[APPS][Connections Part 4] Resolve same-module connection ID object values

[sdkennedy2]

Motivation

The parent PR adds direct same-file connection ID constants. App code also commonly groups same-file connection IDs in local object maps, for example CONNECTIONS.HTTP or CONNECTIONS.HTTP.PROD.

This PR adds that object-map support separately from the basic constant resolver so reviewers can evaluate the property-access rules on their own.

Changes

Adds same-module object member resolution for supported connectionId forms:

const CONNECTIONS = { HTTP: '77c14b8b-27e1-4901-985d-8817908b9706' };
request({ connectionId: CONNECTIONS.HTTP, inputs: {} });

The algorithm works in two steps.

First, it treats CONNECTIONS.HTTP as a static object lookup. It resolves CONNECTIONS to the same-file const object, finds the HTTP property, and returns the expression stored at that property. In the example above, that expression is the string literal '77c14b8b-27e1-4901-985d-8817908b9706'.

That property value does not need to be a string literal directly. It can also be another same-file const identifier:

const HTTP_CONNECTION_ID = '77c14b8b-27e1-4901-985d-8817908b9706';
const CONNECTIONS = { HTTP: HTTP_CONNECTION_ID };
request({ connectionId: CONNECTIONS.HTTP, inputs: {} });

In that case, the object lookup returns the identifier expression HTTP_CONNECTION_ID.

Second, the returned expression goes back through the existing connection ID value resolver. If the expression is a string literal, it becomes the final connection ID immediately. If the expression is an identifier, the resolver follows that identifier to its same-file const initializer and then resolves that initializer to the final string.

This same two-step shape also supports nested static reads such as CONNECTIONS.HTTP.PROD: each object member lookup returns the next expression, and the general resolver keeps resolving until it reaches a final supported string value.

The resolver intentionally fails closed for dynamic forms that could hide the runtime value, including computed member reads, imported object roots, mutable object roots, object spreads, computed object properties, duplicate keys, accessors, missing properties, and non-object intermediate values. Imported connection ID tracing remains out of scope for a later PR.

QA Instructions

Ran:

yarn workspace @dd/tests test:unit packages/plugins/apps/src/backend/ast-parsing/extract-connection-ids.test.ts --runInBand

Child branch result: 58 tests passed.

Blast Radius

This affects Apps backend function discovery/upload/dev-server manifest generation for action-catalog connection allowlists. Runtime backend execution is unchanged. The resolver remains conservative and throws on object shapes that could hide the actual runtime connection ID.

Documentation

• PR Description Guidelines

[sdkennedy2]

• [APPS][Connections Part 6] Discover action calls in reachable modules #353
• [APPS][Connections Part 5] Move apps Vite behavior into getVitePlugin #357
• [APPS][Connections Part 4] Resolve same-module connection ID object values #354 👈 (View in Graphite)
• [APPS][Connections Part 3] Resolve same-module connection ID constants #351
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[sdkennedy2]

@codex review
@cursor review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df714c36aa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject mutable const connection maps

When a const binding resolves to an object literal, this path treats the initializer as the runtime value even though const does not freeze object properties. In files such as const CONNECTIONS = { HTTP: 'conn-a' }; CONNECTIONS.HTTP = getConnectionId(); request({ connectionId: CONNECTIONS.HTTP }), the extractor now records conn-a instead of failing closed or including the actual runtime ID, which can produce an incorrect allowlist. Please detect writes to member chains of these connection maps (including aliases/nested objects) or only accept frozen/otherwise immutable shapes.

Useful? React with 👍 / 👎.

[sdkennedy2]

I'm fine with this being allowed. While the object could be mutated I think the other options are either too restrictive or a lot of work to detect mutations.

[sarenji]

🔥

[sarenji]

Just to be sure, is this mutable feature something we could realistically see a user wanting in the future?

[sdkennedy2]

We can always iterate on customer feedback and prioritize trying to support this if our customers ask for it.