Fix Google Discovery boundary lint

Rhys Sullivan committed 6 months ago

Commit ed17ac41 parent b039b6e2 files · +179 −233Browse files

Unified · Split

2 files

packages/plugins/google-discovery/src/sdk/binding-store.ts +42 −68
packages/plugins/google-discovery/src/sdk/plugin.ts +137 −165

packages/plugins/google-discovery/src/sdk/binding-store.ts+42−68

 // survive adapter serialization.
 // ---------------------------------------------------------------------------
-import { Effect, Schema } from "effect";
+import { Effect, Option, Schema } from "effect";
-import {
+import { defineSchema, type StorageDeps, type StorageFailure } from "@executor-js/sdk/core";
-  defineSchema,
-  type StorageDeps,
-  type StorageFailure,
-} from "@executor-js/sdk/core";
 import {
   GoogleDiscoveryMethodBinding,
 const decodeBinding = Schema.decodeUnknownSync(GoogleDiscoveryMethodBinding);
 const toJsonRecord = (value: unknown): Record<string, unknown> => value as Record<string, unknown>;
+const decodeString = Schema.decodeUnknownSync(Schema.String);
+const decodeJsonObject = Schema.decodeUnknownSync(Schema.Record(Schema.String, Schema.Unknown));
+const decodeJsonString = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown));
 const decodeJson = (value: unknown): unknown => {
   if (value === null || value === undefined) return value;
   if (typeof value !== "string") return value;
-  try {
+  return Option.getOrElse(decodeJsonString(value), () => value);
-    return JSON.parse(value);
-  } catch {
-    return value;
-  }
 };
 // --- auth column packing/unpacking ------------------------------------------
 ): Record<string, GoogleDiscoveryCredentialValue> => {
   const out: Record<string, GoogleDiscoveryCredentialValue> = {};
   for (const row of rows) {
-    const name = row.name as string;
+    const name = decodeString(row.name);
     if (row.kind === "secret" && typeof row.secret_id === "string") {
       const prefix = row.secret_prefix as string | undefined | null;
-      out[name] = prefix
+      out[name] = prefix ? { secretId: row.secret_id, prefix } : { secretId: row.secret_id };
-        ? { secretId: row.secret_id, prefix }
-        : { secretId: row.secret_id };
     } else if (row.kind === "text" && typeof row.text_value === "string") {
       out[name] = row.text_value;
     }
   /** Source rows whose oauth2 auth columns reference the given secret id.
    *  `slot` distinguishes client_id vs client_secret. */
-  readonly findSourcesBySecret: (
+  readonly findSourcesBySecret: (secretId: string) => Effect.Effect<
-    secretId: string,
-  ) => Effect.Effect<
     readonly {
       readonly namespace: string;
       readonly scope_id: string;
   >;
   /** Source rows whose oauth2 auth points at the given connection id. */
-  readonly findSourcesByConnection: (
+  readonly findSourcesByConnection: (connectionId: string) => Effect.Effect<
-    connectionId: string,
-  ) => Effect.Effect<
     readonly {
       readonly namespace: string;
       readonly scope_id: string;
         });
         if (!row) return null;
         const decoded = decodeBinding(decodeJson(row.binding));
-        return { namespace: row.source_id as string, binding: decoded };
+        return { namespace: decodeString(row.source_id), binding: decoded };
       }),
     putBinding: (toolId, sourceId, scope, binding) =>
             { field: "scope_id", value: scope },
           ],
         });
-        const ids = rows.map((r) => r.id as string);
+        const ids = rows.map((r) => decodeString(r.id));
         yield* db.deleteMany({
           model: "google_discovery_binding",
           where: [
         });
         const out = new Map<string, GoogleDiscoveryMethodBinding>();
         for (const row of rows) {
-          out.set(row.id as string, decodeBinding(decodeJson(row.binding)));
+          out.set(decodeString(row.id), decodeBinding(decodeJson(row.binding)));
         }
         return out;
       }),
         yield* deleteSourceChildren(source.namespace, source.scope);
         const encoded = stripExtractedFields(
-          encodeStoredSourceData(source.config) as Record<string, unknown>,
+          decodeJsonObject(encodeStoredSourceData(source.config)),
         );
         yield* db.create({
           model: "google_discovery_source",
           },
           forceAllowId: true,
         });
-        yield* writeCredentialRows(
+        yield* writeCredentialRows(source.namespace, source.scope, source.config.credentials);
-          source.namespace,
-          source.scope,
-          source.config.credentials,
-        );
       }),
     updateSourceMeta: (sourceId, scope, update) =>
             { field: "scope_id", value: scope },
           ],
           update: {
-            name: update.name ?? (row.name as string),
+            name: update.name ?? decodeString(row.name),
             updated_at: new Date(),
             ...authToColumns(auth),
           },
         });
         if (!row) return null;
         return {
-          namespace: row.id as string,
+          namespace: decodeString(row.id),
-          scope: row.scope_id as string,
+          scope: decodeString(row.scope_id),
-          name: row.name as string,
+          name: decodeString(row.name),
           config: yield* hydrateStoredSourceData(row, sourceId, scope),
         };
       }),
           [
             db.findMany({
               model: "google_discovery_source",
-              where: [
+              where: [{ field: "auth_client_id_secret_id", value: secretId }],
-                { field: "auth_client_id_secret_id", value: secretId },
-              ],
             }),
             db.findMany({
               model: "google_discovery_source",
-              where: [
+              where: [{ field: "auth_client_secret_secret_id", value: secretId }],
-                { field: "auth_client_secret_secret_id", value: secretId },
-              ],
             }),
           ],
           { concurrency: "unbounded" },
         }[] = [];
         for (const r of byClientId) {
           out.push({
-            namespace: r.id as string,
+            namespace: decodeString(r.id),
-            scope_id: r.scope_id as string,
+            scope_id: decodeString(r.scope_id),
-            name: r.name as string,
+            name: decodeString(r.name),
             slot: "auth.oauth2.client_id",
           });
         }
         for (const r of byClientSecret) {
           out.push({
-            namespace: r.id as string,
+            namespace: decodeString(r.id),
-            scope_id: r.scope_id as string,
+            scope_id: decodeString(r.scope_id),
-            name: r.name as string,
+            name: decodeString(r.name),
             slot: "auth.oauth2.client_secret",
           });
         }
         .pipe(
           Effect.map((rows) =>
             rows.map((r) => ({
-              namespace: r.id as string,
+              namespace: decodeString(r.id),
-              scope_id: r.scope_id as string,
+              scope_id: decodeString(r.scope_id),
-              name: r.name as string,
+              name: decodeString(r.name),
               slot: "auth.oauth2.connection",
             })),
           ),
         return [
           ...headers.map((r) => ({
             kind: "credential_header" as const,
-            source_id: r.source_id as string,
+            source_id: decodeString(r.source_id),
-            scope_id: r.scope_id as string,
+            scope_id: decodeString(r.scope_id),
-            name: r.name as string,
+            name: decodeString(r.name),
           })),
           ...params.map((r) => ({
             kind: "credential_query_param" as const,
-            source_id: r.source_id as string,
+            source_id: decodeString(r.source_id),
-            scope_id: r.scope_id as string,
+            scope_id: decodeString(r.scope_id),
-            name: r.name as string,
+            name: decodeString(r.name),
           })),
         ];
       }),
         const requested = new Set(keys);
         const out = new Map<string, string>();
         for (const r of rows) {
-          const key = `${r.scope_id as string}:${r.id as string}`;
+          const key = `${decodeString(r.scope_id)}:${decodeString(r.id)}`;
-          if (requested.has(key)) out.set(key, r.name as string);
+          if (requested.has(key)) out.set(key, decodeString(r.name));
         }
         return out;
       }),
           forceAllowId: true,
         });
       }
-      const paramRows = valueMapToRows(
+      const paramRows = valueMapToRows(sourceId, scope, credentials.queryParams);
-        sourceId,
-        scope,
-        credentials.queryParams,
-      );
       if (paramRows.length > 0) {
         yield* db.createMany({
           model: "google_discovery_source_credential_query_param",
     scope: string,
   ): Effect.Effect<GoogleDiscoveryStoredSourceData, StorageFailure> {
     return Effect.gen(function* () {
-      const partial = decodeJson(row.config) as Record<string, unknown>;
+      const partial = decodeJsonObject(decodeJson(row.config));
       const headerRows = yield* db.findMany({
         model: "google_discovery_source_credential_header",
         where: [
       const headers = rowsToValueMap(headerRows);
       const queryParams = rowsToValueMap(paramRows);
       const credentials =
-        Object.keys(headers).length === 0 &&
+        Object.keys(headers).length === 0 && Object.keys(queryParams).length === 0
-        Object.keys(queryParams).length === 0
           ? undefined
           : {
               ...(Object.keys(headers).length > 0 ? { headers } : {}),
 // Strip auth/credentials from the encoded source-data shape. Those
 // moved to columns and child tables; the remaining structural fields
 // live in the `config` JSON.
-const stripExtractedFields = (
+const stripExtractedFields = (encoded: Record<string, unknown>): Record<string, unknown> => {
-  encoded: Record<string, unknown>,
-): Record<string, unknown> => {
   const { auth, credentials, ...rest } = encoded;
   void auth;
   void credentials;

packages/plugins/google-discovery/src/sdk/plugin.ts+137−165

-import { Effect, Option } from "effect";
+import { Effect, Option, Predicate, Schema } from "effect";
 import {
   ScopeId,
 } from "@executor-js/sdk/core";
 import { GoogleDiscoveryGroup } from "../api/group";
-import {
+import { GoogleDiscoveryExtensionService, GoogleDiscoveryHandlers } from "../api/handlers";
-  GoogleDiscoveryExtensionService,
-  GoogleDiscoveryHandlers,
-} from "../api/handlers";
 import {
   googleDiscoverySchema,
   makeGoogleDiscoveryStore,
   type GoogleDiscoveryStore,
-  type GoogleDiscoveryStoredSource,
 } from "./binding-store";
 import { extractGoogleDiscoveryManifest } from "./document";
 import { annotationsForOperation, invokeGoogleDiscoveryTool } from "./invoke";
   | GoogleDiscoverySourceError
   | StorageFailure;
-export interface GoogleDiscoveryPluginExtension {
-  readonly probeDiscovery: (
-    input: string | GoogleDiscoveryProbeInput,
-  ) => Effect.Effect<
-    GoogleDiscoveryProbeResult,
-    GoogleDiscoveryParseError | GoogleDiscoverySourceError
-  >;
-  readonly addSource: (
-    input: GoogleDiscoveryAddSourceInput,
-  ) => Effect.Effect<
-    { readonly toolCount: number; readonly namespace: string },
-    GoogleDiscoveryParseError | GoogleDiscoverySourceError | StorageFailure
-  >;
-  readonly removeSource: (namespace: string, scope: string) => Effect.Effect<void, StorageFailure>;
-  readonly getSource: (
-    namespace: string,
-    scope: string,
-  ) => Effect.Effect<GoogleDiscoveryStoredSource | null, StorageFailure>;
-  readonly updateSource: (
-    namespace: string,
-    scope: string,
-    input: GoogleDiscoveryUpdateSourceInput,
-  ) => Effect.Effect<void, StorageFailure>;
-}
 // ---------------------------------------------------------------------------
 // URL normalization + slug helpers (unchanged)
 // ---------------------------------------------------------------------------
 const DISCOVERY_SERVICE_HOST = "https://www.googleapis.com/discovery/v1/apis";
+const decodeString = Schema.decodeUnknownSync(Schema.String);
+const isGoogleDiscoverySourceError = (error: unknown): error is GoogleDiscoverySourceError =>
+  Predicate.isTagged("GoogleDiscoverySourceError")(error);
 const normalizeDiscoveryUrl = (discoveryUrl: string): string => {
   const trimmed = discoveryUrl.trim();
   if (trimmed.length === 0) return trimmed;
-  let parsed: URL;
+  if (!URL.canParse(trimmed)) return trimmed;
-  try {
+  const parsed = new URL(trimmed);
-    parsed = new URL(trimmed);
-  } catch {
-    return trimmed;
-  }
   if (parsed.pathname !== "/$discovery/rest") return trimmed;
   const version = parsed.searchParams.get("version")?.trim();
   if (!version) return trimmed;
         }),
     }).pipe(
       Effect.mapError((err) =>
-        err instanceof GoogleDiscoverySourceError
+        isGoogleDiscoverySourceError(err)
           ? err
           : new GoogleDiscoverySourceError({ message: "Secret resolution failed" }),
       ),
         }),
     }).pipe(
       Effect.mapError((err) =>
-        err instanceof GoogleDiscoverySourceError
+        isGoogleDiscoverySourceError(err)
           ? err
           : new GoogleDiscoverySourceError({ message: "Secret resolution failed" }),
       ),
     readonly queryParams?: Record<string, string>;
   },
 ) =>
-  Effect.tryPromise({
+  Effect.gen(function* () {
-    try: async () => {
+    const response = yield* Effect.tryPromise({
-      const url = new URL(normalizeDiscoveryUrl(discoveryUrl));
+      try: () => {
-      for (const [key, value] of Object.entries(credentials?.queryParams ?? {})) {
+        const url = new URL(normalizeDiscoveryUrl(discoveryUrl));
-        url.searchParams.set(key, value);
+        for (const [key, value] of Object.entries(credentials?.queryParams ?? {})) {
-      }
+          url.searchParams.set(key, value);
-      const response = await fetch(url.toString(), {
+        }
-        headers: credentials?.headers,
+        return fetch(url.toString(), {
-        signal: AbortSignal.timeout(20_000),
+          headers: credentials?.headers,
-      });
+          signal: AbortSignal.timeout(20_000),
-      if (!response.ok) {
-        throw new GoogleDiscoverySourceError({
-          message: `Google Discovery fetch failed with status ${response.status}`,
         });
-      }
+      },
-      return response.text();
+      catch: () =>
-    },
+        new GoogleDiscoverySourceError({
-    catch: (cause) =>
+          message: "Google Discovery fetch failed",
-      cause instanceof GoogleDiscoverySourceError
+        }),
-        ? cause
+    });
-        : new GoogleDiscoverySourceError({
+    if (!response.ok) {
-            message: cause instanceof Error ? cause.message : String(cause),
+      return yield* new GoogleDiscoverySourceError({
-          }),
+        message: `Google Discovery fetch failed with status ${response.status}`,
+      });
+    }
+    return yield* Effect.tryPromise({
+      try: () => response.text(),
+      catch: () =>
+        new GoogleDiscoverySourceError({
+          message: "Google Discovery response body read failed",
+        }),
+    });
   });
 const normalizeSlug = (value: string): string =>
     return manifest.methods.length;
   });
+const makeGoogleDiscoveryPluginExtension = (ctx: PluginCtx<GoogleDiscoveryStore>) => ({
+  probeDiscovery: (input: string | GoogleDiscoveryProbeInput) =>
+    Effect.gen(function* () {
+      const discoveryUrl = typeof input === "string" ? input : input.discoveryUrl;
+      const credentials =
+        typeof input === "string"
+          ? undefined
+          : yield* resolveGoogleDiscoveryCredentials(input.credentials, ctx);
+      const text = yield* fetchDiscoveryDocument(discoveryUrl, credentials);
+      const manifest = yield* extractGoogleDiscoveryManifest(text);
+      const scopes = Object.keys(
+        Option.isSome(manifest.oauthScopes) ? manifest.oauthScopes.value : {},
+      ).sort();
+      const operations = manifest.methods.map((method) => ({
+        toolPath: method.toolPath,
+        method: method.binding.method,
+        pathTemplate: method.binding.pathTemplate,
+        description: Option.isSome(method.description) ? method.description.value : null,
+      }));
+      return {
+        name: Option.isSome(manifest.title)
+          ? manifest.title.value
+          : `${manifest.service} ${manifest.version}`,
+        title: Option.isSome(manifest.title) ? manifest.title.value : null,
+        service: manifest.service,
+        version: manifest.version,
+        toolCount: manifest.methods.length,
+        scopes,
+        operations,
+      };
+    }),
+  addSource: (input: GoogleDiscoveryAddSourceInput) =>
+    ctx.transaction(
+      Effect.gen(function* () {
+        const credentials = yield* resolveGoogleDiscoveryCredentials(input.credentials, ctx);
+        const text = yield* fetchDiscoveryDocument(input.discoveryUrl, credentials);
+        const manifest = yield* extractGoogleDiscoveryManifest(text);
+        const namespace =
+          input.namespace ??
+          deriveNamespace({
+            name: input.name,
+            service: manifest.service,
+            version: manifest.version,
+          });
+        const sourceData = new GoogleDiscoveryStoredSourceDataSchema({
+          name: input.name,
+          discoveryUrl: normalizeDiscoveryUrl(input.discoveryUrl),
+          credentials: input.credentials,
+          service: manifest.service,
+          version: manifest.version,
+          rootUrl: manifest.rootUrl,
+          servicePath: manifest.servicePath,
+          auth: input.auth,
+        });
+        const toolCount = yield* registerManifest(
+          ctx,
+          namespace,
+          input.scope,
+          manifest,
+          sourceData,
+        );
+        return { toolCount, namespace };
+      }),
+    ),
+  removeSource: (namespace: string, scope: string) =>
+    ctx.transaction(
+      Effect.gen(function* () {
+        yield* ctx.storage.removeBindingsBySource(namespace, scope);
+        yield* ctx.storage.removeSource(namespace, scope);
+        yield* ctx.core.sources.unregister(namespace).pipe(Effect.ignore);
+      }),
+    ),
+  // OAuth start/complete live on `ctx.oauth` now — the UI calls
+  // the shared `/scopes/:scopeId/oauth/*` endpoints directly with a
+  // Google-specific `authorization-code` strategy and writes the
+  // resulting connection back via `updateSource`.
+  getSource: (namespace: string, scope: string) => ctx.storage.getSource(namespace, scope),
+  updateSource: (namespace: string, scope: string, input: GoogleDiscoveryUpdateSourceInput) =>
+    ctx.storage.updateSourceMeta(namespace, scope, {
+      name: input.name?.trim() || undefined,
+      auth: input.auth,
+    }),
+});
+export type GoogleDiscoveryPluginExtension = ReturnType<typeof makeGoogleDiscoveryPluginExtension>;
 // ---------------------------------------------------------------------------
 // Plugin
 // ---------------------------------------------------------------------------
   schema: googleDiscoverySchema,
   storage: (deps) => makeGoogleDiscoveryStore(deps),
-  extension: (ctx) =>
+  extension: makeGoogleDiscoveryPluginExtension,
-    ({
-      probeDiscovery: (input) =>
-        Effect.gen(function* () {
-          const discoveryUrl = typeof input === "string" ? input : input.discoveryUrl;
-          const credentials =
-            typeof input === "string"
-              ? undefined
-              : yield* resolveGoogleDiscoveryCredentials(input.credentials, ctx);
-          const text = yield* fetchDiscoveryDocument(discoveryUrl, credentials);
-          const manifest = yield* extractGoogleDiscoveryManifest(text);
-          const scopes = Object.keys(
-            Option.isSome(manifest.oauthScopes) ? manifest.oauthScopes.value : {},
-          ).sort();
-          const operations = manifest.methods.map((method) => ({
-            toolPath: method.toolPath,
-            method: method.binding.method,
-            pathTemplate: method.binding.pathTemplate,
-            description: Option.isSome(method.description) ? method.description.value : null,
-          }));
-          return {
-            name: Option.isSome(manifest.title)
-              ? manifest.title.value
-              : `${manifest.service} ${manifest.version}`,
-            title: Option.isSome(manifest.title) ? manifest.title.value : null,
-            service: manifest.service,
-            version: manifest.version,
-            toolCount: manifest.methods.length,
-            scopes,
-            operations,
-          };
-        }),
-      addSource: (input) =>
-        ctx.transaction(
-          Effect.gen(function* () {
-            const credentials = yield* resolveGoogleDiscoveryCredentials(input.credentials, ctx);
-            const text = yield* fetchDiscoveryDocument(input.discoveryUrl, credentials);
-            const manifest = yield* extractGoogleDiscoveryManifest(text);
-            const namespace =
-              input.namespace ??
-              deriveNamespace({
-                name: input.name,
-                service: manifest.service,
-                version: manifest.version,
-              });
-            const sourceData = new GoogleDiscoveryStoredSourceDataSchema({
-              name: input.name,
-              discoveryUrl: normalizeDiscoveryUrl(input.discoveryUrl),
-              credentials: input.credentials,
-              service: manifest.service,
-              version: manifest.version,
-              rootUrl: manifest.rootUrl,
-              servicePath: manifest.servicePath,
-              auth: input.auth,
-            });
-            const toolCount = yield* registerManifest(
-              ctx,
-              namespace,
-              input.scope,
-              manifest,
-              sourceData,
-            );
-            return { toolCount, namespace };
-          }),
-        ),
-      removeSource: (namespace, scope) =>
-        ctx.transaction(
-          Effect.gen(function* () {
-            yield* ctx.storage.removeBindingsBySource(namespace, scope);
-            yield* ctx.storage.removeSource(namespace, scope);
-            yield* ctx.core.sources.unregister(namespace).pipe(Effect.ignore);
-          }),
-        ),
-      // OAuth start/complete live on `ctx.oauth` now — the UI calls
-      // the shared `/scopes/:scopeId/oauth/*` endpoints directly with a
-      // Google-specific `authorization-code` strategy and writes the
-      // resulting connection back via `updateSource`.
-      getSource: (namespace, scope) => ctx.storage.getSource(namespace, scope),
-      updateSource: (namespace, scope, input) =>
-        ctx.storage.updateSourceMeta(namespace, scope, {
-          name: input.name?.trim() || undefined,
-          auth: input.auth,
-        }),
-    }) satisfies GoogleDiscoveryPluginExtension,
   invokeTool: ({ ctx, toolRow, args }) =>
     invokeGoogleDiscoveryTool({
       ctx: ctx as PluginCtx<GoogleDiscoveryStore>,
       toolId: toolRow.id,
-      toolScope: toolRow.scope_id as string,
+      toolScope: decodeString(toolRow.scope_id),
       args,
     }),
     Effect.gen(function* () {
       const typedCtx = ctx as PluginCtx<GoogleDiscoveryStore>;
       const scopes = new Set<string>();
-      for (const row of toolRows) scopes.add(row.scope_id as string);
+      for (const row of toolRows) scopes.add(decodeString(row.scope_id));
       const byScope = new Map<string, ReadonlyMap<string, GoogleDiscoveryMethodBinding>>();
       for (const scope of scopes) {
         const bindings = yield* typedCtx.storage.getBindingsForSource(sourceId, scope);
       }
       const out: Record<string, ToolAnnotations> = {};
       for (const row of toolRows) {
-        const binding = byScope.get(row.scope_id as string)?.get(row.id);
+        const binding = byScope.get(decodeString(row.scope_id))?.get(row.id);
         if (binding) {
           out[row.id] = annotationsForOperation(binding.method, binding.pathTemplate);
         }
   usagesForSecret: ({ ctx, args }) =>
     Effect.gen(function* () {
       const typedCtx = ctx as PluginCtx<GoogleDiscoveryStore>;
-      const sources = yield* typedCtx.storage.findSourcesBySecret(
+      const sources = yield* typedCtx.storage.findSourcesBySecret(args.secretId);
-        args.secretId,
+      const childRows = yield* typedCtx.storage.findCredentialRowsBySecret(args.secretId);
-      );
-      const childRows = yield* typedCtx.storage.findCredentialRowsBySecret(
-        args.secretId,
-      );
       const sourceKeys = new Set<string>();
       for (const s of sources) sourceKeys.add(`${s.scope_id}:${s.namespace}`);
-      for (const r of childRows)
+      for (const r of childRows) sourceKeys.add(`${r.scope_id}:${r.source_id}`);
-        sourceKeys.add(`${r.scope_id}:${r.source_id}`);
       const names = yield* typedCtx.storage.lookupSourceNames([...sourceKeys]);
       const out: Usage[] = [];
   usagesForConnection: ({ ctx, args }) =>
     Effect.gen(function* () {
       const typedCtx = ctx as PluginCtx<GoogleDiscoveryStore>;
-      const sources = yield* typedCtx.storage.findSourcesByConnection(
+      const sources = yield* typedCtx.storage.findSourcesByConnection(args.connectionId);
-        args.connectionId,
-      );
       return sources.map(
         (s) =>
           new Usage({
         servicePath: manifest.servicePath,
       });
       yield* registerManifest(typedCtx, sourceId, scope, manifest, next);
-    }).pipe(Effect.mapError((err) => (err instanceof Error ? err : new Error(String(err))))),
+    }),
   // Connection refresh is owned by the canonical `"oauth2"`
   // ConnectionProvider registered by core — no plugin-specific handler