Share secret-backed credential values (#454)

Rhys Sullivan committed 6 months ago

Commit 9639a681 parent 899a99e17 files · +768 −954Browse files

Showing the changes to packages/plugins/openapi/src (3 of 17 files). Show all

Unified · Split

3 files

packages/plugins/openapi/src/api/group.ts +1 −9
packages/plugins/openapi/src/sdk/plugin.ts +18 −25
packages/plugins/openapi/src/sdk/types.ts +6 −16

packages/plugins/openapi/src/api/group.ts+1−9

 import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema } from "@effect/platform";
 import { Schema } from "effect";
-import { ScopeId } from "@executor/sdk";
+import { ScopeId, SecretBackedValue } from "@executor/sdk";
 import { InternalError } from "@executor/api";
 import { OpenApiParseError, OpenApiExtractionError, OpenApiOAuthError } from "../sdk/errors";
 const namespaceParam = HttpApiSchema.param("namespace", Schema.String);
 const sourceScopeIdParam = HttpApiSchema.param("sourceScopeId", ScopeId);
-const SecretBackedValue = Schema.Union(
-  Schema.String,
-  Schema.Struct({
-    secretId: Schema.String,
-    prefix: Schema.optional(Schema.String),
-  }),
-);
 const SpecFetchCredentialsPayload = Schema.Struct({
   headers: Schema.optional(Schema.Record({ key: Schema.String, value: SecretBackedValue })),
   queryParams: Schema.optional(Schema.Record({ key: Schema.String, value: SecretBackedValue })),

packages/plugins/openapi/src/sdk/plugin.ts+18−25

   SecretId,
   SourceDetectionResult,
   definePlugin,
+  resolveSecretBackedMap,
   type PluginCtx,
   type StorageFailure,
   type ToolAnnotations,
     return resolved;
   });
-const resolveHeaderValue = (
+const resolveHeaderValues = (
   ctx: PluginCtx<OpenapiStore>,
-  name: string,
+  values: Record<string, HeaderValue> | undefined,
-  value: HeaderValue,
+): Effect.Effect<Record<string, string>, OpenApiOAuthError | StorageFailure> =>
-): Effect.Effect<string, OpenApiOAuthError | StorageFailure> => {
+  resolveSecretBackedMap({
-  if (typeof value === "string") return Effect.succeed(value);
+    values,
-  return ctx.secrets.get(value.secretId).pipe(
+    getSecret: ctx.secrets.get,
-    Effect.mapError((err) =>
+    onMissing: (name) =>
+      new OpenApiOAuthError({
+        message: `Secret not found for "${name}"`,
+      }),
+    onError: (err, name) =>
       "_tag" in err && err._tag === "SecretOwnedByConnectionError"
         ? new OpenApiOAuthError({
             message: `Secret not found for "${name}"`,
           })
         : err,
+  }).pipe(
+    Effect.mapError((err) =>
+      "_tag" in err && err._tag === "SecretOwnedByConnectionError"
+        ? new OpenApiOAuthError({ message: "Secret resolution failed" })
+        : err,
     ),
-    Effect.flatMap((secret) =>
+    Effect.map((resolved) => resolved ?? {}),
-      secret === null
-        ? Effect.fail(
-            new OpenApiOAuthError({
-              message: `Secret not found for "${name}"`,
-            }),
-          )
-        : Effect.succeed(value.prefix ? `${value.prefix}${secret}` : secret),
-    ),
   );
-};
-const resolveHeaderValues = (
-  ctx: PluginCtx<OpenapiStore>,
-  values: Record<string, HeaderValue> | undefined,
-): Effect.Effect<Record<string, string>, OpenApiOAuthError | StorageFailure> =>
-  Effect.forEach(Object.entries(values ?? {}), ([name, value]) =>
-    Effect.map(resolveHeaderValue(ctx, name, value), (resolved) => [name, resolved] as const),
-  ).pipe(Effect.map((entries) => Object.fromEntries(entries)));
 const resolveOAuthConnectionId = (
   ctx: PluginCtx<OpenapiStore>,

packages/plugins/openapi/src/sdk/types.ts+6−16

 import { Schema } from "effect";
-import { ConnectionId, ScopeId, SecretId } from "@executor/sdk";
+import { ConnectionId, ScopeId, SecretBackedValue, SecretId } from "@executor/sdk";
 // ---------------------------------------------------------------------------
 // Branded IDs
 export class MediaBinding extends Schema.Class<MediaBinding>("MediaBinding")({
   contentType: Schema.String,
   schema: Schema.optionalWith(Schema.Unknown, { as: "Option" }),
-  encoding: Schema.optionalWith(
+  encoding: Schema.optionalWith(Schema.Record({ key: Schema.String, value: EncodingObject }), {
-    Schema.Record({ key: Schema.String, value: EncodingObject }),
+    as: "Option",
-    { as: "Option" },
+  }),
-  ),
 }) {}
 export class OperationRequestBody extends Schema.Class<OperationRequestBody>(
  * A header value — either a static string or a reference to a secret.
  * Stored as JSON-serializable data.
  */
-export const HeaderValue = Schema.Union(
+export const HeaderValue = SecretBackedValue;
-  Schema.String,
-  Schema.Struct({
-    secretId: Schema.String,
-    prefix: Schema.optional(Schema.String),
-  }),
-);
 export type HeaderValue = typeof HeaderValue.Type;
 export class ConfiguredHeaderBinding extends Schema.Class<ConfiguredHeaderBinding>(
   prefix: Schema.optional(Schema.String),
 }) {}
-export const ConfiguredHeaderValue = Schema.Union(
+export const ConfiguredHeaderValue = Schema.Union(Schema.String, ConfiguredHeaderBinding);
-  Schema.String,
-  ConfiguredHeaderBinding,
-);
 export type ConfiguredHeaderValue = typeof ConfiguredHeaderValue.Type;
 export const OpenApiSourceBindingValue = Schema.Union(

Share secret-backed credential values (#454)

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code