connections: extract sign-in state into a first-class SDK primitive

Introduces a `Connection` resource on the core SDK (`ctx.connections`) that owns live OAuth access/refresh tokens and the plugin-specific providerState needed to refresh them. Plugins register a `ConnectionProvider` alongside their secret providers; source auth configs become thin pointers (`{kind: "oauth2", connectionId}`) instead of inlining secret/token state. - core/sdk: ConnectionId brand, ConnectionRef, CreateConnectionInput, ConnectionRefreshError, ConnectionRefreshInput, executor.connections (get/list/remove/accessToken), plugin.connectionProviders hook. - core/api: /scopes/:id/connections endpoints + handler group, secrets list filter that hides connection-owned rows. - storage: new `connection` table (drizzle migrations for cloud + local). - plugins (openapi, google-discovery, mcp): migrated onto ctx.connections, widened stored-auth schemas to carry the full OAuth config so re-sign-in is reproducible without the prior Connection row existing. - react: `/connections` page with removal; signIn slot on SourcePlugin; per-plugin SignInButton mounted on the source detail top bar with dynamic "Sign in" / "Reconnect" copy driven by `connectionsAtom`. - openapi store: tolerant oauth2 decode at the row boundary so legacy rows written before the schema widening surface without OAuth attached instead of crashing the source list. - oauth2 plugin: removes the dead standalone refresh module now that refresh lives behind ctx.connections.

Rhys Sullivan committed 6 months ago

Commit bd7faba1 parent 7909ef473 files · +6087 −2239Browse files

Showing the changes to packages/plugins/openapi/src/api (2 of 73 files). Show all

Unified · Split

2 files

packages/plugins/openapi/src/api/group.ts +6 −6
packages/plugins/openapi/src/api/handlers.ts +1 −3

packages/plugins/openapi/src/api/group.ts+6−6

   name: Schema.optional(Schema.String),
   baseUrl: Schema.optional(Schema.String),
   headers: Schema.optional(Schema.Record({ key: Schema.String, value: Schema.Unknown })),
+  // Set after a successful re-authenticate to rewrite the source's
+  // OAuth2Auth pointer to the freshly minted connection.
+  oauth2: Schema.optional(OAuth2Auth),
 });
 const UpdateSourceResponse = Schema.Struct({
 // ---------------------------------------------------------------------------
 // Shared identity fields for both OAuth2 flows. `tokenScope` names which
-// executor scope will own the minted tokens (typically the per-user scope).
+// executor scope will own the resulting Connection (typically the per-user
-// The token secret ids are pre-decided so the source's stored `OAuth2Auth`
+// scope). Token secret ids are minted by the SDK from the Connection id —
-// can reference the same ids across every user — per-user values shadow
+// callers never pick them.
-// org-level fallbacks via secret fall-through on read.
 const StartOAuthIdentityFields = {
   displayName: Schema.String,
   securitySchemeName: Schema.String,
   clientIdSecretId: Schema.String,
   scopes: Schema.Array(Schema.String),
   tokenScope: Schema.optional(ScopeId),
-  accessTokenSecretId: Schema.String,
 } as const;
 const StartOAuthPayload = Schema.Union(
     authorizationUrl: Schema.String,
     redirectUrl: Schema.String,
     clientSecretSecretId: Schema.optional(Schema.NullOr(Schema.String)),
-    refreshTokenSecretId: Schema.optional(Schema.NullOr(Schema.String)),
   }),
   // RFC 6749 §4.4 — no user-interactive step, no session, no popup. The
   // plugin exchanges tokens inline and returns a completed auth. The

packages/plugins/openapi/src/api/handlers.ts+1−3

           name: payload.name,
           baseUrl: payload.baseUrl,
           headers: payload.headers as Record<string, HeaderValue> | undefined,
+          oauth2: payload.oauth2,
         } as OpenApiUpdateSourceInput);
         return { updated: true };
       })),
             clientSecretSecretId: payload.clientSecretSecretId,
             scopes: [...payload.scopes],
             tokenScope,
-            accessTokenSecretId: payload.accessTokenSecretId,
           });
         }
         return yield* ext.startOAuth({
           clientSecretSecretId: payload.clientSecretSecretId ?? null,
           scopes: [...payload.scopes],
           tokenScope,
-          accessTokenSecretId: payload.accessTokenSecretId,
-          refreshTokenSecretId: payload.refreshTokenSecretId ?? null,
         });
       })),
     )

connections: extract sign-in state into a first-class SDK primitive

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code