chore: import upstream snapshot with attribution

apps/sim/app/api/tools/confluence/selector-spaces/route.ts

@@ -0,0 +1,153 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { confluenceSpacesSelectorContract } from '@/lib/api/contracts/selectors/confluence'
+import { parseRequest } from '@/lib/api/server'
+import { authorizeCredentialUse } from '@/lib/auth/credential-access'
+import { validateJiraCloudId } from '@/lib/core/security/input-validation'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
+import {
+  getAtlassianServiceAccountSecret,
+  refreshAccessTokenIfNeeded,
+  resolveOAuthAccountId,
+} from '@/app/api/auth/oauth/utils'
+import { getConfluenceCloudId } from '@/tools/confluence/utils'
+import { parseAtlassianErrorMessage } from '@/tools/jira/utils'
+
+const logger = createLogger('ConfluenceSelectorSpacesAPI')
+
+export const dynamic = 'force-dynamic'
+
+const PAGE_LIMIT = 250
+
+type SpaceStatus = 'current' | 'archived'
+
+/**
+ * Cursor format: `<status>:<innerCursor>`. Empty inner cursor means "first page
+ * of that status". When current is exhausted we hand back `archived:` so the
+ * client transparently flips to the archived stream — listing both surfaces
+ * archived spaces in the dropdown, which would otherwise only be reachable by
+ * typing the space key manually even though sync works against archived spaces.
+ */
+function parseCursor(raw: string | undefined): { status: SpaceStatus; inner?: string } {
+  if (!raw) return { status: 'current' }
+  const idx = raw.indexOf(':')
+  if (idx === -1) return { status: 'current' }
+  const status = raw.slice(0, idx) === 'archived' ? 'archived' : 'current'
+  const inner = raw.slice(idx + 1)
+  return { status, inner: inner || undefined }
+}
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+  try {
+    const parsed = await parseRequest(confluenceSpacesSelectorContract, request, {})
+    if (!parsed.success) return parsed.response
+
+    const { credential, workflowId, domain, cursor } = parsed.data.body
+
+    if (!credential) {
+      logger.error('Missing credential in request')
+      return NextResponse.json({ error: 'Credential is required' }, { status: 400 })
+    }
+
+    if (!domain) {
+      return NextResponse.json({ error: 'Domain is required' }, { status: 400 })
+    }
+
+    const authz = await authorizeCredentialUse(request, {
+      credentialId: credential,
+      workflowId,
+    })
+    if (!authz.ok || !authz.credentialOwnerUserId) {
+      return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status: 403 })
+    }
+
+    const resolved = await resolveOAuthAccountId(credential)
+    const isAtlassianServiceAccount =
+      resolved?.providerId === ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID && !!resolved.credentialId
+
+    let accessToken: string | null
+    let cloudId: string
+    if (isAtlassianServiceAccount) {
+      const secret = await getAtlassianServiceAccountSecret(resolved.credentialId!)
+      accessToken = secret.apiToken
+      cloudId = secret.cloudId
+    } else {
+      accessToken = await refreshAccessTokenIfNeeded(
+        credential,
+        authz.credentialOwnerUserId,
+        requestId
+      )
+      if (!accessToken) {
+        logger.error('Failed to get access token', {
+          credentialId: credential,
+          userId: authz.credentialOwnerUserId,
+        })
+        return NextResponse.json(
+          { error: 'Could not retrieve access token', authRequired: true },
+          { status: 401 }
+        )
+      }
+      cloudId = await getConfluenceCloudId(domain, accessToken)
+    }
+
+    const cloudIdValidation = validateJiraCloudId(cloudId, 'cloudId')
+    if (!cloudIdValidation.isValid) {
+      return NextResponse.json({ error: cloudIdValidation.error }, { status: 400 })
+    }
+
+    const baseUrl = `https://api.atlassian.com/ex/confluence/${cloudIdValidation.sanitized}/wiki/api/v2/spaces`
+    const { status, inner } = parseCursor(cursor)
+
+    const params = new URLSearchParams({ limit: String(PAGE_LIMIT), status })
+    if (inner) params.set('cursor', inner)
+    const url = `${baseUrl}?${params.toString()}`
+
+    const response = await fetch(url, {
+      method: 'GET',
+      headers: { Accept: 'application/json', Authorization: `Bearer ${accessToken}` },
+    })
+
+    if (!response.ok) {
+      const errorText = await response.text()
+      const message = parseAtlassianErrorMessage(response.status, response.statusText, errorText)
+      logger.error('Confluence API error response', { error: message, status: response.status })
+      return NextResponse.json({ error: message }, { status: 502 })
+    }
+
+    const data = await response.json()
+    const spaces = (data.results || []).map((space: { id: string; name: string; key: string }) => ({
+      id: space.id,
+      name: space.name,
+      key: space.key,
+      status,
+    }))
+
+    let nextInner: string | undefined
+    const nextLink = data._links?.next as string | undefined
+    if (nextLink) {
+      try {
+        nextInner = new URL(nextLink, 'https://placeholder').searchParams.get('cursor') || undefined
+      } catch {
+        nextInner = undefined
+      }
+    }
+
+    let nextCursor: string | undefined
+    if (nextInner) {
+      nextCursor = `${status}:${nextInner}`
+    } else if (status === 'current') {
+      nextCursor = 'archived:'
+    }
+
+    return NextResponse.json({ spaces, nextCursor })
+  } catch (error) {
+    logger.error('Error listing Confluence spaces:', error)
+    return NextResponse.json(
+      { error: (error as Error).message || 'Internal server error' },
+      { status: 500 }
+    )
+  }
+})