133 lines
4.1 KiB
TypeScript
133 lines
4.1 KiB
TypeScript
import { query } from './index.js';
|
|
import { decryptSecret, encryptSecret } from '../lib/crypto.js';
|
|
import type { IntegrationRow, ProviderSlug } from '../types/integration.js';
|
|
|
|
type IntegrationRecord = {
|
|
id: number;
|
|
provider: ProviderSlug;
|
|
external_workspace_id: string | null;
|
|
display_name: string | null;
|
|
api_key_hash: string | null;
|
|
access_token_ciphertext: string | null;
|
|
refresh_token_ciphertext: string | null;
|
|
signing_secret_ciphertext: string | null;
|
|
token_expires_at: Date | null;
|
|
scopes: string[] | null;
|
|
};
|
|
|
|
const PUBLIC_COLUMNS = `
|
|
id, provider, external_workspace_id, display_name, token_expires_at, scopes
|
|
`;
|
|
|
|
/**
|
|
* Ciphertext columns are dropped here rather than in the query so that every
|
|
* caller path converges on a value that structurally cannot carry a secret.
|
|
*/
|
|
const toPublicRow = (record: IntegrationRecord): IntegrationRow => ({
|
|
id: record.id,
|
|
provider: record.provider,
|
|
externalWorkspaceId: record.external_workspace_id,
|
|
displayName: record.display_name,
|
|
scopes: record.scopes ?? [],
|
|
tokenExpiresAt: record.token_expires_at,
|
|
});
|
|
|
|
export const findByApiKeyHash = async (
|
|
hash: string
|
|
): Promise<IntegrationRow | null> => {
|
|
const { rows } = await query<IntegrationRecord>(
|
|
`SELECT ${PUBLIC_COLUMNS} FROM integrations WHERE api_key_hash = $1`,
|
|
[hash]
|
|
);
|
|
return rows[0] ? toPublicRow(rows[0]) : null;
|
|
};
|
|
|
|
export const findByProviderWorkspace = async (
|
|
provider: ProviderSlug,
|
|
externalWorkspaceId: string
|
|
): Promise<IntegrationRow | null> => {
|
|
const { rows } = await query<IntegrationRecord>(
|
|
`SELECT ${PUBLIC_COLUMNS} FROM integrations
|
|
WHERE provider = $1 AND external_workspace_id = $2`,
|
|
[provider, externalWorkspaceId]
|
|
);
|
|
return rows[0] ? toPublicRow(rows[0]) : null;
|
|
};
|
|
|
|
export const upsertInstall = async (input: {
|
|
provider: ProviderSlug;
|
|
externalWorkspaceId: string;
|
|
displayName?: string;
|
|
apiKeyHash?: string;
|
|
signingSecret?: string;
|
|
scopes?: string[];
|
|
}): Promise<IntegrationRow> => {
|
|
const { rows } = await query<IntegrationRecord>(
|
|
`INSERT INTO integrations
|
|
(provider, external_workspace_id, display_name, api_key_hash,
|
|
signing_secret_ciphertext, scopes)
|
|
VALUES ($1, $2, $3, $4, $5, $6)
|
|
ON CONFLICT (provider, external_workspace_id) DO UPDATE SET
|
|
display_name = EXCLUDED.display_name,
|
|
api_key_hash = COALESCE(EXCLUDED.api_key_hash, integrations.api_key_hash),
|
|
signing_secret_ciphertext = COALESCE(
|
|
EXCLUDED.signing_secret_ciphertext, integrations.signing_secret_ciphertext
|
|
),
|
|
scopes = EXCLUDED.scopes,
|
|
updated_at = NOW()
|
|
RETURNING ${PUBLIC_COLUMNS}`,
|
|
[
|
|
input.provider,
|
|
input.externalWorkspaceId,
|
|
input.displayName ?? null,
|
|
input.apiKeyHash ?? null,
|
|
input.signingSecret ? encryptSecret(input.signingSecret) : null,
|
|
input.scopes ?? [],
|
|
]
|
|
);
|
|
return toPublicRow(rows[0]);
|
|
};
|
|
|
|
export const updateTokens = async (input: {
|
|
id: number;
|
|
accessToken: string;
|
|
refreshToken?: string;
|
|
expiresAt?: Date;
|
|
}): Promise<void> => {
|
|
await query(
|
|
`UPDATE integrations SET
|
|
access_token_ciphertext = $2,
|
|
refresh_token_ciphertext = COALESCE($3, refresh_token_ciphertext),
|
|
token_expires_at = $4,
|
|
updated_at = NOW()
|
|
WHERE id = $1`,
|
|
[
|
|
input.id,
|
|
encryptSecret(input.accessToken),
|
|
input.refreshToken ? encryptSecret(input.refreshToken) : null,
|
|
input.expiresAt ?? null,
|
|
]
|
|
);
|
|
};
|
|
|
|
const readSecret = async (
|
|
id: number,
|
|
column: 'access_token_ciphertext' | 'refresh_token_ciphertext' | 'signing_secret_ciphertext'
|
|
): Promise<string | null> => {
|
|
const { rows } = await query<Record<string, string | null>>(
|
|
`SELECT ${column} AS value FROM integrations WHERE id = $1`,
|
|
[id]
|
|
);
|
|
const value = rows[0]?.value;
|
|
return value ? decryptSecret(value) : null;
|
|
};
|
|
|
|
export const getAccessToken = (id: number): Promise<string | null> =>
|
|
readSecret(id, 'access_token_ciphertext');
|
|
|
|
export const getRefreshToken = (id: number): Promise<string | null> =>
|
|
readSecret(id, 'refresh_token_ciphertext');
|
|
|
|
export const getSigningSecret = (id: number): Promise<string | null> =>
|
|
readSecret(id, 'signing_secret_ciphertext');
|