feat(integrations): add OCI Object Storage - #7413
Open
BillLeoutsakosvl346 wants to merge 5 commits into
Open
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Greptile SummaryAdds an OCI Object Storage integration backed by Oracle’s S3 Compatibility API, including customer-managed credentials and six workflow operations.
Confidence Score: 5/5The PR appears safe to merge based on the reviewed changes, with no concrete blocking or independently actionable non-blocking issue established. The integration keeps credential resolution server-controlled, validates and encrypts provider-specific secrets, confines requests to fixed OCI endpoints, bounds transfer paths, and aligns its block, tools, selectors, contracts, and generated metadata.
|
| Filename | Overview |
|---|---|
| apps/sim/lib/internal/oci-object-storage/client.ts | Adds the fixed-endpoint S3-compatible client, OCI response normalization, bounded bucket listings, retry configuration, and client cleanup. |
| apps/sim/lib/internal/oci-object-storage/operations.ts | Implements the six provider operations with file authorization, transfer limits, download preflight, streaming bounds, and normalized outputs. |
| apps/sim/lib/credentials/oci-object-storage-service-account.ts | Adds OCI credential normalization, live verification, encrypted-secret parsing, strict provider binding, and display identity handling. |
| apps/sim/lib/credentials/orchestration/index.ts | Extends credential rotation orchestration to rebuild and atomically replace OCI service-account secrets. |
| apps/sim/blocks/blocks/oci_object_storage.ts | Defines the OCI workflow block, six operations, selectors, parameter mapping, outputs, templates, and skills. |
| apps/sim/lib/selectors/server/providers/oci-object-storage.ts | Adds authorized bucket and object selectors backed by the provider-local OCI client. |
| apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx | Adds the OCI Customer Secret Key connection and reconnection form with required-field validation and secret-safe error handling. |
Sequence Diagram
sequenceDiagram
participant User as Workflow user
participant Exec as Tool execution boundary
participant Cred as Credential service
participant OCI as OCI S3-compatible endpoint
participant Files as Sim file storage
User->>Exec: Invoke OCI operation with credential reference
Exec->>Cred: Resolve authorized encrypted credential
Cred-->>Exec: Access key, secret, namespace, region
Exec->>OCI: Signed S3-compatible request
alt Upload from Sim file
Exec->>Files: Authorize and read bounded file
Files-->>Exec: File bytes and content type
Exec->>OCI: PutObject
else Download object
Exec->>OCI: HeadObject preflight
OCI-->>Exec: Size and metadata
Exec->>OCI: GetObject
OCI-->>Exec: Bounded object stream
Exec-->>User: Canonical file output and metadata
else List, inspect, or delete
OCI-->>Exec: Normalized operation result
end
Reviews (1): Last reviewed commit: "feat(integrations): add OCI Object Stora..." | Re-trigger Greptile
Contributor
Author
Contributor
|
@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
2 issues found across 64 files
Confidence score: 4/5
apps/sim/lib/internal/oci-object-storage/execute-tool.tslogs terminal provider or credential failures atwarn, which can hide actionable OCI operation failures at normal log thresholds; log these failures aterror.apps/sim/lib/internal/oci-object-storage/operations.test.tsdoes not track_attempts, so the upload test could pass despite unintended retries and fail to catch extra writes; record the attempt count and assert it is1.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="apps/sim/lib/internal/oci-object-storage/operations.test.ts">
<violation number="1" location="apps/sim/lib/internal/oci-object-storage/operations.test.ts:33">
P2: The upload test cannot detect a regression from one write attempt to three retries because this mock ignores `_attempts`. Record the attempt count and assert `1` for the upload path.</violation>
</file>
<file name="apps/sim/lib/internal/oci-object-storage/execute-tool.ts">
<violation number="1" location="apps/sim/lib/internal/oci-object-storage/execute-tool.ts:95">
P2: Every provider or credential failure caught here stops the operation but is logged at `warn`, hiding actionable failures at normal log thresholds. Log terminal OCI operation failures at `error`.
(Based on your team's feedback about operational log severity.)</violation>
</file>
| } catch (error) { | ||
| request.signal?.throwIfAborted() | ||
| const normalized = normalizeOciObjectStorageError(error) | ||
| logger.warn('OCI Object Storage operation failed', { |
Contributor
There was a problem hiding this comment.
P2: Every provider or credential failure caught here stops the operation but is logged at warn, hiding actionable failures at normal log thresholds. Log terminal OCI operation failures at error.
(Based on your team's feedback about operational log severity.)
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/sim/lib/internal/oci-object-storage/execute-tool.ts, line 95:
<comment>Every provider or credential failure caught here stops the operation but is logged at `warn`, hiding actionable failures at normal log thresholds. Log terminal OCI operation failures at `error`.
(Based on your team's feedback about operational log severity.) </comment>
<file context>
@@ -0,0 +1,105 @@
+ } catch (error) {
+ request.signal?.throwIfAborted()
+ const normalized = normalizeOciObjectStorageError(error)
+ logger.warn('OCI Object Storage operation failed', {
+ requestId: request.requestId,
+ toolId: request.toolId,
</file context>
Contributor
Author
|
Addressed the Cubic review in
Validation after the changes:
Live OCI smoke testing remains unavailable because no disposable OCI tenant, bucket, or Customer Secret Key is available; the PR does not claim live verification. |
Contributor
Author
|
@cubic please re-review the latest commit. |
Contributor
@BillLeoutsakosvl346 Incremental reviews are turned off for this repository. Comment |
Contributor
Author
|
@cubic review |
Contributor
@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete. |
…ject-storage-integration # Conflicts: # apps/sim/tools/generated/tool-metadata.ts
Contributor
Author
|
Final head is now |
Contributor
Author
|
@cubic review |
Contributor
@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a customer-connected OCI Object Storage block backed by Oracle's S3 Compatibility API and the existing AWS S3 SDK dependency.
oci-object-storage-service-accountcredentials for Customer Secret Key access, storing encrypted access key, secret key, namespace, and region values.OCI setup and permissions
Customers need an OCI Customer Secret Key, Object Storage namespace, and supported commercial OC1 region. The minimum intended IAM permissions are:
BUCKET_INSPECTOBJECT_INSPECTOBJECT_READOBJECT_CREATE/OBJECT_OVERWRITEOBJECT_DELETEOracle references: S3 Compatibility API, Customer Secret Keys, and Object Storage IAM policies.
Validation
Passed after reconciling with the latest
origin/staging:git diff --checkreports only the docs generator's existing output style in the new generated MDX file: one JSX trailing space and its terminal blank line. The docs generator consistency check passes.Live smoke status
Not run: no disposable OCI tenant, bucket, and Customer Secret Key were available. This PR is being opened at the request of the author without claiming live OCI validation. A maintainer with a disposable OCI setup should run ListBuckets → ListObjects → PutObject → HeadObject → GetObject/byte-compare → DeleteObject → verify absence before treating the integration as production-verified.
Deferred from v1
Bucket administration, copy, multipart upload, pre-authenticated requests, versioning, and triggers are intentionally deferred. Zero-byte canonical file downloads remain subject to the shared
FileToolProcessorbehavior rather than adding a provider-specific bypass.