fix(cli): include authorization from root steps in childIngestionSources

Root steps (matched via ingestionSourceId) that carry authorization
metadata are now included in childIngestionSources as minimal entries
(id, name, authorization only) to avoid increasing config file size.
This allows downstream consumers like docs-v2 to generate complete
authorization documentation.

Author: gastonyelmini

packages/integration-sdk-cli/src/commands/generate-ingestion-sources-config.test.ts

@@ -190,4 +190,96 @@ describe('#generateIngestionSourcesConfig', () => {
       ingestionSourcesConfig[INGESTION_SOURCE_IDS.TEST_SOURCE],
     ).toBeUndefined();
   });
+
+  it('should include only authorization from matched root steps', () => {
+    const integrationSteps: IntegrationStep<IntegrationInstanceConfig>[] = [
+      {
+        id: 'fetch-repos',
+        name: 'Fetch Repos',
+        entities: [
+          {
+            resourceName: 'Github Repo',
+            _type: 'github_repo',
+            _class: ['CodeRepo'],
+          },
+        ],
+        relationships: [],
+        dependsOn: ['fetch-account'],
+        ingestionSourceId: INGESTION_SOURCE_IDS.FETCH_REPOS,
+        authorization: {
+          permissions: ['repo:read'],
+          endpoints: ['https://api.example.com/repos'],
+        },
+        executionHandler: jest.fn(),
+      },
+      {
+        id: 'fetch-issues',
+        name: 'Fetch Issues',
+        entities: [
+          {
+            resourceName: 'GitHub Issue',
+            _type: 'github_issue',
+            _class: ['Issue'],
+          },
+        ],
+        relationships: [],
+        dependsOn: ['fetch-repos'],
+        executionHandler: jest.fn(),
+      },
+    ];
+    const ingestionSourcesConfig = generateIngestionSourcesConfig(
+      ingestionConfig,
+      integrationSteps,
+    );
+    const children =
+      ingestionSourcesConfig[INGESTION_SOURCE_IDS.FETCH_REPOS]
+        .childIngestionSources!;
+    // Root step entry only has id, name, and authorization (no entities/relationships)
+    const rootEntry = children.find((c) => c.id === 'fetch-repos');
+    expect(rootEntry).toEqual({
+      id: 'fetch-repos',
+      name: 'Fetch Repos',
+      authorization: {
+        permissions: ['repo:read'],
+        endpoints: ['https://api.example.com/repos'],
+      },
+    });
+    // Dependent step still has full metadata
+    const dependentEntry = children.find((c) => c.id === 'fetch-issues');
+    expect(dependentEntry).toEqual(
+      expect.objectContaining({
+        id: 'fetch-issues',
+        entities: expect.any(Array),
+      }),
+    );
+  });
+
+  it('should not include root steps without authorization', () => {
+    const integrationSteps: IntegrationStep<IntegrationInstanceConfig>[] = [
+      {
+        id: 'fetch-vulnerability-alerts',
+        name: 'Fetch Vulnerability Alerts',
+        entities: [
+          {
+            resourceName: 'GitHub Vulnerability Alerts',
+            _type: 'github_finding',
+            _class: ['Finding'],
+          },
+        ],
+        relationships: [],
+        dependsOn: ['fetch-repos'],
+        ingestionSourceId: INGESTION_SOURCE_IDS.FINDING_ALERTS,
+        executionHandler: jest.fn(),
+      },
+    ];
+    const ingestionSourcesConfig = generateIngestionSourcesConfig(
+      ingestionConfig,
+      integrationSteps,
+    );
+    // No authorization on the step, so it's not added as a root entry — only dependents (none here)
+    expect(
+      ingestionSourcesConfig[INGESTION_SOURCE_IDS.FINDING_ALERTS]
+        .childIngestionSources,
+    ).toBeEmpty();
+  });
 });

packages/integration-sdk-cli/src/commands/generate-ingestion-sources-config.ts

@@ -67,9 +67,17 @@ export function generateIngestionSourcesConfigCommand() {
     });
 }
 
+type ChildIngestionSource =
+  | StepMetadata
+  | (Pick<StepMetadata, 'id' | 'name'> & {
+      authorization?: StepMetadata['authorization'];
+    });
+
 export type EnhancedIntegrationIngestionConfigFieldMap = Record<
   IntegrationSourceId,
-  IntegrationIngestionConfigField & { childIngestionSources?: StepMetadata[] }
+  IntegrationIngestionConfigField & {
+    childIngestionSources?: ChildIngestionSource[];
+  }
 >;
 
 /**
@@ -102,18 +110,35 @@ export function generateIngestionSourcesConfig<
         return;
       }
       // Get the dependent steps for the given matchedIntegrationStepIds
-      const childIngestionSources = integrationSteps.filter((step) =>
+      const dependentSteps = integrationSteps.filter((step) =>
         step.dependsOn?.some((value) =>
           matchedIntegrationStepIds.includes(value),
         ),
       );
+      // Extract authorization from matched root steps as minimal entries
+      const rootStepAuthorizations = integrationSteps
+        .filter((step) => step.ingestionSourceId === key && step.authorization)
+        .map(({ id, name, authorization }) => ({
+          id,
+          name,
+          authorization,
+        }));
+      // Combine root step authorizations with dependent steps, deduplicating by id
+      const seenIds = new Set<string>();
+      const childIngestionSources = [
+        ...rootStepAuthorizations,
+        ...dependentSteps.map(
+          ({ executionHandler, ...keepAttrs }) => keepAttrs,
+        ),
+      ].filter((step) => {
+        if (seenIds.has(step.id)) return false;
+        seenIds.add(step.id);
+        return true;
+      });
       // Generate ingestionConfig with the childIngestionSources
       newIngestionConfig[key] = {
         ...ingestionConfig[key],
-        // Drop execution handler from returned object
-        childIngestionSources: childIngestionSources.map(
-          ({ executionHandler, ...keepAttrs }) => keepAttrs,
-        ),
+        childIngestionSources,
       };
     } else {
       log.warn(`The key ${key} does not exist in the ingestionConfig`);