mirror of
https://github.com/alkimake/paperclip.git
synced 2026-06-17 03:10:38 +09:00
[codex] Add agent permissions and controls plan (#6386)
## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies by keeping task ownership, approvals, and operator control inside one control plane. > - Agent permissions and plugin-hosted company settings sit on the boundary between autonomy and governance. > - V1 needs scoped task assignment rules, plugin extension points, and clearer company access surfaces without weakening company boundaries. > - The branch builds the core authorization service, plugin SDK/host APIs, and UI simplifications needed to support those controls. > - Paperclip EE plugin surfaces were intentionally moved out of this core PR per review direction, so this PR now carries only the public core/plugin infrastructure work. > - The latest updates preserve the PAP-9937 branch changes that belong in this PR, remove the `design/` artifacts, and exclude the experimental `plugin-briefs` package. > - Greptile feedback was applied through the authorization/audit paths and the final cleanup commit was re-reviewed at 5/5 with no unresolved Greptile threads. > - The benefit is safer assignment control with extension hooks for richer permission products while preserving simple defaults for normal operators. ## What Changed - Added scoped task-assignment authorization decisions and routed issue/agent assignment mutations through the authorization service. - Added plugin SDK and host APIs for company settings slots, authorization policy/grant management, assignment previews, and bridge invocation scope propagation. - Simplified core company access UI and moved advanced controls behind plugin-provided settings surfaces. - Added retry-now affordances for blocked issue next-step notices. - Added protected-assignment enforcement for persisted agent/project/issue policies, including explicit-grant fallback behavior. - Added incremental principal-access compatibility backfill for active agent memberships and role-default human permission grants. - Added the Markdown code block wrap action fix from the latest branch changes. - Removed `design/` artifacts from the PR and removed `packages/plugins/plugin-briefs` from the final diff. - Addressed Greptile feedback for plugin actor sanitization, legacy membership handling, audit pagination, unknown grant-scope metadata, and startup test mocks. ## Verification - `pnpm exec vitest run server/src/__tests__/access-service.test.ts server/src/__tests__/company-portability.test.ts` -> 2 files passed, 54 tests passed. - `pnpm exec vitest run server/src/__tests__/server-startup-feedback-export.test.ts server/src/__tests__/access-service.test.ts server/src/__tests__/company-portability.test.ts` -> 3 files passed, 62 tests passed. - `pnpm exec vitest run server/src/__tests__/authorization-service.test.ts server/src/__tests__/plugin-access-authorization-host-services.test.ts server/src/__tests__/server-startup-feedback-export.test.ts` -> 3 files passed, 28 tests passed. - `pnpm --filter @paperclipai/server typecheck` -> passed. - `git diff --check` -> passed. - `node ./scripts/check-docker-deps-stage.mjs` -> passed. - `CI=true pnpm install --frozen-lockfile --ignore-scripts` -> passed with no lockfile update. - `pnpm exec vitest run ui/src/components/MarkdownBody.interaction.test.tsx` -> 1 test passed. - `git ls-files design packages/plugins/plugin-briefs | wc -l` -> 0. - GitHub CI on `40cd83b53` -> all checks passed, merge state `CLEAN`. - Greptile on `40cd83b53` -> 5/5, 102 files reviewed, 0 comments/annotations added, 0 unresolved review threads. - Confirmed the PR diff contains no `design/`, `packages/plugins/plugin-briefs`, `pnpm-lock.yaml`, or `.github/workflows` changes. ## Risks - Medium: task assignment authorization paths are behaviorally stricter for protected/private policy data, so existing plugin-authored policies may block assignment until explicit grants or approval flows are configured. - Medium: plugin-host authorization APIs expand the surface area available to trusted plugins and need careful review for company scoping. - Low: startup now performs a principal-access compatibility backfill, but the migration and runtime backfill use conflict-tolerant inserts. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5 coding agent, tool-enabled workflow with shell, git, and GitHub CLI access. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Dotta
GitHub
parent
c91a062326
commit
38c185fb8b
102 changed files with 6744 additions and 395 deletions
|
|
@ -1,14 +1,18 @@
|
|||
import type { Db } from "@paperclipai/db";
|
||||
import {
|
||||
activityLog,
|
||||
agentTaskSessions as agentTaskSessionsTable,
|
||||
agents as agentsTable,
|
||||
budgetIncidents,
|
||||
costEvents,
|
||||
heartbeatRuns,
|
||||
invites,
|
||||
issues as issuesTable,
|
||||
pluginLogs,
|
||||
principalPermissionGrants,
|
||||
projects as projectsTable,
|
||||
} from "@paperclipai/db";
|
||||
import { eq, and, like, desc, inArray, sql } from "drizzle-orm";
|
||||
import { eq, and, like, desc, inArray, sql, isNull, isNotNull, gt, lte } from "drizzle-orm";
|
||||
import type {
|
||||
HostServices,
|
||||
Company,
|
||||
|
|
@ -22,7 +26,7 @@ import type {
|
|||
PluginIssueOrchestrationSummary,
|
||||
PluginExecutionWorkspaceMetadata,
|
||||
} from "@paperclipai/plugin-sdk";
|
||||
import type { CreateIssueThreadInteraction, IssueDocumentSummary } from "@paperclipai/shared";
|
||||
import type { CreateIssueThreadInteraction, InviteJoinType, IssueDocumentSummary, PermissionKey, PrincipalType } from "@paperclipai/shared";
|
||||
import { pluginOperationIssueOriginKind } from "@paperclipai/shared";
|
||||
import { companyService } from "./companies.js";
|
||||
import { agentService } from "./agents.js";
|
||||
|
|
@ -36,11 +40,8 @@ import { heartbeatService } from "./heartbeat.js";
|
|||
import { budgetService } from "./budgets.js";
|
||||
import { issueApprovalService } from "./issue-approvals.js";
|
||||
import { subscribeCompanyLiveEvents } from "./live-events.js";
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { createHash, randomBytes, randomUUID } from "node:crypto";
|
||||
import path from "node:path";
|
||||
import { activityService } from "./activity.js";
|
||||
import { costService } from "./costs.js";
|
||||
import { assetService } from "./assets.js";
|
||||
import { pluginRegistryService } from "./plugin-registry.js";
|
||||
import { pluginStateStore } from "./plugin-state-store.js";
|
||||
import { pluginDatabaseService } from "./plugin-database.js";
|
||||
|
|
@ -71,6 +72,9 @@ import { request as httpsRequest } from "node:https";
|
|||
import { isIP } from "node:net";
|
||||
import { logger } from "../middleware/logger.js";
|
||||
import { getTelemetryClient } from "../telemetry.js";
|
||||
import { accessService } from "./access.js";
|
||||
import { authorizationService, type AuthorizationActor } from "./authorization.js";
|
||||
import { sanitizeRecord } from "../redaction.js";
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// SSRF protection for plugin HTTP fetch
|
||||
|
|
@ -526,11 +530,10 @@ export function buildHostServices(
|
|||
const issues = issueService(db);
|
||||
const documents = documentService(db);
|
||||
const goals = goalService(db);
|
||||
const activity = activityService(db);
|
||||
const costs = costService(db);
|
||||
const access = accessService(db);
|
||||
const authorization = authorizationService(db);
|
||||
const budgets = budgetService(db);
|
||||
const issueApprovals = issueApprovalService(db);
|
||||
const assets = assetService(db);
|
||||
const scopedBus = eventBus.forPlugin(pluginKey);
|
||||
|
||||
// Track active session event subscriptions for cleanup
|
||||
|
|
@ -562,6 +565,17 @@ export function buildHostServices(
|
|||
return rows.slice(offset, offset + limit);
|
||||
};
|
||||
|
||||
const authorizationAuditDecisionCondition = (decisionFilter: string) => {
|
||||
const conditions = [
|
||||
sql`lower(${activityLog.details}->>'decision') = ${decisionFilter}`,
|
||||
decisionFilter === "allow" ? sql`left(coalesce(${activityLog.details}->>'reason', ''), 6) = 'allow_'` : undefined,
|
||||
decisionFilter === "deny" ? sql`left(coalesce(${activityLog.details}->>'reason', ''), 5) = 'deny_'` : undefined,
|
||||
decisionFilter === "allow" ? sql`${activityLog.details}->>'allowed' = 'true'` : undefined,
|
||||
decisionFilter === "deny" ? sql`${activityLog.details}->>'allowed' = 'false'` : undefined,
|
||||
].filter((condition): condition is NonNullable<typeof condition> => Boolean(condition));
|
||||
return sql`(${sql.join(conditions, sql` OR `)})`;
|
||||
};
|
||||
|
||||
/**
|
||||
* Plugins are instance-wide in the current runtime. Company IDs are still
|
||||
* required for company-scoped data access, but there is no per-company
|
||||
|
|
@ -841,6 +855,202 @@ export function buildHostServices(
|
|||
}));
|
||||
};
|
||||
|
||||
const INVITE_TOKEN_PREFIX = "pcp_invite_";
|
||||
const INVITE_TOKEN_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
|
||||
const INVITE_TOKEN_SUFFIX_LENGTH = 8;
|
||||
const INVITE_TOKEN_MAX_RETRIES = 5;
|
||||
const COMPANY_INVITE_TTL_MS = 72 * 60 * 60 * 1000;
|
||||
|
||||
const hashToken = (token: string) => createHash("sha256").update(token).digest("hex");
|
||||
|
||||
const createInviteToken = () => {
|
||||
const bytes = randomBytes(INVITE_TOKEN_SUFFIX_LENGTH);
|
||||
let suffix = "";
|
||||
for (let idx = 0; idx < INVITE_TOKEN_SUFFIX_LENGTH; idx += 1) {
|
||||
suffix += INVITE_TOKEN_ALPHABET[bytes[idx]! % INVITE_TOKEN_ALPHABET.length];
|
||||
}
|
||||
return `${INVITE_TOKEN_PREFIX}${suffix}`;
|
||||
};
|
||||
|
||||
const isInviteTokenHashCollisionError = (error: unknown) => {
|
||||
const candidates = [
|
||||
error,
|
||||
(error as { cause?: unknown } | null)?.cause ?? null,
|
||||
];
|
||||
for (const candidate of candidates) {
|
||||
if (!candidate || typeof candidate !== "object") continue;
|
||||
const code = "code" in candidate && typeof candidate.code === "string" ? candidate.code : null;
|
||||
const message = "message" in candidate && typeof candidate.message === "string" ? candidate.message : "";
|
||||
const constraint = "constraint" in candidate && typeof candidate.constraint === "string" ? candidate.constraint : null;
|
||||
if (code !== "23505") continue;
|
||||
if (constraint === "invites_token_hash_unique_idx") return true;
|
||||
if (message.includes("invites_token_hash_unique_idx")) return true;
|
||||
}
|
||||
return false;
|
||||
};
|
||||
|
||||
const inviteState = (invite: typeof invites.$inferSelect) => {
|
||||
if (invite.revokedAt) return "revoked" as const;
|
||||
if (invite.acceptedAt) return "accepted" as const;
|
||||
if (invite.expiresAt <= new Date()) return "expired" as const;
|
||||
return "active" as const;
|
||||
};
|
||||
|
||||
const redactInvite = (invite: typeof invites.$inferSelect) => {
|
||||
const { tokenHash: _tokenHash, defaultsPayload, ...safeInvite } = invite;
|
||||
return {
|
||||
...safeInvite,
|
||||
allowedJoinTypes: safeInvite.allowedJoinTypes as InviteJoinType,
|
||||
defaultsPayload: defaultsPayload && typeof defaultsPayload === "object"
|
||||
? sanitizeRecord(defaultsPayload)
|
||||
: defaultsPayload ?? null,
|
||||
state: inviteState(invite),
|
||||
};
|
||||
};
|
||||
|
||||
const inviteStateWhereClause = (state: unknown) => {
|
||||
const now = new Date();
|
||||
switch (state) {
|
||||
case "active":
|
||||
return and(isNull(invites.revokedAt), isNull(invites.acceptedAt), gt(invites.expiresAt, now));
|
||||
case "accepted":
|
||||
return isNotNull(invites.acceptedAt);
|
||||
case "expired":
|
||||
return and(isNull(invites.revokedAt), isNull(invites.acceptedAt), lte(invites.expiresAt, now));
|
||||
case "revoked":
|
||||
return isNotNull(invites.revokedAt);
|
||||
default:
|
||||
return undefined;
|
||||
}
|
||||
};
|
||||
|
||||
const mergeInviteDefaults = (defaultsPayload: Record<string, unknown> | null | undefined, agentMessage: string | null, humanRole: string | null) => {
|
||||
const defaults = defaultsPayload && typeof defaultsPayload === "object"
|
||||
? { ...defaultsPayload }
|
||||
: {};
|
||||
if (humanRole) {
|
||||
defaults.human = {
|
||||
...(typeof defaults.human === "object" && defaults.human !== null ? defaults.human as Record<string, unknown> : {}),
|
||||
role: humanRole,
|
||||
};
|
||||
}
|
||||
if (agentMessage) {
|
||||
defaults.agent = {
|
||||
...(typeof defaults.agent === "object" && defaults.agent !== null ? defaults.agent as Record<string, unknown> : {}),
|
||||
message: agentMessage,
|
||||
};
|
||||
}
|
||||
return sanitizeRecord(defaults);
|
||||
};
|
||||
|
||||
const redactGrant = (grant: typeof principalPermissionGrants.$inferSelect) => ({
|
||||
...grant,
|
||||
principalType: grant.principalType as PrincipalType,
|
||||
permissionKey: grant.permissionKey as PermissionKey,
|
||||
scope: grant.scope && typeof grant.scope === "object" ? sanitizeRecord(grant.scope) : grant.scope ?? null,
|
||||
});
|
||||
|
||||
const loadPluginMember = async (companyId: string, memberId: string) => {
|
||||
const member = await access.getMemberById(companyId, memberId);
|
||||
if (!member) return null;
|
||||
const grants = await access.listPrincipalGrants(
|
||||
companyId,
|
||||
member.principalType as PrincipalType,
|
||||
member.principalId,
|
||||
);
|
||||
return {
|
||||
...member,
|
||||
principalType: member.principalType as PrincipalType,
|
||||
status: member.status as "pending" | "active" | "suspended" | "archived",
|
||||
grants: grants.map(redactGrant),
|
||||
};
|
||||
};
|
||||
|
||||
const pluginAssignmentActor = (actor: {
|
||||
type: "agent" | "board";
|
||||
agentId?: string | null;
|
||||
companyId?: string | null;
|
||||
userId?: string | null;
|
||||
companyIds?: string[];
|
||||
}): AuthorizationActor => {
|
||||
if (actor.type === "agent") {
|
||||
return {
|
||||
type: "agent",
|
||||
agentId: actor.agentId ?? null,
|
||||
companyId: actor.companyId ?? null,
|
||||
source: "agent_key",
|
||||
};
|
||||
}
|
||||
return {
|
||||
type: "board",
|
||||
userId: actor.userId ?? null,
|
||||
companyIds: Array.isArray(actor.companyIds) ? actor.companyIds : [],
|
||||
source: "session",
|
||||
};
|
||||
};
|
||||
|
||||
const policyPathForResource = (resourceType: "company" | "agent" | "project" | "issue") => {
|
||||
switch (resourceType) {
|
||||
case "agent":
|
||||
return { table: "agent" as const };
|
||||
case "project":
|
||||
return { table: "project" as const };
|
||||
case "issue":
|
||||
return { table: "issue" as const };
|
||||
case "company":
|
||||
return { table: "company" as const };
|
||||
}
|
||||
};
|
||||
|
||||
const readAuthorizationPolicy = async (companyId: string, resourceType: "company" | "agent" | "project" | "issue", resourceId: string) => {
|
||||
const pathInfo = policyPathForResource(resourceType);
|
||||
if (pathInfo.table === "agent") {
|
||||
const agent = await agents.getById(resourceId);
|
||||
if (!inCompany(agent, companyId)) return null;
|
||||
const permissions = agent.permissions && typeof agent.permissions === "object" ? agent.permissions as Record<string, unknown> : {};
|
||||
return {
|
||||
resourceType,
|
||||
resourceId,
|
||||
companyId,
|
||||
policy: permissions.authorizationPolicy && typeof permissions.authorizationPolicy === "object"
|
||||
? sanitizeRecord(permissions.authorizationPolicy as Record<string, unknown>)
|
||||
: null,
|
||||
updatedAt: agent.updatedAt,
|
||||
};
|
||||
}
|
||||
if (pathInfo.table === "project") {
|
||||
const project = await projects.getById(resourceId);
|
||||
if (!inCompany(project, companyId)) return null;
|
||||
const policy = project.executionWorkspacePolicy && typeof project.executionWorkspacePolicy === "object"
|
||||
? (project.executionWorkspacePolicy as unknown as Record<string, unknown>).authorizationPolicy
|
||||
: null;
|
||||
return {
|
||||
resourceType,
|
||||
resourceId,
|
||||
companyId,
|
||||
policy: policy && typeof policy === "object" ? sanitizeRecord(policy as Record<string, unknown>) : null,
|
||||
updatedAt: project.updatedAt,
|
||||
};
|
||||
}
|
||||
if (pathInfo.table === "issue") {
|
||||
const issue = await issues.getById(resourceId);
|
||||
if (!inCompany(issue, companyId)) return null;
|
||||
const policy = issue.executionPolicy && typeof issue.executionPolicy === "object"
|
||||
? (issue.executionPolicy as Record<string, unknown>).authorizationPolicy
|
||||
: null;
|
||||
return {
|
||||
resourceType,
|
||||
resourceId,
|
||||
companyId,
|
||||
policy: policy && typeof policy === "object" ? sanitizeRecord(policy as Record<string, unknown>) : null,
|
||||
updatedAt: issue.updatedAt,
|
||||
};
|
||||
}
|
||||
const company = await companies.getById(resourceId);
|
||||
if (!company || company.id !== companyId) return null;
|
||||
return { resourceType, resourceId, companyId, policy: null, updatedAt: company.updatedAt };
|
||||
};
|
||||
|
||||
return {
|
||||
config: {
|
||||
async get() {
|
||||
|
|
@ -1993,6 +2203,337 @@ export function buildHostServices(
|
|||
},
|
||||
},
|
||||
|
||||
access: {
|
||||
async listMembers(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
const rows = await access.listMembers(companyId);
|
||||
const visibleRows = params.includeArchived ? rows : rows.filter((row) => row.status !== "archived");
|
||||
const grants = await db
|
||||
.select()
|
||||
.from(principalPermissionGrants)
|
||||
.where(eq(principalPermissionGrants.companyId, companyId));
|
||||
const grantsByPrincipal = new Map<string, typeof grants>();
|
||||
for (const grant of grants) {
|
||||
const key = `${grant.principalType}:${grant.principalId}`;
|
||||
const existing = grantsByPrincipal.get(key) ?? [];
|
||||
existing.push(grant);
|
||||
grantsByPrincipal.set(key, existing);
|
||||
}
|
||||
return visibleRows.map((member) => ({
|
||||
...member,
|
||||
principalType: member.principalType as PrincipalType,
|
||||
status: member.status as "pending" | "active" | "suspended" | "archived",
|
||||
grants: (grantsByPrincipal.get(`${member.principalType}:${member.principalId}`) ?? []).map(redactGrant),
|
||||
}));
|
||||
},
|
||||
async getMember(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
return loadPluginMember(companyId, params.memberId);
|
||||
},
|
||||
async updateMember(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
const updated = await access.updateMember(companyId, params.memberId, params.patch);
|
||||
if (!updated) throw new Error("Member not found");
|
||||
await logPluginActivity({
|
||||
companyId,
|
||||
action: "company_member.updated_by_plugin",
|
||||
entityType: "company_membership",
|
||||
entityId: params.memberId,
|
||||
details: {
|
||||
patch: sanitizeRecord(params.patch as Record<string, unknown>),
|
||||
},
|
||||
});
|
||||
return (await loadPluginMember(companyId, params.memberId))!;
|
||||
},
|
||||
async listInvites(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
const limit = Math.min(Math.max(Number(params.limit ?? 20), 1), 100);
|
||||
const offset = Math.max(Number(params.offset ?? 0), 0);
|
||||
const stateClause = inviteStateWhereClause(params.state);
|
||||
const rows = await db
|
||||
.select()
|
||||
.from(invites)
|
||||
.where(stateClause ? and(eq(invites.companyId, companyId), stateClause) : eq(invites.companyId, companyId))
|
||||
.orderBy(desc(invites.createdAt))
|
||||
.limit(limit + 1)
|
||||
.offset(offset);
|
||||
const hasMore = rows.length > limit;
|
||||
return {
|
||||
invites: rows.slice(0, limit).map(redactInvite),
|
||||
nextOffset: hasMore ? offset + limit : null,
|
||||
};
|
||||
},
|
||||
async createInvite(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
const normalizedAgentMessage = typeof params.agentMessage === "string"
|
||||
? params.agentMessage.trim() || null
|
||||
: null;
|
||||
const allowedJoinTypes = params.allowedJoinTypes ?? "both";
|
||||
const humanRole = allowedJoinTypes === "agent" ? null : params.humanRole ?? "operator";
|
||||
const insertValues = {
|
||||
companyId,
|
||||
inviteType: "company_join" as const,
|
||||
allowedJoinTypes,
|
||||
defaultsPayload: mergeInviteDefaults(params.defaultsPayload ?? null, normalizedAgentMessage, humanRole),
|
||||
expiresAt: new Date(Date.now() + COMPANY_INVITE_TTL_MS),
|
||||
invitedByUserId: null,
|
||||
};
|
||||
let token: string | null = null;
|
||||
let created: typeof invites.$inferSelect | null = null;
|
||||
for (let attempt = 0; attempt < INVITE_TOKEN_MAX_RETRIES; attempt += 1) {
|
||||
const candidateToken = createInviteToken();
|
||||
try {
|
||||
created = await db
|
||||
.insert(invites)
|
||||
.values({
|
||||
...insertValues,
|
||||
tokenHash: hashToken(candidateToken),
|
||||
})
|
||||
.returning()
|
||||
.then((rows) => rows[0] ?? null);
|
||||
token = candidateToken;
|
||||
break;
|
||||
} catch (error) {
|
||||
if (!isInviteTokenHashCollisionError(error)) throw error;
|
||||
}
|
||||
}
|
||||
if (!token || !created) throw new Error("Failed to generate a unique invite token");
|
||||
await logPluginActivity({
|
||||
companyId,
|
||||
action: "invite.created_by_plugin",
|
||||
entityType: "invite",
|
||||
entityId: created.id,
|
||||
details: {
|
||||
allowedJoinTypes: created.allowedJoinTypes,
|
||||
expiresAt: created.expiresAt.toISOString(),
|
||||
hasAgentMessage: Boolean(normalizedAgentMessage),
|
||||
},
|
||||
});
|
||||
return { ...redactInvite(created), token };
|
||||
},
|
||||
async revokeInvite(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
const invite = await db
|
||||
.select()
|
||||
.from(invites)
|
||||
.where(and(eq(invites.id, params.inviteId), eq(invites.companyId, companyId)))
|
||||
.then((rows) => rows[0] ?? null);
|
||||
if (!invite) throw new Error("Invite not found");
|
||||
if (invite.acceptedAt) throw new Error("Invite already consumed");
|
||||
if (invite.revokedAt) return redactInvite(invite);
|
||||
const revoked = await db
|
||||
.update(invites)
|
||||
.set({ revokedAt: new Date(), updatedAt: new Date() })
|
||||
.where(eq(invites.id, invite.id))
|
||||
.returning()
|
||||
.then((rows) => rows[0] ?? invite);
|
||||
await logPluginActivity({
|
||||
companyId,
|
||||
action: "invite.revoked_by_plugin",
|
||||
entityType: "invite",
|
||||
entityId: invite.id,
|
||||
});
|
||||
return redactInvite(revoked);
|
||||
},
|
||||
},
|
||||
|
||||
authorization: {
|
||||
async listGrants(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
const conditions = [
|
||||
eq(principalPermissionGrants.companyId, companyId),
|
||||
params.principalType ? eq(principalPermissionGrants.principalType, params.principalType) : undefined,
|
||||
params.principalId ? eq(principalPermissionGrants.principalId, params.principalId) : undefined,
|
||||
].filter((condition): condition is NonNullable<typeof condition> => Boolean(condition));
|
||||
const rows = await db
|
||||
.select()
|
||||
.from(principalPermissionGrants)
|
||||
.where(and(...conditions))
|
||||
.orderBy(principalPermissionGrants.principalType, principalPermissionGrants.principalId, principalPermissionGrants.permissionKey);
|
||||
return rows.map(redactGrant);
|
||||
},
|
||||
async setGrants(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
if (params.principalType !== "agent" && params.principalType !== "user") {
|
||||
throw new Error("principalType must be 'agent' or 'user'");
|
||||
}
|
||||
if (params.principalType === "agent") {
|
||||
requireInCompany("Agent", await agents.getById(params.principalId), companyId);
|
||||
} else {
|
||||
const membership = await access.getMembership(companyId, params.principalType as PrincipalType, params.principalId);
|
||||
if (!membership) throw new Error("Principal is not a member of this company");
|
||||
}
|
||||
await access.setPrincipalGrants(
|
||||
companyId,
|
||||
params.principalType as PrincipalType,
|
||||
params.principalId,
|
||||
params.grants.map((grant) => ({
|
||||
permissionKey: grant.permissionKey as PermissionKey,
|
||||
scope: grant.scope ? sanitizeRecord(grant.scope) : null,
|
||||
})),
|
||||
params.grantedByUserId ?? null,
|
||||
);
|
||||
await logPluginActivity({
|
||||
companyId,
|
||||
action: "authorization.grants_updated_by_plugin",
|
||||
entityType: "principal_permission_grants",
|
||||
entityId: `${params.principalType}:${params.principalId}`,
|
||||
details: { grantCount: params.grants.length },
|
||||
});
|
||||
return access
|
||||
.listPrincipalGrants(companyId, params.principalType as PrincipalType, params.principalId)
|
||||
.then((rows) => rows.map(redactGrant));
|
||||
},
|
||||
async policySummary(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
const [members, grants] = await Promise.all([
|
||||
access.listMembers(companyId),
|
||||
db
|
||||
.select({ id: principalPermissionGrants.id })
|
||||
.from(principalPermissionGrants)
|
||||
.where(eq(principalPermissionGrants.companyId, companyId)),
|
||||
]);
|
||||
return {
|
||||
companyId,
|
||||
permissionsMode: "simple" as const,
|
||||
memberCount: members.length,
|
||||
activeMemberCount: members.filter((member) => member.status === "active").length,
|
||||
grantCount: grants.length,
|
||||
advancedPolicyAvailable: false as const,
|
||||
};
|
||||
},
|
||||
async getPolicy(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
return readAuthorizationPolicy(companyId, params.resourceType, params.resourceId);
|
||||
},
|
||||
async updatePolicy(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
const policy = params.policy ? sanitizeRecord(params.policy) : null;
|
||||
if (params.resourceType === "agent") {
|
||||
const agent = requireInCompany("Agent", await agents.getById(params.resourceId), companyId);
|
||||
const permissions = agent.permissions && typeof agent.permissions === "object"
|
||||
? { ...(agent.permissions as Record<string, unknown>) }
|
||||
: {};
|
||||
if (policy) permissions.authorizationPolicy = policy;
|
||||
else delete permissions.authorizationPolicy;
|
||||
await db
|
||||
.update(agentsTable)
|
||||
.set({ permissions, updatedAt: new Date() })
|
||||
.where(eq(agentsTable.id, agent.id));
|
||||
} else if (params.resourceType === "project") {
|
||||
const project = requireInCompany("Project", await projects.getById(params.resourceId), companyId);
|
||||
const executionWorkspacePolicy = project.executionWorkspacePolicy && typeof project.executionWorkspacePolicy === "object"
|
||||
? { ...(project.executionWorkspacePolicy as unknown as Record<string, unknown>) }
|
||||
: {};
|
||||
if (policy) executionWorkspacePolicy.authorizationPolicy = policy;
|
||||
else delete executionWorkspacePolicy.authorizationPolicy;
|
||||
await db
|
||||
.update(projectsTable)
|
||||
.set({ executionWorkspacePolicy, updatedAt: new Date() })
|
||||
.where(eq(projectsTable.id, project.id));
|
||||
} else if (params.resourceType === "issue") {
|
||||
const issue = requireInCompany("Issue", await issues.getById(params.resourceId), companyId);
|
||||
const executionPolicy = issue.executionPolicy && typeof issue.executionPolicy === "object"
|
||||
? { ...(issue.executionPolicy as Record<string, unknown>) }
|
||||
: {};
|
||||
if (policy) executionPolicy.authorizationPolicy = policy;
|
||||
else delete executionPolicy.authorizationPolicy;
|
||||
await db
|
||||
.update(issuesTable)
|
||||
.set({ executionPolicy, updatedAt: new Date() })
|
||||
.where(eq(issuesTable.id, issue.id));
|
||||
} else {
|
||||
const company = await companies.getById(params.resourceId);
|
||||
if (!company || company.id !== companyId) throw new Error("Company not found");
|
||||
throw new Error("Company authorization policy updates are not supported by the current core schema");
|
||||
}
|
||||
await logPluginActivity({
|
||||
companyId,
|
||||
action: "authorization.policy_updated_by_plugin",
|
||||
entityType: params.resourceType,
|
||||
entityId: params.resourceId,
|
||||
details: { hasPolicy: Boolean(policy) },
|
||||
});
|
||||
const updated = await readAuthorizationPolicy(companyId, params.resourceType, params.resourceId);
|
||||
if (!updated) throw new Error("Policy resource not found");
|
||||
return updated;
|
||||
},
|
||||
async previewAssignment(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
return authorization.decide({
|
||||
actor: pluginAssignmentActor(params.actor),
|
||||
action: "tasks:assign",
|
||||
resource: { type: "issue", companyId, ...params.target },
|
||||
scope: {
|
||||
issueId: params.target.issueId ?? null,
|
||||
projectId: params.target.projectId ?? null,
|
||||
parentIssueId: params.target.parentIssueId ?? null,
|
||||
assigneeAgentId: params.target.assigneeAgentId ?? null,
|
||||
assigneeUserId: params.target.assigneeUserId ?? null,
|
||||
},
|
||||
});
|
||||
},
|
||||
async explainAssignment(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
return authorization.decide({
|
||||
actor: pluginAssignmentActor(params.actor),
|
||||
action: "tasks:assign",
|
||||
resource: { type: "issue", companyId, ...params.target },
|
||||
scope: {
|
||||
issueId: params.target.issueId ?? null,
|
||||
projectId: params.target.projectId ?? null,
|
||||
parentIssueId: params.target.parentIssueId ?? null,
|
||||
assigneeAgentId: params.target.assigneeAgentId ?? null,
|
||||
assigneeUserId: params.target.assigneeUserId ?? null,
|
||||
},
|
||||
});
|
||||
},
|
||||
async searchAudit(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
await ensurePluginAvailableForCompany(companyId);
|
||||
const limit = Math.min(Math.max(Number(params.limit ?? 50), 1), 100);
|
||||
const offset = Math.max(Number(params.offset ?? 0), 0);
|
||||
const decisionFilter = typeof params.decision === "string" && params.decision.trim()
|
||||
? params.decision.trim().toLowerCase()
|
||||
: null;
|
||||
const conditions = [
|
||||
eq(activityLog.companyId, companyId),
|
||||
params.action ? eq(activityLog.action, params.action) : undefined,
|
||||
params.actorType ? eq(activityLog.actorType, params.actorType) : undefined,
|
||||
params.actorId ? eq(activityLog.actorId, params.actorId) : undefined,
|
||||
params.entityType ? eq(activityLog.entityType, params.entityType) : undefined,
|
||||
params.entityId ? eq(activityLog.entityId, params.entityId) : undefined,
|
||||
decisionFilter ? authorizationAuditDecisionCondition(decisionFilter) : undefined,
|
||||
].filter((condition): condition is NonNullable<typeof condition> => Boolean(condition));
|
||||
const rows = await db
|
||||
.select()
|
||||
.from(activityLog)
|
||||
.where(and(...conditions))
|
||||
.orderBy(desc(activityLog.createdAt))
|
||||
.limit(limit)
|
||||
.offset(offset);
|
||||
return rows.map((row) => ({
|
||||
...row,
|
||||
details: row.details && typeof row.details === "object"
|
||||
? sanitizeRecord(row.details)
|
||||
: row.details ?? null,
|
||||
}));
|
||||
},
|
||||
},
|
||||
|
||||
agentSessions: {
|
||||
async create(params) {
|
||||
const companyId = ensureCompanyId(params.companyId);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue