feat(server): run credentials verifiacation on the connection import endpoint

Author: hassan254-prog

packages/server/lib/controllers/connection/postConnection.ts

@@ -1,7 +1,7 @@
 import * as z from 'zod';
 
 import db from '@nangohq/database';
-import { logContextGetter } from '@nangohq/logs';
+import { defaultOperationExpiration, logContextGetter } from '@nangohq/logs';
 import {
     EndUserMapper,
     buildTagsFromEndUser,
@@ -27,7 +27,8 @@ import {
     connectionTagsSchema,
     endUserSchema
 } from '../../helpers/validation.js';
-import { connectionCreated, connectionCreationStartCapCheck, connectionRefreshSuccess } from '../../hooks/hooks.js';
+import { validateConnection } from '../../hooks/connection/on/validate-connection.js';
+import { connectionCreated, connectionCreationStartCapCheck, connectionRefreshSuccess, testConnectionCredentials } from '../../hooks/hooks.js';
 import { asyncWrapper } from '../../utils/asyncWrapper.js';
 
 import type { AuthOperationType, ConnectionConfig, ConnectionUpsertResponse, EndUser, PostPublicConnection, ProviderGithubApp } from '@nangohq/types';
@@ -141,6 +142,20 @@ export const postPublicConnection = asyncWrapper<PostPublicConnection>(async (re
         return;
     }
 
+    const logCtx = await logContextGetter.create(
+        {
+            operation: { type: 'auth', action: 'create_connection' },
+            meta: { authType: 'connection_api' },
+            expiresAt: defaultOperationExpiration.auth()
+        },
+        { account, environment }
+    );
+    await logCtx.enrichOperation({
+        integrationId: integration.id!,
+        integrationName: integration.unique_key,
+        providerName
+    });
+
     let updatedConnection: ConnectionUpsertResponse | undefined;
 
     const connCreatedHook = (res: ConnectionUpsertResponse) => {
@@ -187,13 +202,29 @@ export const postPublicConnection = asyncWrapper<PostPublicConnection>(async (re
         }
         case 'API_KEY':
         case 'BASIC': {
+            // the testconnection only works with API_KEY, BASIC and TBA from this list
+            const connectionConfig = body.connection_config || {};
+            const connectionResponse = await testConnectionCredentials({
+                config: integration,
+                connectionConfig,
+                connectionId,
+                credentials: body.credentials,
+                provider,
+                logCtx
+            });
+            if (connectionResponse.isErr()) {
+                await logCtx.failed();
+                res.status(400).send({ error: { code: 'connection_test_failed', message: connectionResponse.error.message } });
+                return;
+            }
+
             const [imported] = await connectionService.importApiAuthConnection({
                 connectionId,
                 providerConfigKey: body.provider_config_key,
                 metadata: body.metadata || {},
                 environment,
                 credentials: body.credentials,
-                connectionConfig: body.connection_config || {},
+                connectionConfig,
                 connectionCreatedHook: connCreatedHook,
                 tags: mergedTags
             });
@@ -215,6 +246,7 @@ export const postPublicConnection = asyncWrapper<PostPublicConnection>(async (re
                 connectionConfig
             });
             if (credentialsRes.isErr()) {
+                await logCtx.failed();
                 res.status(500).send({ error: { code: 'server_error', message: credentialsRes.error.message } });
                 return;
             }
@@ -248,7 +280,8 @@ export const postPublicConnection = asyncWrapper<PostPublicConnection>(async (re
                 connectionConfig
             });
             if (credentialsRes.isErr()) {
-                res.status(500).send({ error: { code: 'server_error', message: credentialsRes.error.message } });
+                await logCtx.failed();
+                res.status(400).send({ error: { code: 'server_error', message: credentialsRes.error.message } });
                 return;
             }
 
@@ -270,13 +303,29 @@ export const postPublicConnection = asyncWrapper<PostPublicConnection>(async (re
         }
         case 'TBA': {
             if (!body.connection_config || !body.connection_config['accountId']) {
+                await logCtx.failed();
                 res.status(400).send({
                     error: { code: 'invalid_body', message: 'Missing accountId in connection_config. This is required to create a TBA connection.' }
                 });
 
                 return;
             }
 
+            const connectionConfig = body.connection_config || {};
+            const connectionResponse = await testConnectionCredentials({
+                config: integration,
+                connectionConfig,
+                connectionId,
+                credentials: body.credentials,
+                provider,
+                logCtx
+            });
+            if (connectionResponse.isErr()) {
+                await logCtx.failed();
+                res.status(400).send({ error: { code: 'connection_test_failed', message: connectionResponse.error.message } });
+                return;
+            }
+
             const [imported] = await connectionService.upsertAuthConnection({
                 connectionId,
                 providerConfigKey: body.provider_config_key,
@@ -316,6 +365,7 @@ export const postPublicConnection = asyncWrapper<PostPublicConnection>(async (re
         }
         default:
             // Missing Bill, Signature, JWT, TwoStep, AppStore
+            await logCtx.failed();
             res.status(400).send({ error: { code: 'invalid_body', message: `Unsupported auth type ${provider.auth_mode}` } });
             return;
     }
@@ -326,10 +376,37 @@ export const postPublicConnection = asyncWrapper<PostPublicConnection>(async (re
     }
 
     if (!updatedConnection) {
+        await logCtx.failed();
         res.status(500).send({ error: { code: 'server_error', message: `Failed to create connection` } });
         return;
     }
 
+    const customValidationResponse = await validateConnection({
+        connection: updatedConnection.connection,
+        config: integration,
+        account,
+        logCtx
+    });
+
+    if (customValidationResponse.isErr()) {
+        if (updatedConnection.operation === 'creation') {
+            // since this is a new invalid connection, delete it with no trace of it
+            await connectionService.hardDelete(updatedConnection.connection.id);
+        }
+
+        const payload = customValidationResponse.error?.payload;
+        const message = typeof payload['message'] === 'string' ? payload['message'] : 'Connection failed validation';
+
+        await logCtx.failed();
+        res.status(400).send({
+            error: {
+                code: 'connection_validation_failed',
+                message
+            }
+        });
+        return;
+    }
+
     let endUser: EndUser | undefined;
     if (body.end_user) {
         await db.knex.transaction(async (trx) => {
@@ -340,6 +417,7 @@ export const postPublicConnection = asyncWrapper<PostPublicConnection>(async (re
                 endUser: EndUserMapper.apiToEndUser(body.end_user!)
             });
             if (endUserRes.isErr()) {
+                await logCtx.failed();
                 res.status(500).send({ error: { code: 'server_error', message: 'Failed to update end user' } });
                 return;
             }
@@ -356,6 +434,13 @@ export const postPublicConnection = asyncWrapper<PostPublicConnection>(async (re
 
     const connection = encryptionManager.decryptConnection(updatedConnection.connection);
 
+    await logCtx.enrichOperation({
+        connectionId: updatedConnection.connection.id,
+        connectionName: updatedConnection.connection.connection_id
+    });
+    void logCtx.info('Connection creation was successful');
+    await logCtx.success();
+
     res.status(201).send(
         connectionFullToPublicApi({ data: connection, provider: providerName, activeLog: [], endUser: endUser ? EndUserMapper.to(endUser) : null })
     );

packages/types/lib/connection/api/get.ts

@@ -96,6 +96,7 @@ export type PostPublicConnection = Endpoint<{
         end_user?: EndUserInput | undefined;
         tags?: Tags | undefined;
     };
+    Error: ApiError<'connection_test_failed'> | ApiError<'connection_validation_failed'>;
     Success: ApiPublicConnectionFull;
 }>;