Ryan/docmost
1
0
Fork 0
mirror of https://github.com/docmost/docmost.git synced 2026-08-20 02:11:35 +10:00
Code Issues Packages Projects Releases Wiki Activity

wip

Browse Source
This commit is contained in:
Philipinho
2026-08-10 03:41:54 +01:00
parent 311b511afb
commit 9f279d191c
29 changed files with 381 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/client/public/locales/en-US/translation.json
+3
View File
@@ -45,7 +45,9 @@
"Date": "Date",
"Delete": "Delete",
"Initiative": "Initiative",
"Last modified by {{name}}": "Last modified by {{name}}",
"Open in Slack": "Open in Slack",
"Paid": "Paid",
"Paste as": "Paste as",
"Project": "Project",
"Remove from page": "Remove from page",
@@ -217,6 +219,7 @@
"Theme": "Theme",
"To change your email, you have to enter your password and new email.": "To change your email, you have to enter your password and new email.",
"Toggle full page width": "Toggle full page width",
"Toggle {{name}} integration": "Toggle {{name}} integration",
"Unable to import pages. Please try again.": "Unable to import pages. Please try again.",
"Unassigned": "Unassigned",
"untitled": "untitled",
apps/client/src/ee/features.ts
+1
View File
@@ -22,4 +22,5 @@ export const Feature = {
PERSONAL_SPACES: 'spaces:personal',
DOCX_EXPORT: 'export:docx',
BASES: 'bases',
INTEGRATIONS: 'integrations',
} as const;
apps/client/src/features/editor/components/common/editor-paste-handler.tsx
+3 -4
View File
@@ -26,15 +26,14 @@ const ATTACHMENT_NODE_TYPES = [
const ATTACHMENT_URL_RE = /\/api\/files\/([0-9a-f-]+)\//;
// Only installed + enabled providers get card treatment; anything else pastes
// as an ordinary link. The cache is prefetched when the page editor mounts;
// Only installed providers get card treatment; anything else pastes as an
// ordinary link. The cache is prefetched when the page editor mounts;
// a cold cache also means ordinary link.
function isIntegrationInstalled(provider: string): boolean {
const installed = queryClient.getQueryData<Integration[]>([
"installed-integrations",
]);
const integration = installed?.find((i) => i.type === provider);
return Boolean(integration?.isEnabled);
return Boolean(installed?.some((i) => i.type === provider));
}
export const handlePaste = (
apps/client/src/features/editor/components/integration-link/integration-link-view.module.css
+12
View File
@@ -13,6 +13,18 @@
background-color: var(--mantine-color-dark-5);
}
.thumbnail {
display: block;
width: 100%;
max-height: 320px;
object-fit: cover;
background-color: var(--mantine-color-gray-0);
}
:global([data-mantine-color-scheme="dark"]) .thumbnail {
background-color: var(--mantine-color-dark-6);
}
.mention {
display: inline-flex;
align-items: center;
apps/client/src/features/editor/components/integration-link/integration-link-view.tsx
+83
View File
@@ -215,6 +215,85 @@ function JiraIssueCard({
);
}
function FigmaFileCard({
url,
unfurlData,
}: {
url: string;
unfurlData: Record<string, any>;
}) {
const { t } = useTranslation();
// Figma thumbnail links are pre-signed and expire; drop the preview rather
// than render a broken image.
const [thumbnailFailed, setThumbnailFailed] = useState(false);
const meta = unfurlData.metadata ?? {};
const thumbnailUrl: string | undefined = meta.thumbnailUrl;
const showThumbnail = Boolean(thumbnailUrl) && !thumbnailFailed;
const subtitle = [
unfurlData.author
? t("Last modified by {{name}}", { name: unfurlData.author })
: unfurlData.description,
meta.lastModified ? timeAgo(new Date(meta.lastModified)) : null,
]
.filter(Boolean)
.join(" • ");
return (
<NodeViewWrapper data-drag-handle="">
<Card
className={classes.card}
withBorder
padding="sm"
radius="sm"
component="a"
href={url}
target="_blank"
rel="noopener"
style={{ textDecoration: "none", color: "inherit" }}
>
{showThumbnail && (
<Card.Section withBorder>
<img
src={thumbnailUrl}
alt=""
loading="lazy"
className={classes.thumbnail}
onError={() => setThumbnailFailed(true)}
/>
</Card.Section>
)}
<Group gap="sm" wrap="nowrap" mt={showThumbnail ? "sm" : undefined}>
<Avatar
src={unfurlData.authorAvatarUrl}
size={28}
radius="xl"
style={{ flexShrink: 0 }}
>
{(unfurlData.author ?? unfurlData.title ?? "F").charAt(0)}
</Avatar>
<Stack gap={2} style={{ flex: 1, minWidth: 0 }}>
<Text size="sm" fw={600} truncate>
{unfurlData.title}
</Text>
{subtitle && (
<Text size="xs" c="dimmed" truncate>
{subtitle}
</Text>
)}
</Stack>
<div style={{ flexShrink: 0, alignSelf: "center" }}>
{getIntegrationIcon("figma", 18)}
</div>
</Group>
</Card>
</NodeViewWrapper>
);
}
function IntegrationLinkView(props: any) {
const { node } = props;
const { url, provider } = node.attrs;
@@ -331,6 +410,10 @@ function IntegrationLinkView(props: any) {
return <JiraIssueCard url={url} unfurlData={unfurlData} />;
}
if (provider === "figma") {
return <FigmaFileCard url={url} unfurlData={unfurlData} />;
}
return (
<NodeViewWrapper data-drag-handle="">
<Card
apps/client/src/features/integration/components/connection-row.tsx
+20 -4
View File
@@ -60,10 +60,26 @@ export default function ConnectionRow({
<>
{connection ? (
<>
<Text size="xs" c="green">
{t("Connected")}
{connection.providerUserId && ` (${connection.providerUserId})`}
</Text>
{connection.invalidatedAt ? (
<>
<Text size="xs" c="orange">
{t("Connection expired")}
</Text>
<Button
size="xs"
variant="light"
color="orange"
onClick={() => onConnect(definition.type)}
>
{t("Reconnect")}
</Button>
</>
) : (
<Text size="xs" c="green">
{t("Connected")}
{connection.providerUserId && ` (${connection.providerUserId})`}
</Text>
)}
<Button
size="xs"
variant="subtle"
apps/client/src/features/integration/components/integration-row.tsx
+35 -24
View File
@@ -1,17 +1,27 @@
import { Group, Text, Badge, Button, Switch, Box, Stack } from "@mantine/core";
import {
Group,
Text,
Badge,
Button,
Box,
Stack,
Tooltip,
} from "@mantine/core";
import { useTranslation } from "react-i18next";
import {
IntegrationDefinition,
Integration,
} from "../types/integration.types";
import { getIntegrationIcon } from "./integration-icons";
import { useHasFeature } from "@/ee/hooks/use-feature";
import { Feature } from "@/ee/features";
import { useUpgradeLabel } from "@/ee/hooks/use-upgrade-label";
type IntegrationRowProps = {
definition: IntegrationDefinition;
installation?: Integration;
onInstall: (type: string) => void;
onUninstall: (integrationId: string) => void;
onToggle: (integration: Integration, enabled: boolean) => void;
};
export default function IntegrationRow({
@@ -19,10 +29,12 @@ export default function IntegrationRow({
installation,
onInstall,
onUninstall,
onToggle,
}: IntegrationRowProps) {
const { t } = useTranslation();
const isInstalled = !!installation;
const hasAccess = useHasFeature(Feature.INTEGRATIONS);
const locked = !!definition.requiresLicense && !hasAccess;
const upgradeLabel = useUpgradeLabel();
return (
<Box
@@ -40,6 +52,11 @@ export default function IntegrationRow({
<Text size="sm" fw={500}>
{definition.name}
</Text>
{locked && (
<Badge size="xs" variant="light" color="violet">
{t("Paid")}
</Badge>
)}
{definition.capabilities.map((cap) => (
<Badge key={cap} size="xs" variant="light">
{cap}
@@ -54,31 +71,25 @@ export default function IntegrationRow({
<Group gap="sm" wrap="nowrap" style={{ flexShrink: 0 }}>
{isInstalled ? (
<>
<Switch
checked={installation.isEnabled}
onChange={(e) =>
onToggle(installation, e.currentTarget.checked)
}
size="sm"
/>
<Button
size="xs"
variant="subtle"
color="red"
onClick={() => onUninstall(installation.id)}
>
{t("Uninstall")}
</Button>
</>
) : (
<Button
size="xs"
variant="light"
onClick={() => onInstall(definition.type)}
variant="subtle"
color="red"
onClick={() => onUninstall(installation.id)}
>
{t("Install")}
{t("Uninstall")}
</Button>
) : (
<Tooltip label={upgradeLabel} disabled={!locked}>
<Button
size="xs"
variant="light"
disabled={locked}
onClick={() => onInstall(definition.type)}
>
{t("Install")}
</Button>
</Tooltip>
)}
</Group>
</Group>
apps/client/src/features/integration/pages/connections.tsx
+1 -2
View File
@@ -81,8 +81,7 @@ export default function Connections() {
{available
.filter((def) => {
if (!def.capabilities.includes("oauth")) return false;
const installation = installed?.find((i) => i.type === def.type);
return installation?.isEnabled;
return installed?.some((i) => i.type === def.type);
})
.map((def) => {
const connection = myConnections?.find(
apps/client/src/features/integration/pages/integrations.tsx
+29 -18
View File
@@ -11,13 +11,12 @@ import {
useInstalledIntegrations,
useInstallIntegration,
useUninstallIntegration,
useUpdateIntegrationSettings,
} from "../queries/integration-query";
import { Integration } from "../types/integration.types";
import {
getOAuthAuthorizeUrl,
getOAuthInstallUrl,
} from "../services/integration-service";
import { Integration } from "../types/integration.types";
import { notifications } from "@mantine/notifications";
export default function Integrations() {
@@ -28,7 +27,6 @@ export default function Integrations() {
useInstalledIntegrations();
const installMutation = useInstallIntegration();
const uninstallMutation = useUninstallIntegration();
const updateMutation = useUpdateIntegrationSettings();
const handleInstall = useCallback(
async (type: string) => {
@@ -50,10 +48,34 @@ export default function Integrations() {
return;
}
// Per-user OAuth providers (Linear, Jira, GitHub, ...): keep existing
// two-step flow — create the integration row, then individual users
// OAuth-connect from /settings/account/connections.
installMutation.mutate({ type });
// Per-user OAuth providers (GitLab, Jira, GitHub, ...): create the
// integration row, then send the installing admin straight into their
// own OAuth so they leave with a working connection. Other members
// connect for themselves from /settings/account/connections.
let integration: Integration;
try {
integration = await installMutation.mutateAsync({ type });
} catch {
return; // the mutation reports its own failure
}
if (!definition?.capabilities?.includes("oauth")) return;
try {
const { authorizationUrl } = await getOAuthAuthorizeUrl({
integrationId: integration.id,
returnPath: "/settings/integrations",
});
window.location.href = authorizationUrl;
} catch (err: any) {
// The integration stays installed; the admin can connect later.
notifications.show({
message:
err?.response?.data?.message ??
t("Failed to start OAuth connection"),
color: "red",
});
}
},
[installMutation, available, t],
);
@@ -65,16 +87,6 @@ export default function Integrations() {
[uninstallMutation],
);
const handleToggle = useCallback(
(integration: Integration, enabled: boolean) => {
updateMutation.mutate({
integrationId: integration.id,
isEnabled: enabled,
});
},
[updateMutation],
);
const isLoading = loadingAvailable || loadingInstalled;
const error = new URLSearchParams(window.location.search).get("error");
@@ -115,7 +127,6 @@ export default function Integrations() {
installation={installation}
onInstall={handleInstall}
onUninstall={handleUninstall}
onToggle={handleToggle}
/>
);
})}
apps/client/src/features/integration/queries/integration-query.ts
-19
View File
@@ -57,25 +57,6 @@ export function useUninstallIntegration() {
});
}
export function useUpdateIntegrationSettings() {
const qc = useQueryClient();
const { t } = useTranslation();
return useMutation({
mutationFn: integrationService.updateIntegrationSettings,
onSuccess: () => {
notifications.show({ message: t("Integration updated successfully") });
qc.invalidateQueries({ queryKey: ["installed-integrations"] });
},
onError: (error) => {
const errorMessage = error["response"]?.data?.message;
notifications.show({
message: errorMessage || t("Failed to update integration"),
color: "red",
});
},
});
}
export function useMyConnections() {
return useQuery({
queryKey: ["my-connections"],
apps/client/src/features/integration/services/integration-service.ts
-9
View File
@@ -35,15 +35,6 @@ export async function uninstallIntegration(data: {
await api.post("/integrations/uninstall", data);
}
export async function updateIntegrationSettings(data: {
integrationId: string;
settings?: Record<string, any>;
isEnabled?: boolean;
}): Promise<Integration> {
const req = await api.post<Integration>("/integrations/update", data);
return req.data;
}
export async function getMyConnections(): Promise<UserConnection[]> {
const req = await api.post<UserConnection[]>("/integrations/connections/mine");
return req.data;
apps/client/src/features/integration/types/integration.types.ts
+2 -2
View File
@@ -14,13 +14,13 @@ export type IntegrationDefinition = {
icon: string;
capabilities: IntegrationCapability[];
oauth?: OAuthConfig;
requiresLicense?: boolean;
};
export type Integration = {
id: string;
workspaceId: string;
type: string;
isEnabled: boolean;
settings: Record<string, any> | null;
installedById: string | null;
createdAt: string;
@@ -35,9 +35,9 @@ export type ConnectionStatus = {
export type UserConnection = {
integrationId: string;
type: string;
isEnabled: boolean;
providerUserId: string | null;
connectedAt: string;
invalidatedAt: string | null;
};
export type UnfurlResult = {
apps/server/src/common/features.ts
+1
View File
@@ -23,6 +23,7 @@ export const Feature = {
PERSONAL_SPACES: 'spaces:personal',
DOCX_EXPORT: 'export:docx',
BASES: 'bases',
INTEGRATIONS: 'integrations',
} as const;
export type FeatureKey = (typeof Feature)[keyof typeof Feature];
apps/server/src/core/integration/dto/integration.dto.ts
-5
View File
@@ -1,5 +1,4 @@
import {
IsBoolean,
IsNotEmpty,
IsObject,
IsOptional,
@@ -28,10 +27,6 @@ export class UpdateIntegrationDto {
@IsOptional()
@IsObject()
settings?: Record<string, any>;
@IsOptional()
@IsBoolean()
isEnabled?: boolean;
}
export class IntegrationIdDto {
apps/server/src/core/integration/integration-connection.service.ts
+2 -2
View File
@@ -28,7 +28,7 @@ export class IntegrationConnectionService {
);
return {
connected: !!connection,
connected: !!connection && !connection.invalidatedAt,
providerUserId: connection?.providerUserId ?? undefined,
};
}
@@ -61,9 +61,9 @@ export class IntegrationConnectionService {
return rows.map((row) => ({
integrationId: row.integrationId,
type: row.type,
isEnabled: row.isEnabled,
providerUserId: row.providerUserId ?? null,
connectedAt: row.createdAt,
invalidatedAt: row.invalidatedAt ?? null,
}));
}
apps/server/src/core/integration/integration.controller.ts
+20 -1
View File
@@ -19,11 +19,14 @@ import {
UpdateIntegrationDto,
IntegrationIdDto,
} from './dto/integration.dto';
import { IntegrationRegistry } from './registry/integration-registry';
import WorkspaceAbilityFactory from '../casl/abilities/workspace-ability.factory';
import {
WorkspaceCaslAction,
WorkspaceCaslSubject,
} from '../casl/interfaces/workspace-ability.type';
import { LicenseCheckService } from '../../integrations/environment/license-check.service';
import { Feature } from '../../common/features';
@Controller('integrations')
export class IntegrationController {
@@ -31,8 +34,22 @@ export class IntegrationController {
private readonly integrationService: IntegrationService,
private readonly connectionService: IntegrationConnectionService,
private readonly workspaceAbility: WorkspaceAbilityFactory,
private readonly licenseCheckService: LicenseCheckService,
private readonly registry: IntegrationRegistry,
) {}
private assertIntegrationsLicensed(workspace: Workspace) {
if (
!this.licenseCheckService.hasFeature(
workspace.licenseKey,
Feature.INTEGRATIONS,
workspace.plan,
)
) {
throw new ForbiddenException('This feature requires a valid license');
}
}
@UseGuards(JwtAuthGuard)
@HttpCode(HttpStatus.OK)
@Post('available')
@@ -67,6 +84,9 @@ export class IntegrationController {
throw new ForbiddenException();
}
if (this.registry.getProvider(dto.type)?.definition.requiresLicense) {
this.assertIntegrationsLicensed(workspace);
}
return this.integrationService.install(dto.type, workspace.id, user.id);
}
@@ -112,7 +132,6 @@ export class IntegrationController {
return this.integrationService.update(dto.integrationId, workspace.id, {
settings: dto.settings,
isEnabled: dto.isEnabled,
});
}
apps/server/src/core/integration/integration.processor.ts
+28 -4
View File
@@ -1,5 +1,7 @@
import { Processor, WorkerHost } from '@nestjs/bullmq';
import { Logger } from '@nestjs/common';
import { OnWorkerEvent, Processor, WorkerHost } from '@nestjs/bullmq';
import { Logger, NotFoundException } from '@nestjs/common';
import { IntegrationConnection } from '@docmost/db/types/entity.types';
import { TokenInvalidError } from './registry/integration-provider.interface';
import { Job } from 'bullmq';
import { QueueJob, QueueName } from '../../integrations/queue/constants/queue.constants';
import { IntegrationRegistry } from './registry/integration-registry';
@@ -35,6 +37,13 @@ export class IntegrationProcessor extends WorkerHost {
}
}
// Route worker-level errors (e.g. lock renewal after laptop sleep) through
// the logger instead of bullmq's raw console.error fallback.
@OnWorkerEvent('error')
onError(err: Error): void {
this.logger.error(`Worker error: ${err.message}`);
}
private async handleTokenRefresh(): Promise<void> {
const connections = await this.connectionRepo.findExpiringTokens(
TOKEN_REFRESH_WINDOW_MS,
@@ -55,6 +64,15 @@ export class IntegrationProcessor extends WorkerHost {
this.logger.error(
`Token refresh failed for connection ${connection.id}: ${(err as Error).message}`,
);
// Dead credential or orphaned row: retire it so findExpiringTokens stops selecting it.
if (
err instanceof NotFoundException ||
err instanceof TokenInvalidError
) {
await this.connectionRepo
.invalidate(connection.id)
.catch(() => undefined);
}
}
}
}
@@ -67,7 +85,7 @@ export class IntegrationProcessor extends WorkerHost {
}
const integrations =
await this.integrationRepo.findEnabledByWorkspace(workspaceId);
await this.integrationRepo.findAllByWorkspace(workspaceId);
for (const integration of integrations) {
const provider = this.registry.getProvider(integration.type);
@@ -75,12 +93,13 @@ export class IntegrationProcessor extends WorkerHost {
continue;
}
let connection: IntegrationConnection | undefined;
try {
const connections = await this.connectionRepo.findByIntegration(
integration.id,
);
const connection = connections[0];
connection = connections[0];
let accessToken: string | undefined;
if (connection) {
@@ -103,6 +122,11 @@ export class IntegrationProcessor extends WorkerHost {
this.logger.error(
`Integration event handler failed for ${integration.type}: ${(err as Error).message}`,
);
if (err instanceof TokenInvalidError && connection) {
await this.connectionRepo
.invalidate(connection.id)
.catch(() => undefined);
}
}
}
}
apps/server/src/core/integration/integration.service.ts
+16 -4
View File
@@ -3,7 +3,12 @@ import {
Injectable,
NotFoundException,
} from '@nestjs/common';
import { InjectKysely } from 'nestjs-kysely';
import { KyselyDB } from '@docmost/db/types/kysely.types';
import { executeTx } from '@docmost/db/utils';
import { IntegrationRepo } from './repos/integration.repo';
import { IntegrationConnectionRepo } from './repos/integration-connection.repo';
import { IntegrationWebhookRepo } from './repos/integration-webhook.repo';
import { IntegrationRegistry } from './registry/integration-registry';
import { Integration } from '@docmost/db/types/entity.types';
import { validateIntegrationSettings } from './dto/integration-settings.schema';
@@ -11,7 +16,10 @@ import { validateIntegrationSettings } from './dto/integration-settings.schema';
@Injectable()
export class IntegrationService {
constructor(
@InjectKysely() private readonly db: KyselyDB,
private readonly integrationRepo: IntegrationRepo,
private readonly connectionRepo: IntegrationConnectionRepo,
private readonly webhookRepo: IntegrationWebhookRepo,
private readonly registry: IntegrationRegistry,
) {}
@@ -33,7 +41,7 @@ export class IntegrationService {
userId: string,
): Promise<Integration> {
const provider = this.registry.getProvider(type);
if (!provider) {
if (!provider || provider.definition.hidden) {
throw new BadRequestException(`Unknown integration type: ${type}`);
}
@@ -59,13 +67,18 @@ export class IntegrationService {
if (!integration || integration.workspaceId !== workspaceId) {
throw new NotFoundException('Integration not found');
}
await this.integrationRepo.softDelete(integrationId);
// Delete child rows first so no orphan connections keep feeding the token refresh scheduler.
await executeTx(this.db, async (trx) => {
await this.connectionRepo.deleteByIntegration(integrationId, trx);
await this.webhookRepo.deleteByIntegration(integrationId, trx);
await this.integrationRepo.softDelete(integrationId, trx);
});
}
async update(
integrationId: string,
workspaceId: string,
data: { settings?: Record<string, any>; isEnabled?: boolean },
data: { settings?: Record<string, any> },
): Promise<Integration> {
const integration = await this.integrationRepo.findById(integrationId);
if (!integration || integration.workspaceId !== workspaceId) {
@@ -85,7 +98,6 @@ export class IntegrationService {
return this.integrationRepo.update(integrationId, {
...(data.settings !== undefined && { settings: data.settings }),
...(data.isEnabled !== undefined && { isEnabled: data.isEnabled }),
});
}
}
apps/server/src/core/integration/oauth/oauth.controller.ts
+19
View File
@@ -24,6 +24,10 @@ import {
OAuthInstallDto,
} from '../dto/integration.dto';
import { IntegrationConnectionService } from '../integration-connection.service';
import { IntegrationRegistry } from '../registry/integration-registry';
import { LicenseCheckService } from '../../../integrations/environment/license-check.service';
import { Feature } from '../../../common/features';
import { ForbiddenException } from '@nestjs/common';
@Controller('integrations/oauth')
export class OAuthController {
@@ -32,6 +36,8 @@ export class OAuthController {
constructor(
private readonly oauthService: OAuthService,
private readonly connectionService: IntegrationConnectionService,
private readonly licenseCheckService: LicenseCheckService,
private readonly registry: IntegrationRegistry,
) {}
@UseGuards(JwtAuthGuard)
@@ -66,6 +72,19 @@ export class OAuthController {
@AuthUser() user: User,
@AuthWorkspace() workspace: Workspace,
) {
// This flow creates the integration row on callback success; gate it
// like a plain install.
if (
this.registry.getProvider(dto.type)?.definition.requiresLicense &&
!this.licenseCheckService.hasFeature(
workspace.licenseKey,
Feature.INTEGRATIONS,
workspace.plan,
)
) {
throw new ForbiddenException('This feature requires a valid license');
}
const { authorizationUrl } = await this.oauthService.getInstallAuthorizationUrl(
dto.type,
workspace.id,
apps/server/src/core/integration/providers/github/github.service.ts
+2 -7
View File
@@ -1,6 +1,7 @@
import { Injectable, Logger } from '@nestjs/common';
import { UnfurlResult } from '../../registry/integration-provider.interface';
import { relativeTime } from '../../utils/relative-time';
import { providerApiFetch } from '../../utils/provider-fetch';
@Injectable()
export class GitHubService {
@@ -253,7 +254,7 @@ export class GitHubService {
apiBaseUrl: string,
path: string,
): Promise<any> {
const response = await fetch(`${apiBaseUrl}${path}`, {
const response = await providerApiFetch('GitHub', `${apiBaseUrl}${path}`, {
headers: {
Authorization: `Bearer ${accessToken}`,
Accept: 'application/vnd.github.v3+json',
@@ -261,12 +262,6 @@ export class GitHubService {
},
});
if (!response.ok) {
throw new Error(
`GitHub API error: ${response.status} ${response.statusText}`,
);
}
return response.json();
}
}
apps/server/src/core/integration/providers/gitlab/gitlab.service.ts
+2 -7
View File
@@ -1,6 +1,7 @@
import { Injectable, Logger } from '@nestjs/common';
import { UnfurlResult } from '../../registry/integration-provider.interface';
import { relativeTime } from '../../utils/relative-time';
import { providerApiFetch } from '../../utils/provider-fetch';
@Injectable()
export class GitLabService {
@@ -240,19 +241,13 @@ export class GitLabService {
apiBaseUrl: string,
path: string,
): Promise<any> {
const response = await fetch(`${apiBaseUrl}${path}`, {
const response = await providerApiFetch('GitLab', `${apiBaseUrl}${path}`, {
headers: {
Authorization: `Bearer ${accessToken}`,
Accept: 'application/json',
},
});
if (!response.ok) {
throw new Error(
`GitLab API error: ${response.status} ${response.statusText}`,
);
}
return response.json();
}
}
apps/server/src/core/integration/registry/integration-provider.interface.ts
+25
View File
@@ -35,6 +35,11 @@ export type IntegrationDefinition = {
capabilities: IntegrationCapability[];
oauth?: OAuthConfig;
unfurlPatterns?: UnfurlPattern[];
// Kept out of the available list and refused for install; existing
// installations keep unfurling.
hidden?: boolean;
// Install requires the INTEGRATIONS license feature; unset = free.
requiresLicense?: boolean;
};
export type ConnectedEvent = {
@@ -84,6 +89,26 @@ export class UnfurlForbiddenError extends Error {
}
}
// Thrown when the provider definitively rejects the stored credential (API 401,
// or invalid_grant at the token endpoint). Callers retire the connection.
export class TokenInvalidError extends Error {
constructor(message = 'Integration credential is no longer valid') {
super(message);
this.name = 'TokenInvalidError';
}
}
export class ProviderApiError extends Error {
constructor(
readonly provider: string,
readonly status: number,
statusText = '',
) {
super(`${provider} API error: ${status} ${statusText}`.trimEnd());
this.name = 'ProviderApiError';
}
}
export type LinkDescription = {
title: string;
description?: string;
apps/server/src/core/integration/registry/integration-registry.ts
+3 -1
View File
@@ -21,7 +21,9 @@ export class IntegrationRegistry {
}
getAvailableIntegrations(): IntegrationDefinition[] {
return this.getAllProviders().map((p) => p.definition);
return this.getAllProviders()
.map((p) => p.definition)
.filter((definition) => !definition.hidden);
}
findUnfurlProvider(
apps/server/src/core/integration/repos/integration-connection.repo.ts
+28 -5
View File
@@ -91,6 +91,7 @@ export class IntegrationConnectionRepo {
accessToken: connection.accessToken,
refreshToken: connection.refreshToken,
tokenExpiresAt: connection.tokenExpiresAt,
invalidatedAt: null,
scopes: connection.scopes,
providerUserId: connection.providerUserId,
metadata: connection.metadata,
@@ -123,6 +124,7 @@ export class IntegrationConnectionRepo {
accessToken: input.accessToken,
refreshToken: input.refreshToken ?? null,
tokenExpiresAt: input.tokenExpiresAt ?? null,
invalidatedAt: null,
scopes: input.scopes ?? null,
userId: input.userId,
},
@@ -200,9 +202,9 @@ export class IntegrationConnectionRepo {
.select([
'integrationConnections.integrationId',
'integrations.type',
'integrations.isEnabled',
'integrationConnections.providerUserId',
'integrationConnections.createdAt',
'integrationConnections.invalidatedAt',
])
.where('integrationConnections.userId', '=', userId)
.where('integrations.workspaceId', '=', workspaceId)
@@ -216,10 +218,31 @@ export class IntegrationConnectionRepo {
const threshold = new Date(Date.now() + expiresBeforeMs);
return this.db
.selectFrom('integrationConnections')
.selectAll()
.where('refreshToken', 'is not', null)
.where('tokenExpiresAt', 'is not', null)
.where('tokenExpiresAt', '<', threshold)
.innerJoin(
'integrations',
'integrations.id',
'integrationConnections.integrationId',
)
.selectAll('integrationConnections')
.where('integrations.deletedAt', 'is', null)
.where('integrationConnections.invalidatedAt', 'is', null)
.where('integrationConnections.refreshToken', 'is not', null)
.where('integrationConnections.tokenExpiresAt', 'is not', null)
.where('integrationConnections.tokenExpiresAt', '<', threshold)
.execute();
}
// Retire a rejected credential: flag for reconnect UX, drop the dead refresh token; no-op if the row is gone.
async invalidate(connectionId: string): Promise<void> {
await this.db
.updateTable('integrationConnections')
.set({
invalidatedAt: new Date(),
refreshToken: null,
tokenExpiresAt: null,
updatedAt: new Date(),
})
.where('id', '=', connectionId)
.execute();
}
apps/server/src/core/integration/repos/integration.repo.ts
-16
View File
@@ -41,20 +41,6 @@ export class IntegrationRepo {
.executeTakeFirst();
}
async findEnabledByWorkspace(
workspaceId: string,
trx?: KyselyTransaction,
): Promise<Integration[]> {
const db = dbOrTx(this.db, trx);
return db
.selectFrom('integrations')
.selectAll()
.where('workspaceId', '=', workspaceId)
.where('isEnabled', '=', true)
.where('deletedAt', 'is', null)
.execute();
}
async findAllByWorkspace(
workspaceId: string,
trx?: KyselyTransaction,
@@ -91,7 +77,6 @@ export class IntegrationRepo {
.onConflict((oc) =>
oc.columns(['type', 'workspaceId']).doUpdateSet({
deletedAt: null,
isEnabled: true,
installedById: integration.installedById,
updatedAt: new Date(),
}),
@@ -135,7 +120,6 @@ export class IntegrationRepo {
.selectFrom('integrations')
.selectAll()
.where('type', '=', type)
.where('isEnabled', '=', true)
.where('deletedAt', 'is', null)
.where(sql<string>`settings->>${sql.lit(key)}`, '=', value)
.executeTakeFirst();
apps/server/src/core/integration/unfurl/unfurl.service.ts
+42 -6
View File
@@ -7,6 +7,8 @@ import {
UnfurlResult,
UnfurlNeedsConnection,
UnfurlForbiddenError,
TokenInvalidError,
ProviderApiError,
IntegrationProvider,
} from '../registry/integration-provider.interface';
import { RedisService } from '@nestjs-labs/nestjs-ioredis';
@@ -14,6 +16,9 @@ import type { Redis } from 'ioredis';
import * as crypto from 'crypto';
const UNFURL_CACHE_TTL = 300; // 5 minutes
// Transient failures get a short negative cache so a broken provider is not
// re-fetched on every view; 404s cache at the normal TTL (the target is gone).
const UNFURL_ERROR_CACHE_TTL = 60;
const UNFURL_CACHE_PREFIX = 'unfurl:';
@Injectable()
@@ -66,11 +71,12 @@ export class UnfurlService {
userId,
);
if (!connection) {
if (!connection || connection.invalidatedAt) {
// Dead workspace connections need an admin re-install; members get no card.
if (connectionScope === 'workspace') {
return null;
}
// Not cached: the card should load as soon as the user connects.
// Not cached: the card should load as soon as the user (re)connects.
return this.buildNeedsConnection(
provider,
integration.id,
@@ -105,14 +111,45 @@ export class UnfurlService {
} catch (err) {
// Not-authorized is an expected outcome (no card), not an error.
if (err instanceof UnfurlForbiddenError) {
this.logger.debug(`Unfurl not authorized for ${url}`);
this.logger.debug(
`Unfurl not authorized for ${url}: ${(err as Error).message}`,
);
await this.cacheNull(cacheKey, UNFURL_ERROR_CACHE_TTL);
return null;
}
if (err instanceof TokenInvalidError) {
this.logger.warn(
`Retiring connection ${connection.id}: ${(err as Error).message}`,
);
await this.connectionRepo
.invalidate(connection.id)
.catch(() => undefined);
if (connectionScope === 'workspace') {
return null;
}
// Not cached so the card heals the moment the user reconnects.
return this.buildNeedsConnection(
provider,
integration.id,
patternType,
match,
url,
);
}
this.logger.error(`Unfurl failed for ${url}: ${(err as Error).message}`);
const ttl =
err instanceof ProviderApiError && err.status === 404
? UNFURL_CACHE_TTL
: UNFURL_ERROR_CACHE_TTL;
await this.cacheNull(cacheKey, ttl);
return null;
}
}
private async cacheNull(cacheKey: string, ttl: number): Promise<void> {
await this.redis.set(cacheKey, 'null', 'EX', ttl);
}
async purgeUserCache(workspaceId: string, userId: string): Promise<void> {
const pattern = `${UNFURL_CACHE_PREFIX}${workspaceId}:${userId}:*`;
try {
@@ -167,7 +204,6 @@ export class UnfurlService {
patternType: string;
integration: {
id: string;
isEnabled: boolean;
type: string;
settings: unknown;
};
@@ -178,13 +214,13 @@ export class UnfurlService {
workspaceId,
staticResult.provider.definition.type,
);
if (integration && integration.isEnabled) {
if (integration) {
return { ...staticResult, integration };
}
}
const integrations =
await this.integrationRepo.findEnabledByWorkspace(workspaceId);
await this.integrationRepo.findAllByWorkspace(workspaceId);
for (const integration of integrations) {
const provider = this.registry.getProvider(integration.type);
apps/server/src/database/migrations/20260807T1264122-integrations.ts
+2 -1
View File
@@ -11,7 +11,6 @@ export async function up(db: Kysely<any>): Promise<void> {
col.references('workspaces.id').onDelete('cascade').notNull(),
)
.addColumn('type', 'text', (col) => col.notNull())
.addColumn('is_enabled', 'boolean', (col) => col.notNull().defaultTo(true))
.addColumn('settings', 'jsonb')
.addColumn('installed_by_id', 'uuid', (col) =>
col.references('users.id').onDelete('set null'),
@@ -50,6 +49,8 @@ export async function up(db: Kysely<any>): Promise<void> {
.addColumn('access_token', 'text')
.addColumn('refresh_token', 'text')
.addColumn('token_expires_at', 'timestamptz')
// Set when the provider definitively rejects the credential; a reconnect clears it.
.addColumn('invalidated_at', 'timestamptz')
.addColumn('scopes', 'text')
.addColumn('metadata', 'jsonb')
// 'workspace' = one shared bot/app connection per integration (Slack);
apps/server/src/database/types/db.d.ts
Vendored
+1 -1
View File
@@ -510,7 +510,6 @@ export interface Integrations {
id: Generated<string>;
workspaceId: string;
type: string;
isEnabled: Generated<boolean>;
settings: Json | null;
installedById: string | null;
createdAt: Generated<Timestamp>;
@@ -527,6 +526,7 @@ export interface IntegrationConnections {
accessToken: string | null;
refreshToken: string | null;
tokenExpiresAt: Timestamp | null;
invalidatedAt: Timestamp | null;
scopes: string | null;
kind: string;
metadata: Json | null;
apps/server/src/ee
+1 -1
Submodule apps/server/src/ee updated: 8a2b127afd...592ef10a71