refactor(core): simplify integration credentials (#31968)

packages/core/src/credential.ts

@@ -1,17 +1,12 @@
 export * as Credential from "./credential"
 
-import { and, asc, eq, ne } from "drizzle-orm"
-import { Context, Effect, Layer, Option, Schema } from "effect"
+import { asc, eq } from "drizzle-orm"
+import { Context, Effect, Layer, Schema } from "effect"
 import { Database } from "./database/database"
-import { ConnectorSchema } from "./connector/schema"
-import { EventV2 } from "./event"
+import { IntegrationSchema } from "./integration/schema"
 import { NonNegativeInt, withStatics } from "./schema"
-import { CredentialTable } from "./credential/sql"
 import { Identifier } from "./util/identifier"
-import { FSUtil } from "./fs-util"
-import { Global } from "./global"
-import { DataMigrationTable } from "./data-migration.sql"
-import path from "path"
+import { CredentialTable } from "./credential/sql"
 
 export const ID = Schema.String.pipe(
   Schema.brand("Credential.ID"),
@@ -21,6 +16,7 @@ export type ID = typeof ID.Type
 
 export class OAuth extends Schema.Class<OAuth>("Credential.OAuth")({
   type: Schema.Literal("oauth"),
+  methodID: IntegrationSchema.MethodID,
   refresh: Schema.String,
   access: Schema.String,
   expires: NonNegativeInt,
@@ -33,255 +29,94 @@ export class Key extends Schema.Class<Key>("Credential.Key")({
   metadata: Schema.optional(Schema.Record(Schema.String, Schema.String)),
 }) {}
 
-export const Value = Schema.Union([OAuth, Key])
+export const Info = Schema.Union([OAuth, Key])
   .pipe(Schema.toTaggedUnion("type"))
-  .annotate({ identifier: "Credential.Value" })
-export type Value = Schema.Schema.Type<typeof Value>
+  .annotate({ identifier: "Credential.Info" })
+export type Info = Schema.Schema.Type<typeof Info>
 
-const LegacyOAuth = Schema.Struct({
-  type: Schema.Literal("oauth"),
-  refresh: Schema.String,
-  access: Schema.String,
-  expires: NonNegativeInt,
-  accountId: Schema.optional(Schema.String),
-  enterpriseUrl: Schema.optional(Schema.String),
-})
-
-const LegacyKey = Schema.Struct({
-  type: Schema.Literal("api"),
-  key: Schema.String,
-  metadata: Schema.optional(Schema.Record(Schema.String, Schema.String)),
-})
-
-const LegacyValue = Schema.Union([LegacyOAuth, LegacyKey])
-
-export class Info extends Schema.Class<Info>("Credential.Info")({
+export class Stored extends Schema.Class<Stored>("Credential.Stored")({
   id: ID,
-  connectorID: ConnectorSchema.ID,
-  methodID: ConnectorSchema.MethodID,
+  integrationID: IntegrationSchema.ID,
   label: Schema.String,
-  value: Value,
+  value: Info,
 }) {}
 
-export const Event = {
-  Added: EventV2.define({
-    type: "credential.added",
-    schema: { credential: Info },
-  }),
-  Removed: EventV2.define({
-    type: "credential.removed",
-    schema: { credential: Info },
-  }),
-  Switched: EventV2.define({
-    type: "credential.switched",
-    schema: {
-      connectorID: ConnectorSchema.ID,
-      from: Schema.optional(ID),
-      to: Schema.optional(ID),
-    },
-  }),
-}
-
 export interface Interface {
-  readonly get: (id: ID) => Effect.Effect<Info | undefined>
-  readonly all: () => Effect.Effect<Info[]>
+  /** Returns every stored credential. */
+  readonly all: () => Effect.Effect<Stored[]>
+  /** Returns stored credentials belonging to one integration. */
+  readonly list: (integrationID: IntegrationSchema.ID) => Effect.Effect<Stored[]>
+  /** Replaces any credential for an integration and returns the new record. */
   readonly create: (input: {
-    connectorID: ConnectorSchema.ID
-    methodID: ConnectorSchema.MethodID
-    value: Value
-    label?: string
-  }) => Effect.Effect<Info>
-  readonly update: (id: ID, updates: Partial<Pick<Info, "label" | "value">>) => Effect.Effect<void>
+    readonly integrationID: IntegrationSchema.ID
+    readonly value: Info
+    readonly label?: string
+  }) => Effect.Effect<Stored>
+  /** Updates the label or secret value of a stored credential. */
+  readonly update: (id: ID, updates: Partial<Pick<Stored, "label" | "value">>) => Effect.Effect<void>
+  /** Removes a stored credential. */
   readonly remove: (id: ID) => Effect.Effect<void>
-  readonly activate: (id: ID) => Effect.Effect<void>
-  readonly active: (connectorID: ConnectorSchema.ID) => Effect.Effect<Info | undefined>
-  readonly activeAll: () => Effect.Effect<Map<ConnectorSchema.ID, Info>>
-  readonly forConnector: (connectorID: ConnectorSchema.ID) => Effect.Effect<Info[]>
 }
 
 export class Service extends Context.Service<Service, Interface>()("@opencode/v2/Credential") {}
 
-export const legacyImportLayer = Layer.effectDiscard(
-  Effect.gen(function* () {
-    const { db } = yield* Database.Service
-    const fs = yield* FSUtil.Service
-    const global = yield* Global.Service
-    const name = "credential.auth-json"
-    if (yield* db.select().from(DataMigrationTable).where(eq(DataMigrationTable.name, name)).get()) return
-    const raw = yield* fs.readJson(path.join(global.data, "auth.json")).pipe(Effect.option)
-    if (Option.isNone(raw) || typeof raw.value !== "object" || raw.value === null || Array.isArray(raw.value)) return
-    const decode = Schema.decodeUnknownOption(LegacyValue)
-    const values = Object.entries(raw.value).flatMap(([connectorID, value]) => {
-      const decoded = decode(value)
-      if (Option.isNone(decoded)) return []
-      const credential = decoded.value
-      const id = ID.create()
-      const connector = ConnectorSchema.ID.make(connectorID.replace(/\/+$/, ""))
-      const methodID = ConnectorSchema.MethodID.make(
-        credential.type === "api"
-          ? "api-key"
-          : connector === ConnectorSchema.ID.make("openai")
-            ? "chatgpt-browser"
-            : "oauth",
-      )
-      const next: Value =
-        credential.type === "api"
-          ? new Key({ type: "key", key: credential.key, metadata: credential.metadata })
-          : new OAuth({
-              type: "oauth",
-              refresh: credential.refresh,
-              access: credential.access,
-              expires: credential.expires,
-              metadata: {
-                ...(credential.accountId ? { accountID: credential.accountId } : {}),
-                ...(credential.enterpriseUrl ? { enterpriseURL: credential.enterpriseUrl } : {}),
-              },
-            })
-      return [{ id, connectorID: connector, methodID, value: next }]
-    })
-    yield* db.transaction((tx) =>
-      Effect.gen(function* () {
-        for (const item of values) {
-          if (
-            yield* tx
-              .select({ id: CredentialTable.id })
-              .from(CredentialTable)
-              .where(eq(CredentialTable.connector_id, item.connectorID))
-              .get()
-          )
-            continue
-          yield* tx.insert(CredentialTable).values({
-            id: item.id,
-            connector_id: item.connectorID,
-            method_id: item.methodID,
-            label: "Imported",
-            value: item.value,
-            active: true,
-          })
-        }
-        yield* tx.insert(DataMigrationTable).values({ name, time_completed: Date.now() }).onConflictDoNothing().run()
-      }),
-    )
-  }).pipe(Effect.orDie),
-)
-
 export const layer = Layer.effect(
   Service,
   Effect.gen(function* () {
     const { db } = yield* Database.Service
-    const events = yield* EventV2.Service
-    const decodeValue = Schema.decodeUnknownSync(Value)
-    const info = (row: typeof CredentialTable.$inferSelect) =>
-      new Info({
+    const decode = Schema.decodeUnknownSync(Info)
+    const stored = (row: typeof CredentialTable.$inferSelect) =>
+      new Stored({
         id: row.id,
-        connectorID: row.connector_id,
-        methodID: row.method_id,
+        integrationID: row.integration_id,
         label: row.label,
-        value: decodeValue(row.value),
+        value: decode(row.value),
       })
 
-    const activate = Effect.fn("Credential.activate")(function* (id: ID) {
-      const switched = yield* db
-        .transaction((tx) =>
-          Effect.gen(function* () {
-            const credential = yield* tx.select().from(CredentialTable).where(eq(CredentialTable.id, id)).get()
-            if (!credential || credential.active) return
-            const current = yield* tx
-              .select({ id: CredentialTable.id })
-              .from(CredentialTable)
-              .where(and(eq(CredentialTable.connector_id, credential.connector_id), eq(CredentialTable.active, true)))
-              .get()
-            yield* tx
-              .update(CredentialTable)
-              .set({ active: false })
-              .where(eq(CredentialTable.connector_id, credential.connector_id))
-              .run()
-            yield* tx.update(CredentialTable).set({ active: true }).where(eq(CredentialTable.id, id)).run()
-            return { connectorID: credential.connector_id, from: current?.id, to: id }
-          }),
-        )
-        .pipe(Effect.orDie)
-      if (switched) yield* events.publish(Event.Switched, switched)
-    })
-
     return Service.of({
-      get: Effect.fn("Credential.get")(function* (id) {
-        const row = yield* db.select().from(CredentialTable).where(eq(CredentialTable.id, id)).get().pipe(Effect.orDie)
-        return row ? info(row) : undefined
-      }),
       all: Effect.fn("Credential.all")(function* () {
         return (yield* db
           .select()
           .from(CredentialTable)
           .orderBy(asc(CredentialTable.time_created))
           .all()
-          .pipe(Effect.orDie)).map(info)
+          .pipe(Effect.orDie)).map(stored)
       }),
-      active: Effect.fn("Credential.active")(function* (connectorID) {
-        const row = yield* db
-          .select()
-          .from(CredentialTable)
-          .where(and(eq(CredentialTable.connector_id, connectorID), eq(CredentialTable.active, true)))
-          .get()
-          .pipe(Effect.orDie)
-        return row ? info(row) : undefined
-      }),
-      activeAll: Effect.fn("Credential.activeAll")(function* () {
-        const rows = yield* db
-          .select()
-          .from(CredentialTable)
-          .where(eq(CredentialTable.active, true))
-          .all()
-          .pipe(Effect.orDie)
-        return new Map(rows.map((row) => [row.connector_id, info(row)]))
-      }),
-      forConnector: Effect.fn("Credential.forConnector")(function* (connectorID) {
+      list: Effect.fn("Credential.list")(function* (integrationID) {
         return (yield* db
           .select()
           .from(CredentialTable)
-          .where(eq(CredentialTable.connector_id, connectorID))
+          .where(eq(CredentialTable.integration_id, integrationID))
           .orderBy(asc(CredentialTable.time_created))
           .all()
-          .pipe(Effect.orDie)).map(info)
+          .pipe(Effect.orDie)).map(stored)
       }),
       create: Effect.fn("Credential.create")(function* (input) {
-        const credential = new Info({
+        const credential = new Stored({
           id: ID.create(),
-          connectorID: input.connectorID,
-          methodID: input.methodID,
+          integrationID: input.integrationID,
           label: input.label ?? "default",
           value: input.value,
         })
-        const from = yield* db
+        yield* db
           .transaction((tx) =>
             Effect.gen(function* () {
-              const current = yield* tx
-                .select({ id: CredentialTable.id })
-                .from(CredentialTable)
-                .where(and(eq(CredentialTable.connector_id, input.connectorID), eq(CredentialTable.active, true)))
-                .get()
               yield* tx
-                .update(CredentialTable)
-                .set({ active: false })
-                .where(eq(CredentialTable.connector_id, input.connectorID))
+                .delete(CredentialTable)
+                .where(eq(CredentialTable.integration_id, credential.integrationID))
                 .run()
               yield* tx
                 .insert(CredentialTable)
                 .values({
                   id: credential.id,
-                  connector_id: credential.connectorID,
-                  method_id: credential.methodID,
+                  integration_id: credential.integrationID,
                   label: credential.label,
                   value: credential.value,
-                  active: true,
                 })
                 .run()
-              return current?.id
             }),
           )
           .pipe(Effect.orDie)
-        yield* events.publish(Event.Added, { credential })
-        yield* events.publish(Event.Switched, { connectorID: credential.connectorID, from, to: credential.id })
         return credential
       }),
       update: Effect.fn("Credential.update")(function* (id, updates) {
@@ -294,50 +129,10 @@ export const layer = Layer.effect(
           .pipe(Effect.orDie)
       }),
       remove: Effect.fn("Credential.remove")(function* (id) {
-        const removed = yield* db
-          .transaction((tx) =>
-            Effect.gen(function* () {
-              const row = yield* tx.select().from(CredentialTable).where(eq(CredentialTable.id, id)).get()
-              if (!row) return
-              yield* tx.delete(CredentialTable).where(eq(CredentialTable.id, id)).run()
-              if (!row.active) return { credential: info(row) }
-              const replacement = yield* tx
-                .select()
-                .from(CredentialTable)
-                .where(and(eq(CredentialTable.connector_id, row.connector_id), ne(CredentialTable.id, id)))
-                .orderBy(asc(CredentialTable.time_created))
-                .get()
-              if (replacement) {
-                yield* tx
-                  .update(CredentialTable)
-                  .set({ active: true })
-                  .where(eq(CredentialTable.id, replacement.id))
-                  .run()
-              }
-              return {
-                credential: info(row),
-                switched: { connectorID: row.connector_id, from: id, to: replacement?.id },
-              }
-            }),
-          )
-          .pipe(Effect.orDie)
-        if (!removed) return
-        yield* events.publish(Event.Removed, { credential: removed.credential })
-        if (removed.switched) yield* events.publish(Event.Switched, removed.switched)
+        yield* db.delete(CredentialTable).where(eq(CredentialTable.id, id)).run().pipe(Effect.orDie)
       }),
-      activate,
     })
   }),
 )
 
-export const defaultLayer = layer.pipe(
-  Layer.provide(Database.defaultLayer),
-  Layer.provide(EventV2.defaultLayer),
-  Layer.provideMerge(
-    legacyImportLayer.pipe(
-      Layer.provide(Database.defaultLayer),
-      Layer.provide(FSUtil.defaultLayer),
-      Layer.provide(Global.defaultLayer),
-    ),
-  ),
-)
+export const defaultLayer = layer.pipe(Layer.provide(Database.defaultLayer))