Connections

import { defineConnectionProvider } from 'twenty-sdk/define';

export default defineConnectionProvider({
  universalIdentifier: '9c7d1f5e-6a0b-4d44-be0c-3f8b5a9d4e6f',
  name: 'linear',
  displayName: 'Linear',
  icon: 'IconBrandLinear',
  // Optional: a logo bundled in your app's public/ folder, shown next to the
  // provider in the app's General tab.
  logo: 'public/linear-logomark.svg',
  type: 'oauth',
  scope: 'WORKSPACE',
  oauth: {
    authorizationEndpoint: 'https://linear.app/oauth/authorize',
    tokenEndpoint: 'https://api.linear.app/oauth/token',
    scopes: ['read', 'write'],
    // These must match keys in `defineApplication.serverVariables` below.
    clientIdVariable: 'LINEAR_CLIENT_ID',
    clientSecretVariable: 'LINEAR_CLIENT_SECRET',
    // Optional: defaults to 'json'. Some providers (Linear, Slack) want
    // 'form-urlencoded' for the token request.
    tokenRequestContentType: 'form-urlencoded',
    // Optional: defaults to true. Disable only if the provider rejects PKCE.
    usePkce: false,
    // Optional: extra query params on the authorize URL.
    // authorizationParams: { prompt: 'consent' },
    // Optional: provider's RFC 7009 token revocation endpoint, called on disconnect.
    // revokeEndpoint: 'https://example.com/oauth/revoke',
  },
  // Optional: a logic function in this app that returns a stable id for the
  // upstream account, run before the tokens are saved. See "Identify the
  // connected account".
  // identifyAccountLogicFunction: { universalIdentifier: '2f1e0d9c-...-...' },
  // Optional: a logic function in this app to run right after a connection is
  // established. See "Run a logic function on connect".
  // onConnectLogicFunction: { universalIdentifier: '3a2b1c0d-...-...' },
  // Optional: a logic function in this app to run right after a connection is
  // removed. See "Run a logic function on disconnect".
  // onDisconnectLogicFunction: { universalIdentifier: '4d5e6f70-...-...' },
});

import { defineApplication } from 'twenty-sdk/define';

export default defineApplication({
  universalIdentifier: '...',
  displayName: 'Linear',
  description: 'Connect Linear to Twenty.',
  // OAuth client credentials live on the app registration (one OAuth app per
  // Twenty server, configured by the admin) — not per-workspace. Declare them
  // as serverVariables so the admin can fill them in once for all installs.
  serverVariables: {
    LINEAR_CLIENT_ID: {
      description: 'OAuth client ID from your Linear OAuth application.',
      isSecret: false,
      isRequired: true,
    },
    LINEAR_CLIENT_SECRET: {
      description: 'OAuth client secret from your Linear OAuth application.',
      isSecret: true,
      isRequired: true,
    },
  },
});

import { defineConnectionProvider } from 'twenty-sdk/define';

export default defineConnectionProvider({
  universalIdentifier: '5b0e6f3a-2c4d-4e8f-9a1b-7c6d5e4f3a2b',
  name: 'linkedin',
  displayName: 'LinkedIn',
  type: 'custom',
  scope: 'USER',
  custom: {
    authorizeLogicFunction: {
      universalIdentifier: 'c4a1e2b3-6d5f-4a7b-8c9d-0e1f2a3b4c5d',
    },
    callbackLogicFunction: {
      universalIdentifier: 'd5b2f3c4-7e6a-4b8c-9d0e-1f2a3b4c5d6e',
    },
  },
  onConnectLogicFunction: {
    universalIdentifier: 'e6c3a4d5-8f7b-4c9d-0e1f-2a3b4c5d6e7f',
  },
});

import { type AuthorizeConnectionPayload } from 'twenty-sdk/logic-function';

export const linkedinAuthorizeHandler = async ({
  callbackUrl,
}: AuthorizeConnectionPayload) => {
  const response = await fetch(
    `${process.env.UNIPILE_DSN}/api/v1/hosted/accounts/link`,
    {
      method: 'POST',
      headers: {
        'X-API-KEY': process.env.UNIPILE_API_KEY ?? '',
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
        type: 'create',
        providers: ['LINKEDIN'],
        api_url: process.env.UNIPILE_DSN,
        expiresOn: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
        // The browser comes back here, and the account id is posted here.
        success_redirect_url: callbackUrl,
        failure_redirect_url: callbackUrl,
        notify_url: callbackUrl,
      }),
    },
  );

  const { url } = await response.json();

  return { authorizationUrl: url };
};

import { type ConnectionCallbackPayload } from 'twenty-sdk/logic-function';

export const linkedinCallbackHandler = async ({
  httpMethod,
  body,
}: ConnectionCallbackPayload) => {
  if (httpMethod !== 'POST') {
    return null;
  }

  const { account_id: accountId } = body as { account_id: string };

  // Never trust the payload alone: confirm the account with the service.
  const account = await fetchUnipileAccount(accountId);

  return { externalAccountId: account.id, handle: account.name };
};

import { createHmac, timingSafeEqual } from 'node:crypto';

import { type ConnectionCallbackPayload } from 'twenty-sdk/logic-function';

export const hostedCallbackHandler = async ({
  httpMethod,
  headers,
  rawBody,
}: ConnectionCallbackPayload) => {
  if (httpMethod !== 'POST' || rawBody === null) {
    return null;
  }

  const expected = createHmac('sha256', process.env.WEBHOOK_SECRET ?? '')
    .update(rawBody)
    .digest();
  const received = Buffer.from(headers['x-signature'] ?? '', 'hex');

  if (received.length !== expected.length || !timingSafeEqual(received, expected)) {
    throw new Error('Invalid notification signature');
  }

  const { account_id: accountId } = JSON.parse(rawBody) as { account_id: string };

  return { externalAccountId: accountId };
};

import { defineConnectionProvider } from 'twenty-sdk/define';

import { SLACK_IDENTIFY_ACCOUNT_LOGIC_FUNCTION_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';

export default defineConnectionProvider({
  universalIdentifier: '...',
  name: 'slack',
  displayName: 'Slack',
  type: 'oauth',
  oauth: {
    /* ... */
  },
  identifyAccountLogicFunction: {
    universalIdentifier: SLACK_IDENTIFY_ACCOUNT_LOGIC_FUNCTION_UNIVERSAL_IDENTIFIER,
  },
});

import { defineLogicFunction } from 'twenty-sdk/define';
import type {
  IdentifyAccountPayload,
  IdentifyAccountResult,
} from 'twenty-sdk/logic-function';

import { SLACK_IDENTIFY_ACCOUNT_LOGIC_FUNCTION_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';

export default defineLogicFunction({
  universalIdentifier: SLACK_IDENTIFY_ACCOUNT_LOGIC_FUNCTION_UNIVERSAL_IDENTIFIER,
  name: 'slack-identify-account',
  timeoutSeconds: 10,
  handler: async ({
    accessToken,
  }: IdentifyAccountPayload): Promise<IdentifyAccountResult> => {
    const response = await fetch('https://slack.com/api/auth.test', {
      method: 'POST',
      headers: { Authorization: `Bearer ${accessToken}` },
    });
    const { ok, error, team_id, team } = await response.json();

    if (!ok) {
      throw new Error(`auth.test failed: ${error}`);
    }

    return { externalAccountId: team_id, handle: team };
  },
});

export default defineConnectionProvider({
  universalIdentifier: '...',
  name: 'slack',
  displayName: 'Slack',
  type: 'oauth',
  oauth: {
    /* ... */
  },
  // Runs claimSlackTeam after every successful Slack connection.
  onConnectLogicFunction: {
    universalIdentifier: '3a2b1c0d-1111-4222-8333-444455556666',
  },
});

export default defineConnectionProvider({
  universalIdentifier: '...',
  name: 'slack',
  displayName: 'Slack',
  type: 'oauth',
  oauth: {
    /* ... */
  },
  // Runs releaseSlackTeam after every Slack disconnection.
  onDisconnectLogicFunction: {
    universalIdentifier: '4470aba8-5ff5-4800-88db-2a427cd8677c',
  },
});

import { listConnections } from 'twenty-sdk/logic-function';

export const createLinearIssueHandler = async (input: {
  teamId?: string;
  title?: string;
}) => {
  if (!input.teamId || !input.title) {
    return { success: false, error: 'teamId and title are required' };
  }

  const connections = await listConnections({ providerName: 'linear' });

  // Workspace-shared credentials win when present; fall back to the first
  // personal one. For HTTP-route triggers you typically pick the
  // request user's connection via event.userWorkspaceId instead.
  const connection =
    connections.find((c) => c.scope === 'WORKSPACE') ?? connections[0];

  if (!connection) {
    return {
      success: false,
      error:
        'Linear is not connected. Open the app settings and click "Add connection".',
    };
  }

  // Use connection.accessToken to call the third-party API.
  const response = await fetch('https://api.linear.app/graphql', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${connection.accessToken}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      query: `mutation { issueCreate(input: { teamId: "${input.teamId}", title: "${input.title}" }) { success } }`,
    }),
  });

  return { success: response.ok };
};