Add OpenAPI imports and live OAuth integrations

.dagger/src/index.ts

@@ -283,6 +283,8 @@ export class AtomicServer {
     cargoHome: string,
   ): Container {
     return container
+      // Fetch pinned Git revisions with Git itself (libgit2 can fail on the shared cache).
+      .withEnvVariable('CARGO_NET_GIT_FETCH_WITH_CLI', 'true')
       .withMountedCache(`${cargoHome}/registry`, dag.cacheVolume('cargo'), {
         // Shared: Locked serialized every parallel CI lane behind whichever
         // job held the volume. Cargo's own flock handles concurrent writers.
@@ -1050,7 +1052,7 @@ export class AtomicServer {
         .container()
         .from(image)
         .withExec(['apt-get', 'update', '-qq'])
-        .withExec(['apt', 'install', '-y', 'nasm', 'protobuf-compiler']),
+        .withExec(['apt', 'install', '-y', 'nasm', 'protobuf-compiler', 'git']),
       CARGO_HOME_MUSL,
     )
       .withExec(['rustup', 'component', 'add', 'clippy'])
@@ -1218,7 +1220,7 @@ export class AtomicServer {
           // (nextest, clippy) fail with "Could not find `protoc`". Matches
           // `rustBuild()`'s apt list; this container split off from it later
           // and the package was missed.
-          .withExec(['apt', 'install', '-y', 'nasm', 'protobuf-compiler']),
+          .withExec(['apt', 'install', '-y', 'nasm', 'protobuf-compiler', 'git']),
         CARGO_HOME_MUSL,
       )
         .withExec(['rustup', 'component', 'add', 'clippy'])

.github/workflows/main.yml

@@ -273,14 +273,19 @@ jobs:
         working-directory: atomic-saas
         run: |
           set -euo pipefail
-          cargo check --all-targets
-          cargo clippy --all-targets -- -D warnings
-          cargo test --all-targets
+          # Dependency workspaces do not inherit this repo's atomic_lib patch.
+          reflector_patch=(--config "patch.\"https://github.com/ontola/atomic-server\".atomic_lib.path=\"$GITHUB_WORKSPACE/atomic-server/lib\"")
+          # atomic-saas commits its lockfile. Refresh the already-locked Git
+          # source so Cargo can select the patched local crate before build.
+          cargo "${reflector_patch[@]}" update -p atomic_lib
+          cargo "${reflector_patch[@]}" check --all-targets
+          cargo "${reflector_patch[@]}" clippy --all-targets -- -D warnings
+          cargo "${reflector_patch[@]}" test --all-targets
           # The managed node embeds this repo's server crate and is not a
           # default workspace member, so the root build does not touch it.
           # Its own CI runs check, clippy and test; the same here.
-          cargo clippy -p atomic-managed-node --all-targets -- -D warnings
-          cargo test -p atomic-managed-node
+          cargo "${reflector_patch[@]}" clippy -p atomic-managed-node --all-targets -- -D warnings
+          cargo "${reflector_patch[@]}" test -p atomic-managed-node
           if ! git diff --quiet -- Cargo.lock; then
             git diff --stat -- Cargo.lock
             echo "::warning::atomic-saas's Cargo.lock drifted against this commit; run cargo check there and commit Cargo.lock."

CHANGELOG.md

@@ -5,6 +5,14 @@ By far most changes relate to `atomic-server`, so if not specified, assume the c
 **Changes to JS assets (including the front-end and JS libraries) are not shown here**, but in [`/browser/CHANGELOG`](/browser/CHANGELOG.md).
 See [STATUS.md](server/STATUS.md) to learn more about which features will remain stable.
 
+- Use indexed prefix lookups in Reflector to avoid full-database scans per imported record.
+- Keep live imports off HTTP workers and bound stalled provider requests.
+- Add Sync → Integrations for GitHub and Google OAuth imports into the running
+  server, with server-side token refresh and separate drives per signed-in user
+  ([#1381](https://github.com/ontola/atomic-server/issues/1381)).
+- Add `atomic-server import-oad`: import APIs described by OpenAPI documents and
+  overlays through Reflector, with persistent drives and search indexing
+  ([#1381](https://github.com/ontola/atomic-server/issues/1381)).
 - Fix: live collaboration stopped for the author of a document after a peer
   edited it. The server stamps `lastCommit` under its own Loro peer after
   applying a commit; the fan-out only forwarded the author's own bytes and

Cargo.toml

@@ -49,3 +49,7 @@ debug = false
 
 [workspace.metadata.bin]
 wasm-pack = { version = "0.15.0" }
+
+# Reflector must use the same Storelike types and database implementation as the server.
+[patch."https://github.com/ontola/atomic-server"]
+atomic_lib = { path = "lib" }

TESTING_COVERAGE.md

@@ -411,3 +411,16 @@ Cloud Vault display metadata: `vaultAutoBackup.test.ts` verifies name/emoji enro
   back to the selected drive, then explicit consent, replication and an
   authenticated read from the real managed node. Plan purchase alone creates
   no enrollment. Real Stripe-hosted test-card checkout remains a deployment check.
+
+## OpenAPI importer
+
+| Layer | Coverage |
+|---|---|
+| glue | `server/tests/it/import_oad.rs`: real CLI, local HTTP API + overlay, persistence, repeated updates, drive owner grants, origin mismatch, and API failure exit status. |
+| engine | Pagination, ontology derivation, and OAuth tests live upstream in reflector-rs / syncables-rs; not rerun by this workspace. |
+| glue / flow | `server/tests/it/integrations.rs`: real running server + mock OAuth/API provider, signed discovery/start, PKCE, browser cookie/state binding, callback replay, token refresh, immediate import, drive reads and sorted children queries, agent isolation and denied consent. |
+| flow | Sync UI manually verified against a temporary server; real GitHub/Google consent requires operator-provided OAuth app credentials. |
+
+- `db::resolver_tests::resource_prefix_scan_matches_local_subjects` checks exact local subject-prefix boundaries and empty results for importer cleanup scans.
+
+- `integrations::oauth::tests::stalled_provider_returns_an_error` proves an unresponsive provider is bounded by the request deadline.

browser/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+- Save completed OAuth imports to the private drive’s **My drives** list.
+
+- Add Integrations to the Sync page: connect GitHub or Google and follow live import progress ([#1381](https://github.com/ontola/atomic-server/issues/1381)).
+
 This changelog covers all five packages, as they are (for now) updated as a whole
 
 ## UNRELEASED