chore: import upstream snapshot with attribution

apps/sim/lib/api/contracts/credentials.ts

@@ -0,0 +1,439 @@
+import { z } from 'zod'
+import { defineRouteContract } from '@/lib/api/contracts/types'
+import {
+  ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID,
+  type OAuthProvider,
+  SLACK_CUSTOM_BOT_PROVIDER_ID,
+} from '@/lib/oauth/types'
+
+const ENV_VAR_NAME_REGEX = /^[A-Za-z0-9_]+$/
+
+export function normalizeCredentialEnvKey(raw: string): string {
+  const trimmed = raw.trim()
+  const wrappedMatch = /^\{\{\s*([A-Za-z0-9_]+)\s*\}\}$/.exec(trimmed)
+  return wrappedMatch ? wrappedMatch[1] : trimmed
+}
+
+export const workspaceCredentialTypeSchema = z.enum([
+  'oauth',
+  'env_workspace',
+  'env_personal',
+  'service_account',
+])
+export const workspaceCredentialRoleSchema = z.enum(['admin', 'member'])
+export const workspaceCredentialMemberStatusSchema = z.enum(['active', 'pending', 'revoked'])
+
+export const workspaceCredentialSchema = z.object({
+  id: z.string(),
+  workspaceId: z.string(),
+  type: workspaceCredentialTypeSchema,
+  displayName: z.string(),
+  description: z.string().nullable(),
+  providerId: z.string().nullable(),
+  accountId: z.string().nullable(),
+  envKey: z.string().nullable(),
+  envOwnerUserId: z.string().nullable(),
+  createdBy: z.string(),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+  role: workspaceCredentialRoleSchema.optional(),
+  status: workspaceCredentialMemberStatusSchema.optional(),
+})
+
+export type WorkspaceCredentialType = z.output<typeof workspaceCredentialTypeSchema>
+export type WorkspaceCredentialRole = z.output<typeof workspaceCredentialRoleSchema>
+export type WorkspaceCredentialMemberStatus = z.output<typeof workspaceCredentialMemberStatusSchema>
+export type WorkspaceCredential = z.output<typeof workspaceCredentialSchema>
+
+export const credentialsListQuerySchema = z.object({
+  workspaceId: z.string().uuid('Workspace ID must be a valid UUID'),
+  type: workspaceCredentialTypeSchema.optional(),
+  providerId: z.string().optional(),
+})
+
+export const credentialIdParamsSchema = z.object({
+  id: z.string().min(1),
+})
+
+export const credentialsListGetQuerySchema = z.object({
+  workspaceId: z.string().uuid('Workspace ID must be a valid UUID'),
+  type: workspaceCredentialTypeSchema.optional(),
+  providerId: z.string().optional(),
+  credentialId: z.string().optional(),
+})
+
+export const serviceAccountJsonSchema = z
+  .string()
+  .min(1, 'Service account JSON key is required')
+  .transform((val, ctx) => {
+    try {
+      const parsed = JSON.parse(val)
+      if (parsed.type !== 'service_account') {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'JSON key must have type "service_account"',
+        })
+        return z.NEVER
+      }
+      if (!parsed.client_email || typeof parsed.client_email !== 'string') {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'JSON key must contain a valid client_email',
+        })
+        return z.NEVER
+      }
+      if (!parsed.private_key || typeof parsed.private_key !== 'string') {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'JSON key must contain a valid private_key',
+        })
+        return z.NEVER
+      }
+      if (!parsed.project_id || typeof parsed.project_id !== 'string') {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'JSON key must contain a valid project_id',
+        })
+        return z.NEVER
+      }
+      return parsed as {
+        type: 'service_account'
+        client_email: string
+        private_key: string
+        project_id: string
+        [key: string]: unknown
+      }
+    } catch {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'Invalid JSON format',
+      })
+      return z.NEVER
+    }
+  })
+
+export const createCredentialBodySchema = z
+  .object({
+    workspaceId: z.string().uuid('Workspace ID must be a valid UUID'),
+    type: workspaceCredentialTypeSchema,
+    displayName: z.string().trim().min(1).max(255).optional(),
+    description: z.string().trim().max(500).optional(),
+    providerId: z.string().trim().min(1).optional(),
+    accountId: z.string().trim().min(1).optional(),
+    envKey: z.string().trim().min(1).optional(),
+    envOwnerUserId: z.string().trim().min(1).optional(),
+    serviceAccountJson: z.string().optional(),
+    apiToken: z.string().trim().min(1).optional(),
+    domain: z.string().trim().min(1).optional(),
+    /**
+     * Client-supplied credential id, honored only for `slack-custom-bot` creates:
+     * the setup modal shows the ingest URL `/api/webhooks/slack/custom/{id}`
+     * before secrets exist, so the id must be known up front.
+     */
+    id: z.string().uuid('id must be a valid UUID').optional(),
+    signingSecret: z.string().trim().min(1).optional(),
+    botToken: z.string().trim().min(1).optional(),
+  })
+  .superRefine((data, ctx) => {
+    if (data.type === 'oauth') {
+      if (!data.accountId) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'accountId is required for oauth credentials',
+          path: ['accountId'],
+        })
+      }
+      if (!data.providerId) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'providerId is required for oauth credentials',
+          path: ['providerId'],
+        })
+      }
+      if (!data.displayName) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'displayName is required for oauth credentials',
+          path: ['displayName'],
+        })
+      }
+      return
+    }
+
+    if (data.type === 'service_account') {
+      if (data.providerId === ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID) {
+        if (!data.apiToken) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'apiToken is required for Atlassian service account credentials',
+            path: ['apiToken'],
+          })
+        }
+        if (!data.domain) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'domain is required for Atlassian service account credentials',
+            path: ['domain'],
+          })
+        }
+        return
+      }
+      if (data.providerId === SLACK_CUSTOM_BOT_PROVIDER_ID) {
+        if (!data.signingSecret) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'signingSecret is required for a custom Slack bot credential',
+            path: ['signingSecret'],
+          })
+        }
+        if (!data.botToken) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'botToken is required for a custom Slack bot credential',
+            path: ['botToken'],
+          })
+        }
+        return
+      }
+      if (!data.serviceAccountJson) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'serviceAccountJson is required for service account credentials',
+          path: ['serviceAccountJson'],
+        })
+      }
+      return
+    }
+
+    const normalizedEnvKey = data.envKey ? normalizeCredentialEnvKey(data.envKey) : ''
+    if (!normalizedEnvKey) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'envKey is required for env credentials',
+        path: ['envKey'],
+      })
+      return
+    }
+
+    if (!ENV_VAR_NAME_REGEX.test(normalizedEnvKey)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'envKey must contain only letters, numbers, and underscores',
+        path: ['envKey'],
+      })
+    }
+  })
+
+export const updateCredentialByIdBodySchema = z
+  .object({
+    displayName: z.string().trim().min(1).max(255).optional(),
+    description: z.string().trim().max(500).nullish(),
+    serviceAccountJson: z.string().min(1).optional(),
+    /** Slack custom-bot secret rotation (reconnect). */
+    signingSecret: z.string().trim().min(1).optional(),
+    botToken: z.string().trim().min(1).optional(),
+    /** Atlassian service-account secret rotation (reconnect). */
+    apiToken: z.string().trim().min(1).optional(),
+    domain: z.string().trim().min(1).optional(),
+  })
+  .strict()
+  .refine(
+    (data) =>
+      data.displayName !== undefined ||
+      data.description !== undefined ||
+      data.serviceAccountJson !== undefined ||
+      data.signingSecret !== undefined ||
+      data.botToken !== undefined ||
+      data.apiToken !== undefined ||
+      data.domain !== undefined,
+    {
+      message: 'At least one field must be provided',
+      path: ['displayName'],
+    }
+  )
+
+export const leaveCredentialQuerySchema = z.object({
+  credentialId: z.string().min(1),
+})
+
+export const workspaceCredentialMemberSchema = z.object({
+  id: z.string(),
+  userId: z.string(),
+  role: workspaceCredentialRoleSchema,
+  status: workspaceCredentialMemberStatusSchema,
+  joinedAt: z.string().nullable(),
+  invitedBy: z.string().nullable().optional(),
+  createdAt: z.string().optional(),
+  updatedAt: z.string().optional(),
+  userName: z.string().nullable(),
+  userEmail: z.string().nullable(),
+  userImage: z.string().nullable().optional(),
+  /** `workspace-admin` roles are derived from workspace admin and cannot be changed. */
+  roleSource: z.enum(['explicit', 'workspace-admin']).optional(),
+})
+
+export type WorkspaceCredentialMember = z.output<typeof workspaceCredentialMemberSchema>
+
+export const createCredentialDraftBodySchema = z.object({
+  workspaceId: z.string().min(1),
+  providerId: z.string().min(1),
+  displayName: z.string().min(1),
+  description: z.string().trim().max(500).optional(),
+  credentialId: z.string().min(1).optional(),
+})
+
+export const upsertWorkspaceCredentialMemberBodySchema = z.object({
+  userId: z.string().min(1),
+  role: workspaceCredentialRoleSchema.default('member'),
+})
+
+export const removeWorkspaceCredentialMemberQuerySchema = z.object({
+  userId: z.string().min(1),
+})
+
+export const oauthCredentialSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  provider: z.custom<OAuthProvider>((value) => typeof value === 'string'),
+  type: z.enum(['oauth', 'service_account']).optional(),
+  serviceId: z.string().optional(),
+  lastUsed: z.string().optional(),
+  isDefault: z.boolean().optional(),
+  scopes: z.array(z.string()).optional(),
+})
+
+export const oauthCredentialsQuerySchema = z
+  .object({
+    provider: z.string().nullish(),
+    workflowId: z.string().uuid('Workflow ID must be a valid UUID').nullish(),
+    workspaceId: z.string().uuid('Workspace ID must be a valid UUID').nullish(),
+    credentialId: z.string().min(1, 'Credential ID must not be empty').max(255).nullish(),
+  })
+  .refine((data) => data.provider || data.credentialId, {
+    message: 'Provider or credentialId is required',
+    path: ['provider'],
+  })
+
+export const listWorkspaceCredentialsContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/credentials',
+  query: credentialsListQuerySchema,
+  response: {
+    mode: 'json',
+    schema: z.object({
+      credentials: z.array(workspaceCredentialSchema),
+    }),
+  },
+})
+
+export const getWorkspaceCredentialContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/credentials/[id]',
+  params: credentialIdParamsSchema,
+  response: {
+    mode: 'json',
+    schema: z.object({
+      credential: workspaceCredentialSchema.nullable(),
+    }),
+  },
+})
+
+export const listOAuthCredentialsContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/auth/oauth/credentials',
+  query: oauthCredentialsQuerySchema,
+  response: {
+    mode: 'json',
+    schema: z.object({
+      credentials: z.array(oauthCredentialSchema),
+    }),
+  },
+})
+
+export const listWorkspaceCredentialMembersContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/credentials/[id]/members',
+  params: credentialIdParamsSchema,
+  response: {
+    mode: 'json',
+    schema: z.object({
+      members: z.array(workspaceCredentialMemberSchema).optional(),
+    }),
+  },
+})
+
+export const createCredentialDraftContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/credentials/draft',
+  body: createCredentialDraftBodySchema,
+  response: {
+    mode: 'json',
+    schema: z.object({
+      success: z.literal(true),
+    }),
+  },
+})
+
+export const createWorkspaceCredentialContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/credentials',
+  body: createCredentialBodySchema,
+  response: {
+    mode: 'json',
+    schema: z.object({
+      credential: workspaceCredentialSchema,
+    }),
+  },
+})
+
+export const updateWorkspaceCredentialContract = defineRouteContract({
+  method: 'PUT',
+  path: '/api/credentials/[id]',
+  params: credentialIdParamsSchema,
+  body: updateCredentialByIdBodySchema,
+  response: {
+    mode: 'json',
+    schema: z.object({
+      credential: workspaceCredentialSchema.nullable(),
+    }),
+  },
+})
+
+export const deleteWorkspaceCredentialContract = defineRouteContract({
+  method: 'DELETE',
+  path: '/api/credentials/[id]',
+  params: credentialIdParamsSchema,
+  response: {
+    mode: 'json',
+    schema: z.object({
+      success: z.literal(true),
+    }),
+  },
+})
+
+export const upsertWorkspaceCredentialMemberContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/credentials/[id]/members',
+  params: credentialIdParamsSchema,
+  body: upsertWorkspaceCredentialMemberBodySchema,
+  response: {
+    mode: 'json',
+    schema: z.object({
+      success: z.literal(true),
+      member: workspaceCredentialMemberSchema.optional(),
+    }),
+  },
+})
+
+export const removeWorkspaceCredentialMemberContract = defineRouteContract({
+  method: 'DELETE',
+  path: '/api/credentials/[id]/members',
+  params: credentialIdParamsSchema,
+  query: removeWorkspaceCredentialMemberQuerySchema,
+  response: {
+    mode: 'json',
+    schema: z.object({
+      success: z.literal(true),
+    }),
+  },
+})