Skip to content

Commit c7f6f7e

Browse files
TheodoreSpeaksTheodoreSpeaks
committed
refactor(credentials): migrate groups to application boundary
1 parent 018f688 commit c7f6f7e

39 files changed

Lines changed: 1888 additions & 633 deletions

File tree

‎apps/sim/app/api/credential-groups/enroll/[token]/complete/route.test.ts‎

Lines changed: 34 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,34 @@
44
import { NextRequest, NextResponse } from 'next/server'
55
import { beforeEach, describe, expect, it, vi } from 'vitest'
66

7-
const { mockCompleteEnrollment, mockIpRateLimit } = vi.hoisted(() => ({
8-
mockCompleteEnrollment: vi.fn(),
9-
mockIpRateLimit: vi.fn(),
7+
const mocks = vi.hoisted(() => ({
8+
authenticate: vi.fn(),
9+
complete: vi.fn(),
10+
ipRateLimit: vi.fn(),
1011
}))
1112

12-
vi.mock('@/lib/credential-groups/enrollments', () => ({
13-
completeCredentialGroupEnrollment: mockCompleteEnrollment,
13+
vi.mock('@/lib/credential-groups/application/enrollment-auth', () => ({
14+
authenticateCredentialGroupEnrollment: mocks.authenticate,
15+
}))
16+
17+
vi.mock('@/lib/credential-groups/application/public-enrollment', () => ({
18+
completePublicCredentialGroupEnrollment: { execute: mocks.complete },
1419
}))
1520

1621
vi.mock('@/lib/credential-groups/rate-limit', () => ({
17-
enforcePublicCredentialGroupIpRateLimit: mockIpRateLimit,
22+
enforcePublicCredentialGroupIpRateLimit: mocks.ipRateLimit,
1823
}))
1924

2025
import { POST } from '@/app/api/credential-groups/enroll/[token]/complete/route'
2126

27+
const principal = {
28+
kind: 'credential_group_enrollment',
29+
workspaceId: 'workspace-1',
30+
credentialGroupId: 'group-1',
31+
enrollmentId: 'enrollment-1',
32+
email: 'alex@example.com',
33+
invitationTokenHash: 'hash-1',
34+
} as const
2235
const context = { params: Promise.resolve({ token: 'invitation-token' }) }
2336

2437
function request() {
@@ -31,23 +44,29 @@ function request() {
3144
describe('credential group enrollment completion route', () => {
3245
beforeEach(() => {
3346
vi.clearAllMocks()
34-
mockIpRateLimit.mockResolvedValue(null)
35-
mockCompleteEnrollment.mockResolvedValue(true)
47+
mocks.ipRateLimit.mockResolvedValue(null)
48+
mocks.authenticate.mockResolvedValue(principal)
49+
mocks.complete.mockResolvedValue({ completed: true })
3650
})
3751

38-
it('submits a fully connected enrollment and redirects to its checklist', async () => {
39-
const response = await POST(request(), context)
52+
it('submits a fully connected enrollment through its invitation principal', async () => {
53+
const enrollmentRequest = request()
54+
const response = await POST(enrollmentRequest, context)
4055

4156
expect(response.status).toBe(307)
4257
expect(response.headers.get('location')).toBe(
4358
'/credential-groups/enroll/invitation-token?submitted=1'
4459
)
4560
expect(response.headers.get('cache-control')).toBe('no-store')
46-
expect(mockCompleteEnrollment).toHaveBeenCalledWith('invitation-token')
61+
expect(mocks.complete).toHaveBeenCalledWith({
62+
principal,
63+
input: {},
64+
request: enrollmentRequest,
65+
})
4766
})
4867

4968
it('redirects an incomplete enrollment without marking it complete', async () => {
50-
mockCompleteEnrollment.mockResolvedValue(false)
69+
mocks.complete.mockResolvedValue({ completed: false })
5170

5271
const response = await POST(request(), context)
5372

@@ -57,13 +76,14 @@ describe('credential group enrollment completion route', () => {
5776
})
5877

5978
it('stops before token lookup when the public IP budget is exhausted', async () => {
60-
mockIpRateLimit.mockResolvedValue(
79+
mocks.ipRateLimit.mockResolvedValue(
6180
NextResponse.json({ error: 'Too many requests' }, { status: 429 })
6281
)
6382

6483
const response = await POST(request(), context)
6584

6685
expect(response.status).toBe(429)
67-
expect(mockCompleteEnrollment).not.toHaveBeenCalled()
86+
expect(mocks.authenticate).not.toHaveBeenCalled()
87+
expect(mocks.complete).not.toHaveBeenCalled()
6888
})
6989
})

‎apps/sim/app/api/credential-groups/enroll/[token]/complete/route.ts‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
import type { NextRequest } from 'next/server'
22
import { completeCredentialGroupEnrollmentContract } from '@/lib/api/contracts/credential-groups'
33
import { parseRequest } from '@/lib/api/server'
4+
import { asOrchestrationError } from '@/lib/core/orchestration/types'
45
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
5-
import { completeCredentialGroupEnrollment } from '@/lib/credential-groups/enrollments'
6+
import { authenticateCredentialGroupEnrollment } from '@/lib/credential-groups/application/enrollment-auth'
7+
import { completePublicCredentialGroupEnrollment } from '@/lib/credential-groups/application/public-enrollment'
68
import { enforcePublicCredentialGroupIpRateLimit } from '@/lib/credential-groups/rate-limit'
79
import { createCredentialGroupEnrollmentRedirect } from '@/app/api/credential-groups/enrollment-redirect'
810

@@ -17,7 +19,20 @@ export const POST = withRouteHandler(
1719
const parsed = await parseRequest(completeCredentialGroupEnrollmentContract, request, context)
1820
if (!parsed.success) return parsed.response
1921
const { token } = parsed.data.params
20-
const completed = await completeCredentialGroupEnrollment(token)
22+
const principal = await authenticateCredentialGroupEnrollment(token)
23+
if (!principal) {
24+
return createCredentialGroupEnrollmentRedirect(token, { oauth: 'unavailable' })
25+
}
26+
const completion = await completePublicCredentialGroupEnrollment
27+
.execute({ principal, input: {}, request })
28+
.catch((error: unknown) => {
29+
if (asOrchestrationError(error)?.code === 'not_found') return null
30+
throw error
31+
})
32+
if (!completion) {
33+
return createCredentialGroupEnrollmentRedirect(token, { oauth: 'unavailable' })
34+
}
35+
const { completed } = completion
2136
if (completed === null) {
2237
return createCredentialGroupEnrollmentRedirect(token, { oauth: 'unavailable' })
2338
}

‎apps/sim/app/api/credential-groups/enroll/[token]/oauth/[optionId]/route.test.ts‎

Lines changed: 38 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -4,30 +4,36 @@
44
import { NextRequest, NextResponse } from 'next/server'
55
import { beforeEach, describe, expect, it, vi } from 'vitest'
66

7-
const { mockGetContext, mockStartOAuth, mockIpRateLimit, mockEnrollmentRateLimit } = vi.hoisted(
8-
() => ({
9-
mockGetContext: vi.fn(),
10-
mockStartOAuth: vi.fn(),
11-
mockIpRateLimit: vi.fn(),
12-
mockEnrollmentRateLimit: vi.fn(),
13-
})
14-
)
7+
const mocks = vi.hoisted(() => ({
8+
authenticate: vi.fn(),
9+
startOAuth: vi.fn(),
10+
ipRateLimit: vi.fn(),
11+
enrollmentRateLimit: vi.fn(),
12+
}))
1513

16-
vi.mock('@/lib/credential-groups/enrollments', () => ({
17-
getCredentialGroupOAuthContext: mockGetContext,
14+
vi.mock('@/lib/credential-groups/application/enrollment-auth', () => ({
15+
authenticateCredentialGroupEnrollment: mocks.authenticate,
1816
}))
1917

20-
vi.mock('@/lib/credential-groups/oauth', () => ({
21-
startCredentialGroupOAuth: mockStartOAuth,
18+
vi.mock('@/lib/credential-groups/application/public-enrollment', () => ({
19+
startPublicCredentialGroupOAuth: { execute: mocks.startOAuth },
2220
}))
2321

2422
vi.mock('@/lib/credential-groups/rate-limit', () => ({
25-
enforcePublicCredentialGroupIpRateLimit: mockIpRateLimit,
26-
enforceCredentialGroupEnrollmentOAuthRateLimit: mockEnrollmentRateLimit,
23+
enforcePublicCredentialGroupIpRateLimit: mocks.ipRateLimit,
24+
enforceCredentialGroupEnrollmentOAuthRateLimit: mocks.enrollmentRateLimit,
2725
}))
2826

2927
import { GET } from '@/app/api/credential-groups/enroll/[token]/oauth/[optionId]/route'
3028

29+
const principal = {
30+
kind: 'credential_group_enrollment',
31+
workspaceId: 'workspace-1',
32+
credentialGroupId: 'group-1',
33+
enrollmentId: 'enrollment-1',
34+
email: 'alex@example.com',
35+
invitationTokenHash: 'hash-1',
36+
} as const
3137
const context = {
3238
params: Promise.resolve({ token: 'invitation-token', optionId: 'option-1' }),
3339
}
@@ -41,42 +47,46 @@ function request() {
4147
describe('credential group OAuth start route', () => {
4248
beforeEach(() => {
4349
vi.clearAllMocks()
44-
mockIpRateLimit.mockResolvedValue(null)
45-
mockEnrollmentRateLimit.mockResolvedValue(null)
46-
mockGetContext.mockResolvedValue({ enrollmentId: 'enrollment-1' })
47-
mockStartOAuth.mockResolvedValue('https://accounts.google.com/o/oauth2/v2/auth?state=state-1')
50+
mocks.ipRateLimit.mockResolvedValue(null)
51+
mocks.enrollmentRateLimit.mockResolvedValue(null)
52+
mocks.authenticate.mockResolvedValue(principal)
53+
mocks.startOAuth.mockResolvedValue({
54+
authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth?state=state-1',
55+
})
4856
})
4957

50-
it('redirects a valid enrollment to Google', async () => {
51-
const response = await GET(request(), context)
58+
it('redirects a valid enrollment to Google through its application operation', async () => {
59+
const oauthRequest = request()
60+
const response = await GET(oauthRequest, context)
5261

5362
expect(response.status).toBe(307)
5463
expect(response.headers.get('location')).toContain('https://accounts.google.com/')
5564
expect(response.headers.get('cache-control')).toBe('no-store')
56-
expect(mockStartOAuth).toHaveBeenCalledWith(
57-
{ enrollmentId: 'enrollment-1' },
58-
'invitation-token'
59-
)
65+
expect(mocks.startOAuth).toHaveBeenCalledWith({
66+
principal,
67+
input: { invitationToken: 'invitation-token', optionId: 'option-1' },
68+
request: oauthRequest,
69+
})
6070
})
6171

6272
it('returns the same 404 for an unavailable enrollment or option', async () => {
63-
mockGetContext.mockResolvedValue(null)
73+
mocks.authenticate.mockResolvedValue(null)
6474

6575
const response = await GET(request(), context)
6676

6777
expect(response.status).toBe(404)
6878
await expect(response.json()).resolves.toEqual({ error: 'Not found' })
69-
expect(mockStartOAuth).not.toHaveBeenCalled()
79+
expect(mocks.startOAuth).not.toHaveBeenCalled()
7080
})
7181

7282
it('stops before token lookup when the public IP budget is exhausted', async () => {
73-
mockIpRateLimit.mockResolvedValue(
83+
mocks.ipRateLimit.mockResolvedValue(
7484
NextResponse.json({ error: 'Too many requests' }, { status: 429 })
7585
)
7686

7787
const response = await GET(request(), context)
7888

7989
expect(response.status).toBe(429)
80-
expect(mockGetContext).not.toHaveBeenCalled()
90+
expect(mocks.authenticate).not.toHaveBeenCalled()
8191
})
8292
})

‎apps/sim/app/api/credential-groups/enroll/[token]/oauth/[optionId]/route.ts‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ import { NextResponse } from 'next/server'
55
import { startCredentialGroupOAuthContract } from '@/lib/api/contracts/credential-groups'
66
import { parseRequest } from '@/lib/api/server'
77
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
8-
import { getCredentialGroupOAuthContext } from '@/lib/credential-groups/enrollments'
9-
import { startCredentialGroupOAuth } from '@/lib/credential-groups/oauth'
8+
import { authenticateCredentialGroupEnrollment } from '@/lib/credential-groups/application/enrollment-auth'
9+
import { startPublicCredentialGroupOAuth } from '@/lib/credential-groups/application/public-enrollment'
1010
import { CredentialGroupOAuthError } from '@/lib/credential-groups/provider-adapter'
1111
import {
1212
enforceCredentialGroupEnrollmentOAuthRateLimit,
@@ -30,21 +30,25 @@ export const GET = withRouteHandler(
3030
const parsed = await parseRequest(startCredentialGroupOAuthContract, request, context)
3131
if (!parsed.success) return parsed.response
3232
const { token, optionId } = parsed.data.params
33-
const enrollment = await getCredentialGroupOAuthContext(token, optionId)
34-
if (!enrollment) {
33+
const principal = await authenticateCredentialGroupEnrollment(token)
34+
if (!principal) {
3535
return NextResponse.json(
3636
{ error: 'Not found' },
3737
{ status: 404, headers: { 'Cache-Control': 'no-store' } }
3838
)
3939
}
4040

4141
const enrollmentLimited = await enforceCredentialGroupEnrollmentOAuthRateLimit(
42-
enrollment.enrollmentId
42+
principal.enrollmentId
4343
)
4444
if (enrollmentLimited) return enrollmentLimited
4545

4646
try {
47-
const authorizationUrl = await startCredentialGroupOAuth(enrollment, token)
47+
const { authorizationUrl } = await startPublicCredentialGroupOAuth.execute({
48+
principal,
49+
input: { invitationToken: token, optionId },
50+
request,
51+
})
4852
const response = NextResponse.redirect(authorizationUrl)
4953
response.headers.set('Cache-Control', 'no-store')
5054
response.headers.set('Referrer-Policy', 'no-referrer')

‎apps/sim/app/api/credential-groups/oauth/[provider]/callback/route.test.ts‎

Lines changed: 38 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -4,31 +4,39 @@
44
import { NextRequest } from 'next/server'
55
import { beforeEach, describe, expect, it, vi } from 'vitest'
66

7-
const { mockConsumeAttempt, mockGetContext, mockCompleteOAuth, mockRateLimit } = vi.hoisted(() => ({
8-
mockConsumeAttempt: vi.fn(),
9-
mockGetContext: vi.fn(),
10-
mockCompleteOAuth: vi.fn(),
11-
mockRateLimit: vi.fn(),
7+
const mocks = vi.hoisted(() => ({
8+
authenticate: vi.fn(),
9+
completeOAuth: vi.fn(),
10+
consumeAttempt: vi.fn(),
11+
rateLimit: vi.fn(),
1212
}))
1313

14-
vi.mock('@/lib/credential-groups/oauth-state', () => ({
15-
consumeCredentialGroupOAuthAttempt: mockConsumeAttempt,
14+
vi.mock('@/lib/credential-groups/application/enrollment-auth', () => ({
15+
authenticateCredentialGroupEnrollment: mocks.authenticate,
1616
}))
1717

18-
vi.mock('@/lib/credential-groups/enrollments', () => ({
19-
getCredentialGroupOAuthContext: mockGetContext,
18+
vi.mock('@/lib/credential-groups/application/public-enrollment', () => ({
19+
completePublicCredentialGroupOAuth: { execute: mocks.completeOAuth },
2020
}))
2121

22-
vi.mock('@/lib/credential-groups/oauth', () => ({
23-
completeCredentialGroupOAuth: mockCompleteOAuth,
22+
vi.mock('@/lib/credential-groups/oauth-state', () => ({
23+
consumeCredentialGroupOAuthAttempt: mocks.consumeAttempt,
2424
}))
2525

2626
vi.mock('@/lib/credential-groups/rate-limit', () => ({
27-
enforcePublicCredentialGroupIpRateLimit: mockRateLimit,
27+
enforcePublicCredentialGroupIpRateLimit: mocks.rateLimit,
2828
}))
2929

3030
import { GET } from '@/app/api/credential-groups/oauth/[provider]/callback/route'
3131

32+
const principal = {
33+
kind: 'credential_group_enrollment',
34+
workspaceId: 'workspace-1',
35+
credentialGroupId: 'group-1',
36+
enrollmentId: 'enrollment-1',
37+
email: 'alex@example.com',
38+
invitationTokenHash: 'hash-1',
39+
} as const
3240
const attempt = {
3341
provider: 'gmail',
3442
invitationToken: 'invitation-token',
@@ -45,21 +53,22 @@ function request(query: string) {
4553
describe('credential group OAuth callback', () => {
4654
beforeEach(() => {
4755
vi.clearAllMocks()
48-
mockRateLimit.mockResolvedValue(null)
49-
mockConsumeAttempt.mockResolvedValue(attempt)
50-
mockGetContext.mockResolvedValue({ enrollmentId: 'enrollment-1' })
51-
mockCompleteOAuth.mockResolvedValue(undefined)
56+
mocks.rateLimit.mockResolvedValue(null)
57+
mocks.consumeAttempt.mockResolvedValue(attempt)
58+
mocks.authenticate.mockResolvedValue(principal)
59+
mocks.completeOAuth.mockResolvedValue({ connectedOptionId: 'option-1' })
5260
})
5361

54-
it('consumes provider-bound state and returns after a successful exchange', async () => {
55-
const response = await GET(request('state=state-1&code=code-1'), context)
62+
it('consumes provider-bound state and enters the application operation', async () => {
63+
const callbackRequest = request('state=state-1&code=code-1')
64+
const response = await GET(callbackRequest, context)
5665

57-
expect(mockConsumeAttempt).toHaveBeenCalledWith('state-1')
58-
expect(mockCompleteOAuth).toHaveBeenCalledWith(
59-
{ enrollmentId: 'enrollment-1' },
60-
attempt,
61-
'code-1'
62-
)
66+
expect(mocks.consumeAttempt).toHaveBeenCalledWith('state-1')
67+
expect(mocks.completeOAuth).toHaveBeenCalledWith({
68+
principal,
69+
input: { attempt, code: 'code-1' },
70+
request: callbackRequest,
71+
})
6372
expect(response.status).toBe(307)
6473
expect(response.headers.get('location')).toBe(
6574
'/credential-groups/enroll/invitation-token?connected=option-1'
@@ -73,19 +82,19 @@ describe('credential group OAuth callback', () => {
7382
expect(response.headers.get('location')).toBe(
7483
'/credential-groups/enroll/invitation-token?oauth=denied'
7584
)
76-
expect(mockGetContext).not.toHaveBeenCalled()
77-
expect(mockCompleteOAuth).not.toHaveBeenCalled()
85+
expect(mocks.authenticate).not.toHaveBeenCalled()
86+
expect(mocks.completeOAuth).not.toHaveBeenCalled()
7887
})
7988

8089
it('rejects replayed, expired, or cross-provider state', async () => {
81-
mockConsumeAttempt.mockResolvedValue(null)
90+
mocks.consumeAttempt.mockResolvedValue(null)
8291

8392
const replayedResponse = await GET(request('state=state-1&code=code-1'), context)
8493
expect(replayedResponse.status).toBe(400)
8594

86-
mockConsumeAttempt.mockResolvedValue({ ...attempt, provider: 'slack' })
95+
mocks.consumeAttempt.mockResolvedValue({ ...attempt, provider: 'slack' })
8796
const mismatchedResponse = await GET(request('state=state-2&code=code-2'), context)
8897
expect(mismatchedResponse.status).toBe(400)
89-
expect(mockCompleteOAuth).not.toHaveBeenCalled()
98+
expect(mocks.completeOAuth).not.toHaveBeenCalled()
9099
})
91100
})

0 commit comments

Comments
 (0)