    id: actor.id,
+    name: actor.name,
+    kind: actor.kind,
+    email: actor.email,
+    ...actor.avatarUrl ? { avatarUrl: actor.avatarUrl } : {}
+  });
+  if (await context.storage.get(key) !== value) await context.storage.set(key, value);
+}
+async function linearUserByEmail(context, options, email) {
+  if (!email) return null;
+  const key = `email-user:${email.toLowerCase()}`;
+  const cached = await context.storage.get(key);
+  if (cached) return cached === "none" ? null : JSON.parse(cached);
+  const { users } = await client(context, options)(
+    `query($email: String!) { users(filter: { email: { eqIgnoreCase: $email } }) { nodes { id name } } }`,
+    { email }
+  );
+  const user = users.nodes[0] ?? null;
+  await context.storage.set(key, user ? JSON.stringify(user) : "none", { ttlSeconds: DAY });
+  return user;
+}
+async function personFor(context, actor) {
+  if (actor?.id) {
+    const connected = await readJson(context, byLinearKey(actor.id));
+    if (connected) return connected;
+  }
+  if (actor?.email) {
+    const known = await readJson(context, byEmailKey(actor.email));
+    if (known) return known;
+  }
+  return {
+    id: `linear:${actor?.id ?? "unknown"}`,
+    name: actor?.name ?? "Someone in Linear",
+    kind: actor?.type === "user" || actor?.type === void 0 ? "human" : "agent",
+    ...actor?.avatarUrl ? { avatarUrl: actor.avatarUrl } : {}
+  };
+}
+async function asActor(context, options, actor, work) {
+  const person = await readJson(context, personKey(actor.id));
+  if (person) {
+    try {
+      return await work(client(context, options, person), true);
+    } catch (error) {
+      if (!(error instanceof LinearAuthError)) throw error;
+      await forget(context, actor.id, person);
+    }
+  }
+  return work(client(context, options), false);
+}
+async function forget(context, identityId, person) {
+  await context.storage.delete(personKey(identityId));
+  await context.storage.delete(byLinearKey(person.linearId));
+}
+function escapeHtml(value) {
+  return value.replace(
+    /[&<>"']/g,
+    (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[char]
+  );
+}
+function message(status, title, text) {
+  return new Response(
+    `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(title)}</title><body style="font: 15px/1.5 system-ui, sans-serif; max-width: 420px; margin: 15vh auto; padding: 0 24px; color-scheme: light dark"><h1 style="font-size: 22px">${escapeHtml(title)}</h1><p>${escapeHtml(text)}</p></body>`,
+    {
+      status,
+      headers: {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store",
+        "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'"
+      }
+    }
+  );
+}
+function backTo(request, candidate) {
+  const origin = new URL(request.url).origin;
+  try {
+    const url = new URL(candidate ?? "/", origin);
+    return url.origin === origin ? url.href : `${origin}/`;
+  } catch {
+    return `${origin}/`;
+  }
+}
+async function connect(request, context, options) {
+  const app = oauthApp(options);
+  if (!app) return message(404, "Not set up", "Linear accounts can't be connected here.");
+  const who = await context.identify(request);
+  if (!who) {
+    if (await context.signedIn(request)) {
+      return message(403, "Not allowed", "You may not use comments here.");
+    }
+    const login = context.loginUrl(request);
+    if (login) return Response.redirect(new URL(login, request.url).href, 302);
+    return message(401, "Sign in first", "Sign in, then come back to connect Linear.");
+  }
+  const state = crypto.randomUUID();
+  const back = backTo(request, new URL(request.url).searchParams.get("return"));
+  await context.storage.set(`connect:${state}`, JSON.stringify({ identity: who, back }), {
+    ttlSeconds: 600
+  });
+  const authorize = new URL(AUTHORIZE_URL);
+  authorize.search = new URLSearchParams({
+    client_id: app.clientId,
+    redirect_uri: `${context.url}/callback`,
+    response_type: "code",
+    scope: "read,write",
+    state,
+    actor: "user",
+    prompt: "consent"
+  }).toString();
+  return Response.redirect(authorize.href, 302);
+}
+async function callback(request, context, options) {
+  const params = new URL(request.url).searchParams;
+  const state = params.get("state") ?? "";
+  const pending = state ? await readJson(context, `connect:${state}`) : null;
+  if (!pending) return message(400, "This link expired", "Go back and connect Linear again.");
+  await context.storage.delete(`connect:${state}`);
+  const who = await context.identify(request);
+  if (!who || who.id !== pending.identity.id) {
+    return message(403, "Signed in as someone else", "Go back and connect Linear again.");
+  }
+  const code = params.get("code");
+  if (!code) return Response.redirect(pending.back, 302);
+  const tokens = await tokenRequest(options, {
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: `${context.url}/callback`
+  });
+  if (!tokens?.access_token) {
+    return message(502, "Linear didn't finish", "Linear turned the connection down. Try again.");
+  }
+  const person = {
+    linearId: "",
+    name: "",
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token ?? null,
+    expiresAt: tokens.expires_in ? Date.now() + tokens.expires_in * 1e3 : null
+  };
+  const { viewer } = await client(
+    context,
+    options,
+    person
+  )("query { viewer { id name } }");
+  person.linearId = viewer.id;
+  person.name = viewer.name;
+  const previous = await readJson(context, byLinearKey(viewer.id));
+  if (previous && previous.id !== who.id) await context.storage.delete(personKey(previous.id));
+  await context.storage.set(personKey(who.id), JSON.stringify(person));
+  await context.storage.set(byLinearKey(viewer.id), JSON.stringify(who));
+  return Response.redirect(pending.back, 302);
+}
+async function disconnect(who, context) {
+  const person = await readJson(context, personKey(who.id));
+  if (!person) return;
+  await forget(context, who.id, person);
+  await fetch(REVOKE_URL, {
+    method: "POST",
+    headers: { authorization: `Bearer ${person.accessToken}` }
+  }).catch(() => void 0);
+}
+async function panelFor(who, context, options) {
+  const person = await readJson(context, personKey(who.id));
+  const blocks = [];
+  let attention = false;
+  if (person) {
+    blocks.push(
+      {
+        type: "status",
+        label: `Connected as ${person.name}`,
+        tone: "positive",
+        description: "What you do here (comments, replies, resolving) shows up in Linear as you."
+      },
+      {
+        type: "button",
+        label: "Disconnect",
+        action: "disconnect",
+        variant: "secondary",
+        confirm: "Disconnect your Linear account? What you do here will reach Linear under the app's name again."
+      }
+    );
+  } else {
+    const match = await linearUserByEmail(context, options, who.email).catch(() => null);
+    if (match) {
+      blocks.push({
+        type: "status",
+        label: `Matched by email: ${match.name}`,
+        tone: "neutral",
+        description: "You're subscribed to the issues you open, and your replies in Linear come back here as you. Connect your account to post in Linear as yourself too."
+      });
+    } else {
+      attention = true;
+      blocks.push({
+        type: "status",
+        label: "Not connected",
+        tone: "notice",
+        description: "Linear doesn't know your email, so what you do here reaches it under the app's name, and your replies there come back as someone else. Connect your Linear account to fix both."
+      });
+    }
+    if (oauthApp(options)) {
+      blocks.push({
+        type: "link",
+        label: "Connect Linear",
+        href: `${context.basePath}/linear/connect`,
+        returnTo: true,
+        variant: match ? "secondary" : "accent"
+      });
+    }
+  }
+  blocks.push({
+    type: "text",
+    text: `New comment threads become issues in ${options.team}. Replies go both ways, and resolving a thread completes its issue.`
+  });
+  return { title: "Linear", icon, attention, blocks };
+}
 function titleOf(body) {
   const line = body.split("\n").find((l) => l.trim())?.trim() ?? "Comment";
   if (line.length <= 80) return line;
   const cut = line.slice(0, 79);
   return `${cut.slice(0, Math.max(cut.lastIndexOf(" "), 60))}\u2026`;
 }
-function byline(comment) {
-  return `\u2014 ${comment.author.name}`;
-}
-function as(options, comment) {
-  if (!actsAsApp(options)) return {};
+function attribution(options, comment, asThemselves) {
+  if (asThemselves || !actsAsApp(options)) return {};
   return {
     createAsUser: comment.author.name,
     ...comment.author.avatarUrl?.startsWith("https://") ? { displayIconUrl: comment.author.avatarUrl } : {}
   };
 }
-async function describe(context, call, thread, options) {
+function signed(options, comment, asThemselves) {
+  return asThemselves || actsAsApp(options) ? comment.body : `${comment.body}
+
+\u2014 ${comment.author.name}`;
+}
+async function describe(context, call, thread, options, asThemselves) {
   const first = thread.comments[0];
   const { anchor } = thread;
-  const where = thread.context?.page.title || thread.url;
+  const where = `[${thread.context?.page.title || thread.url}](${context.threadUrl(thread)})`;
   const lines = [
-    first.body,
+    signed(options, first, asThemselves),
     "",
-    actsAsApp(options) ? `On [${where}](${context.threadUrl(thread)})` : `${byline(first)}, on [${where}](${context.threadUrl(thread)})`,
+    `On ${where}`,
     "",
     `**Element** \`<${anchor.tag}>\` \`${anchor.selector.replace(/`/g, "'")}\`${anchor.text ? ` \u201C${anchor.text}\u201D` : ""}`
   ];
@@ -161,32 +439,36 @@ async function describe(context, call, thread, options) {
   if (page) lines.push("", `![The page](${page})`);
   return lines.join("\n");
 }
-async function mirror(event, context, options, call) {
+async function mirror(event, context, options) {
   switch (event.type) {
     case "thread.created": {
       const { thread } = event;
       if (options.filter && !options.filter(thread)) return;
-      const team = await teamOf(context, options, call);
       const first = thread.comments[0];
-      const { issueCreate } = await call(
-        `mutation($input: IssueCreateInput!) { issueCreate(input: $input) { issue { id identifier url } } }`,
-        {
-          input: {
-            teamId: team.id,
-            title: titleOf(first.body),
-            description: await describe(context, call, thread, options),
-            ...options.labelIds?.length ? { labelIds: options.labelIds } : {},
-            ...options.projectId ? { projectId: options.projectId } : {},
-            ...as(options, first)
+      await asActor(context, options, event.actor, async (call, asThemselves) => {
+        const team = await teamOf(context, options, call);
+        const follower = asThemselves ? null : await linearUserByEmail(context, options, event.actor.email).catch(() => null);
+        const { issueCreate } = await call(
+          `mutation($input: IssueCreateInput!) { issueCreate(input: $input) { issue { id identifier url } } }`,
+          {
+            input: {
+              teamId: team.id,
+              title: titleOf(first.body),
+              description: await describe(context, call, thread, options, asThemselves),
+              ...options.labelIds?.length ? { labelIds: options.labelIds } : {},
+              ...options.projectId ? { projectId: options.projectId } : {},
+              ...follower ? { subscriberIds: [follower.id] } : {},
+              ...attribution(options, first, asThemselves)
+            }
           }
-        }
-      );
-      const { issue } = issueCreate;
-      await context.links.save({
-        externalId: issue.id,
-        threadId: thread.id,
-        url: issue.url,
-        title: issue.identifier
+        );
+        const { issue } = issueCreate;
+        await context.links.save({
+          externalId: issue.id,
+          threadId: thread.id,
+          url: issue.url,
+          title: issue.identifier
+        });
       });
       return;
     }
@@ -200,18 +482,18 @@ async function mirror(event, context, options, call) {
         threadId: event.thread.id,
         commentId: comment.id
       });
-      await call(
-        `mutation($input: CommentCreateInput!) { commentCreate(input: $input) { success } }`,
-        {
+      await asActor(
+        context,
+        options,
+        event.actor,
+        (call, asThemselves) => call(`mutation($input: CommentCreateInput!) { commentCreate(input: $input) { success } }`, {
           input: {
             id,
             issueId: issue,
-            body: actsAsApp(options) ? comment.body : `${comment.body}
-
-${byline(comment)}`,
-            ...as(options, comment)
+            body: signed(options, comment, asThemselves),
+            ...attribution(options, comment, asThemselves)
           }
-        }
+        })
       );
       return;
     }
@@ -219,25 +501,29 @@ ${byline(comment)}`,
     case "thread.reopened": {
       const issue = await issueOf(context, event.thread.id);
       if (!issue) return;
-      const team = await teamOf(context, options, call);
-      const stateId = event.type === "thread.resolved" ? team.completed : team.unstarted;
-      if (!stateId) return;
-      await call(
-        `mutation($id: String!, $stateId: String!) { issueUpdate(id: $id, input: { stateId: $stateId }) { success } }`,
-        {
-          id: issue,
-          stateId
-        }
-      );
+      await asActor(context, options, event.actor, async (call) => {
+        const team = await teamOf(context, options, call);
+        const stateId = event.type === "thread.resolved" ? team.completed : team.unstarted;
+        if (!stateId) return;
+        await call(
+          `mutation($id: String!, $stateId: String!) { issueUpdate(id: $id, input: { stateId: $stateId }) { success } }`,
+          { id: issue, stateId }
+        );
+      });
       return;
     }
     case "comment.deleted": {
       const links = await context.links.forThread(event.threadId);
       const mirrored = links.find((link) => link.commentId === event.commentId);
       if (!mirrored) return;
-      await call(`mutation($id: String!) { commentDelete(id: $id) { success } }`, {
-        id: mirrored.externalId
-      });
+      await asActor(
+        context,
+        options,
+        event.actor,
+        (call) => call(`mutation($id: String!) { commentDelete(id: $id) { success } }`, {
+          id: mirrored.externalId
+        })
+      );
       return;
     }
     default:
@@ -269,8 +555,9 @@ async function verified(request, secret) {
   return ok ? body : null;
 }
 async function webhook(request, context, options) {
-  if (!options.webhookSecret)
+  if (!options.webhookSecret) {
     return Response.json({ error: "no webhook secret configured" }, { status: 404 });
+  }
   const body = await verified(request, options.webhookSecret);
   if (body === null) return Response.json({ error: "bad signature" }, { status: 401 });
   const payload = JSON.parse(body);
@@ -280,14 +567,6 @@ async function webhook(request, context, options) {
   context.waitUntil(receive(payload, context));
   return new Response(null, { status: 200 });
 }
-function personOf(actor) {
-  return {
-    id: `linear:${actor?.id ?? "unknown"}`,
-    name: actor?.name ?? "Someone in Linear",
-    kind: actor?.type === "user" || actor?.type === void 0 ? "human" : "agent",
-    ...actor?.avatarUrl ? { avatarUrl: actor.avatarUrl } : {}
-  };
-}
 async function receive(payload, context) {
   const { data } = payload;
   if (payload.type === "Comment" && payload.action === "create") {
@@ -297,7 +576,8 @@ async function receive(payload, context) {
     if (!issue) return;
     const text = String(data.body ?? "").trim().slice(0, MAX_REPLY);
     if (!text) return;
-    const { comment } = await context.as(personOf(payload.actor)).reply(issue.threadId, text);
+    const person = await personFor(context, payload.actor);
+    const { comment } = await context.as(person).reply(issue.threadId, text);
     await context.links.save({ externalId: id, threadId: issue.threadId, commentId: comment.id });
     return;
   }
@@ -306,7 +586,7 @@ async function receive(payload, context) {
     if (!issue) return;
     const state = data.state;
     const done = state?.type === "completed" || state?.type === "canceled";
-    const actions = context.as(personOf(payload.actor));
+    const actions = context.as(await personFor(context, payload.actor));
     const thread = await actions.getThread(issue.threadId);
     if (!thread) return;
     if (done && thread.status === "open") await actions.setStatus(thread.id, "resolved");