mirror of
https://github.com/alkimake/paperclip.git
synced 2026-06-14 01:50:39 +09:00
feat: implement multi-user access and invite flows (#3784)
## Thinking Path > - Paperclip is the control plane for autonomous AI companies. > - V1 needs to stay local-first while also supporting shared, authenticated deployments. > - Human operators need real identities, company membership, invite flows, profile surfaces, and company-scoped access controls. > - Agents and operators also need the existing issue, inbox, workspace, approval, and plugin flows to keep working under those authenticated boundaries. > - This branch accumulated the multi-user implementation, follow-up QA fixes, workspace/runtime refinements, invite UX improvements, release-branch conflict resolution, and review hardening. > - This pull request consolidates that branch onto the current `master` branch as a single reviewable PR. > - The benefit is a complete multi-user implementation path with tests and docs carried forward without dropping existing branch work. ## What Changed - Added authenticated human-user access surfaces: auth/session routes, company user directory, profile settings, company access/member management, join requests, and invite management. - Added invite creation, invite landing, onboarding, logo/branding, invite grants, deduped join requests, and authenticated multi-user E2E coverage. - Tightened company-scoped and instance-admin authorization across board, plugin, adapter, access, issue, and workspace routes. - Added profile-image URL validation hardening, avatar preservation on name-only profile updates, and join-request uniqueness migration cleanup for pending human requests. - Added an atomic member role/status/grants update path so Company Access saves no longer leave partially updated permissions. - Improved issue chat, inbox, assignee identity rendering, sidebar/account/company navigation, workspace routing, and execution workspace reuse behavior for multi-user operation. - Added and updated server/UI tests covering auth, invites, membership, issue workspace inheritance, plugin authz, inbox/chat behavior, and multi-user flows. - Merged current `public-gh/master` into this branch, resolved all conflicts, and verified no `pnpm-lock.yaml` change is included in this PR diff. ## Verification - `pnpm exec vitest run server/src/__tests__/issues-service.test.ts ui/src/components/IssueChatThread.test.tsx ui/src/pages/Inbox.test.tsx` - `pnpm run preflight:workspace-links && pnpm exec vitest run server/src/__tests__/plugin-routes-authz.test.ts` - `pnpm exec vitest run server/src/__tests__/plugin-routes-authz.test.ts server/src/__tests__/workspace-runtime-service-authz.test.ts server/src/__tests__/access-validators.test.ts` - `pnpm exec vitest run server/src/__tests__/authz-company-access.test.ts server/src/__tests__/routines-routes.test.ts server/src/__tests__/sidebar-preferences-routes.test.ts server/src/__tests__/approval-routes-idempotency.test.ts server/src/__tests__/openclaw-invite-prompt-route.test.ts server/src/__tests__/agent-cross-tenant-authz-routes.test.ts server/src/__tests__/routines-e2e.test.ts` - `pnpm exec vitest run server/src/__tests__/auth-routes.test.ts ui/src/pages/CompanyAccess.test.tsx` - `pnpm --filter @paperclipai/shared typecheck && pnpm --filter @paperclipai/db typecheck && pnpm --filter @paperclipai/server typecheck` - `pnpm --filter @paperclipai/shared typecheck && pnpm --filter @paperclipai/server typecheck` - `pnpm --filter @paperclipai/ui typecheck` - `pnpm db:generate` - `npx playwright test --config tests/e2e/playwright.config.ts --list` - Confirmed branch has no uncommitted changes and is `0` commits behind `public-gh/master` before PR creation. - Confirmed no `pnpm-lock.yaml` change is staged or present in the PR diff. ## Risks - High review surface area: this PR contains the accumulated multi-user branch plus follow-up fixes, so reviewers should focus especially on company-boundary enforcement and authenticated-vs-local deployment behavior. - UI behavior changed across invites, inbox, issue chat, access settings, and sidebar navigation; no browser screenshots are included in this branch-consolidation PR. - Plugin install, upgrade, and lifecycle/config mutations now require instance-admin access, which is intentional but may change expectations for non-admin board users. - A join-request dedupe migration rejects duplicate pending human requests before creating unique indexes; deployments with unusual historical duplicates should review the migration behavior. - Company member role/status/grant saves now use a new combined endpoint; older separate endpoints remain for compatibility. - Full production build was not run locally in this heartbeat; CI should cover the full matrix. ## Model Used - OpenAI Codex coding agent, GPT-5-based model, CLI/tool-use environment. Exact deployed model identifier and context window were not exposed by the runtime. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge Note on screenshots: this is a branch-consolidation PR for an already-developed multi-user branch, and no browser screenshots were captured during this heartbeat. --------- Co-authored-by: dotta <dotta@example.com> Co-authored-by: Paperclip <noreply@paperclip.ing> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Dotta
GitHub
parent
e93e418cbf
commit
b9a80dcf22
150 changed files with 26872 additions and 1289 deletions
84
packages/db/scripts/create-auth-bootstrap-invite.ts
Normal file
84
packages/db/scripts/create-auth-bootstrap-invite.ts
Normal file
|
|
@ -0,0 +1,84 @@
|
|||
import { createHash, randomBytes } from "node:crypto";
|
||||
import { readFileSync } from "node:fs";
|
||||
import path from "node:path";
|
||||
import { and, eq, gt, isNull } from "drizzle-orm";
|
||||
import { createDb } from "../src/client.js";
|
||||
import { invites } from "../src/schema/index.js";
|
||||
|
||||
function hashToken(token: string) {
|
||||
return createHash("sha256").update(token).digest("hex");
|
||||
}
|
||||
|
||||
function createInviteToken() {
|
||||
return `pcp_bootstrap_${randomBytes(24).toString("hex")}`;
|
||||
}
|
||||
|
||||
function readArg(flag: string) {
|
||||
const index = process.argv.indexOf(flag);
|
||||
if (index === -1) return null;
|
||||
return process.argv[index + 1] ?? null;
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const configPath = readArg("--config");
|
||||
const baseUrl = readArg("--base-url");
|
||||
|
||||
if (!configPath || !baseUrl) {
|
||||
throw new Error("Usage: tsx create-auth-bootstrap-invite.ts --config <path> --base-url <url>");
|
||||
}
|
||||
|
||||
const config = JSON.parse(readFileSync(path.resolve(configPath), "utf8")) as {
|
||||
database?: {
|
||||
mode?: string;
|
||||
embeddedPostgresPort?: number;
|
||||
connectionString?: string;
|
||||
};
|
||||
};
|
||||
const dbUrl =
|
||||
config.database?.mode === "postgres"
|
||||
? config.database.connectionString
|
||||
: `postgres://paperclip:paperclip@127.0.0.1:${config.database?.embeddedPostgresPort ?? 54329}/paperclip`;
|
||||
if (!dbUrl) {
|
||||
throw new Error(`Could not resolve database connection from ${configPath}`);
|
||||
}
|
||||
|
||||
const db = createDb(dbUrl);
|
||||
const closableDb = db as typeof db & {
|
||||
$client?: {
|
||||
end?: (options?: { timeout?: number }) => Promise<void>;
|
||||
};
|
||||
};
|
||||
|
||||
try {
|
||||
const now = new Date();
|
||||
await db
|
||||
.update(invites)
|
||||
.set({ revokedAt: now, updatedAt: now })
|
||||
.where(
|
||||
and(
|
||||
eq(invites.inviteType, "bootstrap_ceo"),
|
||||
isNull(invites.revokedAt),
|
||||
isNull(invites.acceptedAt),
|
||||
gt(invites.expiresAt, now)
|
||||
)
|
||||
);
|
||||
|
||||
const token = createInviteToken();
|
||||
await db.insert(invites).values({
|
||||
inviteType: "bootstrap_ceo",
|
||||
tokenHash: hashToken(token),
|
||||
allowedJoinTypes: "human",
|
||||
expiresAt: new Date(Date.now() + 72 * 60 * 60 * 1000),
|
||||
invitedByUserId: "system",
|
||||
});
|
||||
|
||||
process.stdout.write(`${baseUrl.replace(/\/+$/, "")}/invite/${token}\n`);
|
||||
} finally {
|
||||
await closableDb.$client?.end?.({ timeout: 5 }).catch(() => undefined);
|
||||
}
|
||||
}
|
||||
|
||||
main().catch((error) => {
|
||||
process.stderr.write(`${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);
|
||||
process.exit(1);
|
||||
});
|
||||
57
packages/db/src/migrations/0057_tidy_join_requests.sql
Normal file
57
packages/db/src/migrations/0057_tidy_join_requests.sql
Normal file
|
|
@ -0,0 +1,57 @@
|
|||
WITH ranked_user_requests AS (
|
||||
SELECT
|
||||
id,
|
||||
row_number() OVER (
|
||||
PARTITION BY company_id, requesting_user_id
|
||||
ORDER BY created_at ASC, id ASC
|
||||
) AS rank
|
||||
FROM join_requests
|
||||
WHERE request_type = 'human'
|
||||
AND status = 'pending_approval'
|
||||
AND requesting_user_id IS NOT NULL
|
||||
)
|
||||
UPDATE join_requests
|
||||
SET
|
||||
status = 'rejected',
|
||||
rejected_at = COALESCE(rejected_at, now()),
|
||||
updated_at = now()
|
||||
WHERE id IN (
|
||||
SELECT id
|
||||
FROM ranked_user_requests
|
||||
WHERE rank > 1
|
||||
);
|
||||
--> statement-breakpoint
|
||||
WITH ranked_email_requests AS (
|
||||
SELECT
|
||||
id,
|
||||
row_number() OVER (
|
||||
PARTITION BY company_id, lower(request_email_snapshot)
|
||||
ORDER BY created_at ASC, id ASC
|
||||
) AS rank
|
||||
FROM join_requests
|
||||
WHERE request_type = 'human'
|
||||
AND status = 'pending_approval'
|
||||
AND request_email_snapshot IS NOT NULL
|
||||
)
|
||||
UPDATE join_requests
|
||||
SET
|
||||
status = 'rejected',
|
||||
rejected_at = COALESCE(rejected_at, now()),
|
||||
updated_at = now()
|
||||
WHERE id IN (
|
||||
SELECT id
|
||||
FROM ranked_email_requests
|
||||
WHERE rank > 1
|
||||
);
|
||||
--> statement-breakpoint
|
||||
CREATE UNIQUE INDEX IF NOT EXISTS "join_requests_pending_human_user_uq"
|
||||
ON "join_requests" USING btree ("company_id", "requesting_user_id")
|
||||
WHERE "request_type" = 'human'
|
||||
AND "status" = 'pending_approval'
|
||||
AND "requesting_user_id" IS NOT NULL;
|
||||
--> statement-breakpoint
|
||||
CREATE UNIQUE INDEX IF NOT EXISTS "join_requests_pending_human_email_uq"
|
||||
ON "join_requests" USING btree ("company_id", lower("request_email_snapshot"))
|
||||
WHERE "request_type" = 'human'
|
||||
AND "status" = 'pending_approval'
|
||||
AND "request_email_snapshot" IS NOT NULL;
|
||||
13432
packages/db/src/migrations/meta/0057_snapshot.json
Normal file
13432
packages/db/src/migrations/meta/0057_snapshot.json
Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -400,6 +400,13 @@
|
|||
"when": 1776084034244,
|
||||
"tag": "0056_spooky_ultragirl",
|
||||
"breakpoints": true
|
||||
},
|
||||
{
|
||||
"idx": 57,
|
||||
"version": "7",
|
||||
"when": 1776309613598,
|
||||
"tag": "0057_tidy_join_requests",
|
||||
"breakpoints": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
import { sql } from "drizzle-orm";
|
||||
import { pgTable, uuid, text, timestamp, jsonb, index, uniqueIndex } from "drizzle-orm/pg-core";
|
||||
import { companies } from "./companies.js";
|
||||
import { invites } from "./invites.js";
|
||||
|
|
@ -37,5 +38,11 @@ export const joinRequests = pgTable(
|
|||
table.requestType,
|
||||
table.createdAt,
|
||||
),
|
||||
pendingHumanUserUniqueIdx: uniqueIndex("join_requests_pending_human_user_uq")
|
||||
.on(table.companyId, table.requestingUserId)
|
||||
.where(sql`${table.requestType} = 'human' AND ${table.status} = 'pending_approval' AND ${table.requestingUserId} IS NOT NULL`),
|
||||
pendingHumanEmailUniqueIdx: uniqueIndex("join_requests_pending_human_email_uq")
|
||||
.on(table.companyId, sql`lower(${table.requestEmailSnapshot})`)
|
||||
.where(sql`${table.requestType} = 'human' AND ${table.status} = 'pending_approval' AND ${table.requestEmailSnapshot} IS NOT NULL`),
|
||||
}),
|
||||
);
|
||||
|
|
|
|||
|
|
@ -362,6 +362,30 @@ export type PrincipalType = (typeof PRINCIPAL_TYPES)[number];
|
|||
export const MEMBERSHIP_STATUSES = ["pending", "active", "suspended"] as const;
|
||||
export type MembershipStatus = (typeof MEMBERSHIP_STATUSES)[number];
|
||||
|
||||
export const COMPANY_MEMBERSHIP_ROLES = [
|
||||
"owner",
|
||||
"admin",
|
||||
"operator",
|
||||
"viewer",
|
||||
"member",
|
||||
] as const;
|
||||
export type CompanyMembershipRole = (typeof COMPANY_MEMBERSHIP_ROLES)[number];
|
||||
|
||||
export const HUMAN_COMPANY_MEMBERSHIP_ROLES = [
|
||||
"owner",
|
||||
"admin",
|
||||
"operator",
|
||||
"viewer",
|
||||
] as const;
|
||||
export type HumanCompanyMembershipRole = (typeof HUMAN_COMPANY_MEMBERSHIP_ROLES)[number];
|
||||
|
||||
export const HUMAN_COMPANY_MEMBERSHIP_ROLE_LABELS: Record<HumanCompanyMembershipRole, string> = {
|
||||
owner: "Owner",
|
||||
admin: "Admin",
|
||||
operator: "Operator",
|
||||
viewer: "Viewer",
|
||||
};
|
||||
|
||||
export const INSTANCE_USER_ROLES = ["instance_admin"] as const;
|
||||
export type InstanceUserRole = (typeof INSTANCE_USER_ROLES)[number];
|
||||
|
||||
|
|
|
|||
|
|
@ -54,6 +54,9 @@ export {
|
|||
LIVE_EVENT_TYPES,
|
||||
PRINCIPAL_TYPES,
|
||||
MEMBERSHIP_STATUSES,
|
||||
COMPANY_MEMBERSHIP_ROLES,
|
||||
HUMAN_COMPANY_MEMBERSHIP_ROLES,
|
||||
HUMAN_COMPANY_MEMBERSHIP_ROLE_LABELS,
|
||||
INSTANCE_USER_ROLES,
|
||||
INVITE_TYPES,
|
||||
INVITE_JOIN_TYPES,
|
||||
|
|
@ -127,6 +130,8 @@ export {
|
|||
type LiveEventType,
|
||||
type PrincipalType,
|
||||
type MembershipStatus,
|
||||
type CompanyMembershipRole,
|
||||
type HumanCompanyMembershipRole,
|
||||
type InstanceUserRole,
|
||||
type InviteType,
|
||||
type InviteJoinType,
|
||||
|
|
@ -308,11 +313,21 @@ export type {
|
|||
SidebarBadges,
|
||||
SidebarOrderPreference,
|
||||
InboxDismissal,
|
||||
AccessUserProfile,
|
||||
CompanyMemberRecord,
|
||||
CompanyMembersResponse,
|
||||
CompanyMembership,
|
||||
CompanyInviteListResponse,
|
||||
CompanyInviteRecord,
|
||||
PrincipalPermissionGrant,
|
||||
Invite,
|
||||
JoinRequest,
|
||||
JoinRequestInviteSummary,
|
||||
JoinRequestRecord,
|
||||
InstanceUserRoleGrant,
|
||||
AdminUserDirectoryEntry,
|
||||
UserCompanyAccessEntry,
|
||||
UserCompanyAccessResponse,
|
||||
CompanyPortabilityInclude,
|
||||
CompanyPortabilityEnvInput,
|
||||
CompanyPortabilityFileEntry,
|
||||
|
|
@ -566,12 +581,19 @@ export {
|
|||
createCompanyInviteSchema,
|
||||
createOpenClawInvitePromptSchema,
|
||||
acceptInviteSchema,
|
||||
listCompanyInvitesQuerySchema,
|
||||
listJoinRequestsQuerySchema,
|
||||
claimJoinRequestApiKeySchema,
|
||||
boardCliAuthAccessLevelSchema,
|
||||
createCliAuthChallengeSchema,
|
||||
resolveCliAuthChallengeSchema,
|
||||
currentUserProfileSchema,
|
||||
authSessionSchema,
|
||||
updateCurrentUserProfileSchema,
|
||||
updateCompanyMemberSchema,
|
||||
updateCompanyMemberWithPermissionsSchema,
|
||||
updateMemberPermissionsSchema,
|
||||
searchAdminUsersQuerySchema,
|
||||
updateUserCompanyAccessSchema,
|
||||
type CreateCostEvent,
|
||||
type CreateFinanceEvent,
|
||||
|
|
@ -580,12 +602,19 @@ export {
|
|||
type CreateCompanyInvite,
|
||||
type CreateOpenClawInvitePrompt,
|
||||
type AcceptInvite,
|
||||
type ListCompanyInvitesQuery,
|
||||
type ListJoinRequestsQuery,
|
||||
type ClaimJoinRequestApiKey,
|
||||
type BoardCliAuthAccessLevel,
|
||||
type CreateCliAuthChallenge,
|
||||
type ResolveCliAuthChallenge,
|
||||
type CurrentUserProfile,
|
||||
type AuthSession,
|
||||
type UpdateCurrentUserProfile,
|
||||
type UpdateCompanyMember,
|
||||
type UpdateCompanyMemberWithPermissions,
|
||||
type UpdateMemberPermissions,
|
||||
type SearchAdminUsersQuery,
|
||||
type UpdateUserCompanyAccess,
|
||||
companySkillSourceTypeSchema,
|
||||
companySkillTrustLevelSchema,
|
||||
|
|
@ -663,18 +692,23 @@ export {
|
|||
AGENT_MENTION_SCHEME,
|
||||
PROJECT_MENTION_SCHEME,
|
||||
SKILL_MENTION_SCHEME,
|
||||
USER_MENTION_SCHEME,
|
||||
buildAgentMentionHref,
|
||||
buildProjectMentionHref,
|
||||
buildSkillMentionHref,
|
||||
buildUserMentionHref,
|
||||
extractAgentMentionIds,
|
||||
extractProjectMentionIds,
|
||||
extractSkillMentionIds,
|
||||
extractUserMentionIds,
|
||||
parseAgentMentionHref,
|
||||
parseProjectMentionHref,
|
||||
parseSkillMentionHref,
|
||||
extractProjectMentionIds,
|
||||
parseUserMentionHref,
|
||||
type ParsedAgentMention,
|
||||
type ParsedProjectMention,
|
||||
type ParsedSkillMention,
|
||||
type ParsedUserMention,
|
||||
} from "./project-mentions.js";
|
||||
|
||||
export {
|
||||
|
|
|
|||
|
|
@ -3,12 +3,15 @@ import {
|
|||
buildAgentMentionHref,
|
||||
buildProjectMentionHref,
|
||||
buildSkillMentionHref,
|
||||
buildUserMentionHref,
|
||||
extractAgentMentionIds,
|
||||
extractProjectMentionIds,
|
||||
extractSkillMentionIds,
|
||||
extractUserMentionIds,
|
||||
parseAgentMentionHref,
|
||||
parseProjectMentionHref,
|
||||
parseSkillMentionHref,
|
||||
parseUserMentionHref,
|
||||
} from "./project-mentions.js";
|
||||
|
||||
describe("project-mentions", () => {
|
||||
|
|
@ -30,6 +33,14 @@ describe("project-mentions", () => {
|
|||
expect(extractAgentMentionIds(`[@CodexCoder](${href})`)).toEqual(["agent-123"]);
|
||||
});
|
||||
|
||||
it("round-trips user mentions", () => {
|
||||
const href = buildUserMentionHref("user-123");
|
||||
expect(parseUserMentionHref(href)).toEqual({
|
||||
userId: "user-123",
|
||||
});
|
||||
expect(extractUserMentionIds(`[@Taylor](${href})`)).toEqual(["user-123"]);
|
||||
});
|
||||
|
||||
it("round-trips skill mentions with slug metadata", () => {
|
||||
const href = buildSkillMentionHref("skill-123", "release-changelog");
|
||||
expect(parseSkillMentionHref(href)).toEqual({
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
export const PROJECT_MENTION_SCHEME = "project://";
|
||||
export const AGENT_MENTION_SCHEME = "agent://";
|
||||
export const USER_MENTION_SCHEME = "user://";
|
||||
export const SKILL_MENTION_SCHEME = "skill://";
|
||||
|
||||
const HEX_COLOR_RE = /^[0-9a-f]{6}$/i;
|
||||
|
|
@ -8,6 +9,7 @@ const HEX_COLOR_WITH_HASH_RE = /^#[0-9a-f]{6}$/i;
|
|||
const HEX_COLOR_SHORT_WITH_HASH_RE = /^#[0-9a-f]{3}$/i;
|
||||
const PROJECT_MENTION_LINK_RE = /\[[^\]]*]\((project:\/\/[^)\s]+)\)/gi;
|
||||
const AGENT_MENTION_LINK_RE = /\[[^\]]*]\((agent:\/\/[^)\s]+)\)/gi;
|
||||
const USER_MENTION_LINK_RE = /\[[^\]]*]\((user:\/\/[^)\s]+)\)/gi;
|
||||
const SKILL_MENTION_LINK_RE = /\[[^\]]*]\((skill:\/\/[^)\s]+)\)/gi;
|
||||
const AGENT_ICON_NAME_RE = /^[a-z0-9-]+$/i;
|
||||
const SKILL_SLUG_RE = /^[a-z0-9][a-z0-9-]*$/i;
|
||||
|
|
@ -22,6 +24,10 @@ export interface ParsedAgentMention {
|
|||
icon: string | null;
|
||||
}
|
||||
|
||||
export interface ParsedUserMention {
|
||||
userId: string;
|
||||
}
|
||||
|
||||
export interface ParsedSkillMention {
|
||||
skillId: string;
|
||||
slug: string | null;
|
||||
|
|
@ -111,6 +117,28 @@ export function parseAgentMentionHref(href: string): ParsedAgentMention | null {
|
|||
};
|
||||
}
|
||||
|
||||
export function buildUserMentionHref(userId: string): string {
|
||||
return `${USER_MENTION_SCHEME}${userId.trim()}`;
|
||||
}
|
||||
|
||||
export function parseUserMentionHref(href: string): ParsedUserMention | null {
|
||||
if (!href.startsWith(USER_MENTION_SCHEME)) return null;
|
||||
|
||||
let url: URL;
|
||||
try {
|
||||
url = new URL(href);
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (url.protocol !== "user:") return null;
|
||||
|
||||
const userId = `${url.hostname}${url.pathname}`.replace(/^\/+/, "").trim();
|
||||
if (!userId) return null;
|
||||
|
||||
return { userId };
|
||||
}
|
||||
|
||||
export function buildSkillMentionHref(skillId: string, slug?: string | null): string {
|
||||
const trimmedSkillId = skillId.trim();
|
||||
const normalizedSlug = normalizeSkillSlug(slug ?? null);
|
||||
|
|
@ -165,6 +193,18 @@ export function extractAgentMentionIds(markdown: string): string[] {
|
|||
return [...ids];
|
||||
}
|
||||
|
||||
export function extractUserMentionIds(markdown: string): string[] {
|
||||
if (!markdown) return [];
|
||||
const ids = new Set<string>();
|
||||
const re = new RegExp(USER_MENTION_LINK_RE);
|
||||
let match: RegExpExecArray | null;
|
||||
while ((match = re.exec(markdown)) !== null) {
|
||||
const parsed = parseUserMentionHref(match[1]);
|
||||
if (parsed) ids.add(parsed.userId);
|
||||
}
|
||||
return [...ids];
|
||||
}
|
||||
|
||||
export function extractSkillMentionIds(markdown: string): string[] {
|
||||
if (!markdown) return [];
|
||||
const ids = new Set<string>();
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
import type {
|
||||
AgentAdapterType,
|
||||
CompanyStatus,
|
||||
HumanCompanyMembershipRole,
|
||||
InstanceUserRole,
|
||||
InviteJoinType,
|
||||
InviteType,
|
||||
|
|
@ -33,6 +35,30 @@ export interface PrincipalPermissionGrant {
|
|||
updatedAt: Date;
|
||||
}
|
||||
|
||||
export interface AccessUserProfile {
|
||||
id: string;
|
||||
email: string | null;
|
||||
name: string | null;
|
||||
image: string | null;
|
||||
}
|
||||
|
||||
export interface CompanyMemberRecord extends CompanyMembership {
|
||||
principalType: "user";
|
||||
membershipRole: HumanCompanyMembershipRole | null;
|
||||
user: AccessUserProfile | null;
|
||||
grants: PrincipalPermissionGrant[];
|
||||
}
|
||||
|
||||
export interface CompanyMembersResponse {
|
||||
members: CompanyMemberRecord[];
|
||||
access: {
|
||||
currentUserRole: HumanCompanyMembershipRole | null;
|
||||
canManageMembers: boolean;
|
||||
canInviteUsers: boolean;
|
||||
canApproveJoinRequests: boolean;
|
||||
};
|
||||
}
|
||||
|
||||
export interface Invite {
|
||||
id: string;
|
||||
companyId: string | null;
|
||||
|
|
@ -48,6 +74,22 @@ export interface Invite {
|
|||
updatedAt: Date;
|
||||
}
|
||||
|
||||
export type InviteState = "active" | "revoked" | "accepted" | "expired";
|
||||
|
||||
export interface CompanyInviteRecord extends Invite {
|
||||
companyName: string | null;
|
||||
humanRole: HumanCompanyMembershipRole | null;
|
||||
inviteMessage: string | null;
|
||||
state: InviteState;
|
||||
invitedByUser: AccessUserProfile | null;
|
||||
relatedJoinRequestId: string | null;
|
||||
}
|
||||
|
||||
export interface CompanyInviteListResponse {
|
||||
invites: CompanyInviteRecord[];
|
||||
nextOffset: number | null;
|
||||
}
|
||||
|
||||
export interface JoinRequest {
|
||||
id: string;
|
||||
inviteId: string;
|
||||
|
|
@ -72,6 +114,26 @@ export interface JoinRequest {
|
|||
updatedAt: Date;
|
||||
}
|
||||
|
||||
export interface JoinRequestInviteSummary {
|
||||
id: string;
|
||||
inviteType: InviteType;
|
||||
allowedJoinTypes: InviteJoinType;
|
||||
humanRole: HumanCompanyMembershipRole | null;
|
||||
inviteMessage: string | null;
|
||||
createdAt: Date;
|
||||
expiresAt: Date;
|
||||
revokedAt: Date | null;
|
||||
acceptedAt: Date | null;
|
||||
invitedByUser: AccessUserProfile | null;
|
||||
}
|
||||
|
||||
export interface JoinRequestRecord extends JoinRequest {
|
||||
requesterUser: AccessUserProfile | null;
|
||||
approvedByUser: AccessUserProfile | null;
|
||||
rejectedByUser: AccessUserProfile | null;
|
||||
invite: JoinRequestInviteSummary | null;
|
||||
}
|
||||
|
||||
export interface InstanceUserRoleGrant {
|
||||
id: string;
|
||||
userId: string;
|
||||
|
|
@ -79,3 +141,21 @@ export interface InstanceUserRoleGrant {
|
|||
createdAt: Date;
|
||||
updatedAt: Date;
|
||||
}
|
||||
|
||||
export interface AdminUserDirectoryEntry extends AccessUserProfile {
|
||||
isInstanceAdmin: boolean;
|
||||
activeCompanyMembershipCount: number;
|
||||
}
|
||||
|
||||
export interface UserCompanyAccessEntry extends CompanyMembership {
|
||||
principalType: "user";
|
||||
companyName: string | null;
|
||||
companyStatus: CompanyStatus | null;
|
||||
}
|
||||
|
||||
export interface UserCompanyAccessResponse {
|
||||
user: (AccessUserProfile & {
|
||||
isInstanceAdmin: boolean;
|
||||
}) | null;
|
||||
companyAccess: UserCompanyAccessEntry[];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -173,11 +173,21 @@ export type { SidebarBadges } from "./sidebar-badges.js";
|
|||
export type { SidebarOrderPreference } from "./sidebar-preferences.js";
|
||||
export type { InboxDismissal } from "./inbox-dismissal.js";
|
||||
export type {
|
||||
AccessUserProfile,
|
||||
CompanyMemberRecord,
|
||||
CompanyMembersResponse,
|
||||
CompanyMembership,
|
||||
CompanyInviteListResponse,
|
||||
CompanyInviteRecord,
|
||||
PrincipalPermissionGrant,
|
||||
Invite,
|
||||
JoinRequest,
|
||||
JoinRequestInviteSummary,
|
||||
JoinRequestRecord,
|
||||
InstanceUserRoleGrant,
|
||||
AdminUserDirectoryEntry,
|
||||
UserCompanyAccessEntry,
|
||||
UserCompanyAccessResponse,
|
||||
} from "./access.js";
|
||||
export type { QuotaWindow, ProviderQuotaResult } from "./quota.js";
|
||||
export type {
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
import type { PauseReason, ProjectStatus } from "../constants.js";
|
||||
import type { AgentEnvConfig } from "./secrets.js";
|
||||
import type {
|
||||
ProjectExecutionWorkspacePolicy,
|
||||
ProjectWorkspaceRuntimeConfig,
|
||||
WorkspaceRuntimeService,
|
||||
} from "./workspace-runtime.js";
|
||||
import type { AgentEnvConfig } from "./secrets.js";
|
||||
|
||||
export type ProjectWorkspaceSourceType = "local_path" | "git_repo" | "remote_managed" | "non_git_path";
|
||||
export type ProjectWorkspaceVisibility = "default" | "advanced";
|
||||
|
|
|
|||
|
|
@ -1,14 +1,18 @@
|
|||
import { z } from "zod";
|
||||
import {
|
||||
AGENT_ADAPTER_TYPES,
|
||||
HUMAN_COMPANY_MEMBERSHIP_ROLES,
|
||||
INVITE_JOIN_TYPES,
|
||||
JOIN_REQUEST_STATUSES,
|
||||
JOIN_REQUEST_TYPES,
|
||||
MEMBERSHIP_STATUSES,
|
||||
PERMISSION_KEYS,
|
||||
} from "../constants.js";
|
||||
import { optionalAgentAdapterTypeSchema } from "../adapter-type.js";
|
||||
|
||||
export const createCompanyInviteSchema = z.object({
|
||||
allowedJoinTypes: z.enum(INVITE_JOIN_TYPES).default("both"),
|
||||
humanRole: z.enum(HUMAN_COMPANY_MEMBERSHIP_ROLES).optional().nullable(),
|
||||
defaultsPayload: z.record(z.string(), z.unknown()).optional().nullable(),
|
||||
agentMessage: z.string().max(4000).optional().nullable(),
|
||||
});
|
||||
|
|
@ -46,6 +50,14 @@ export const listJoinRequestsQuerySchema = z.object({
|
|||
|
||||
export type ListJoinRequestsQuery = z.infer<typeof listJoinRequestsQuerySchema>;
|
||||
|
||||
export const listCompanyInvitesQuerySchema = z.object({
|
||||
state: z.enum(["active", "revoked", "accepted", "expired"]).optional(),
|
||||
limit: z.coerce.number().int().min(1).max(100).optional().default(20),
|
||||
offset: z.coerce.number().int().min(0).optional().default(0),
|
||||
});
|
||||
|
||||
export type ListCompanyInvitesQuery = z.infer<typeof listCompanyInvitesQuerySchema>;
|
||||
|
||||
export const claimJoinRequestApiKeySchema = z.object({
|
||||
claimSecret: z.string().min(16).max(256),
|
||||
});
|
||||
|
|
@ -85,8 +97,82 @@ export const updateMemberPermissionsSchema = z.object({
|
|||
|
||||
export type UpdateMemberPermissions = z.infer<typeof updateMemberPermissionsSchema>;
|
||||
|
||||
export const updateCompanyMemberSchema = z.object({
|
||||
membershipRole: z.enum(HUMAN_COMPANY_MEMBERSHIP_ROLES).optional().nullable(),
|
||||
status: z.enum(MEMBERSHIP_STATUSES).optional(),
|
||||
}).refine((value) => value.membershipRole !== undefined || value.status !== undefined, {
|
||||
message: "membershipRole or status is required",
|
||||
});
|
||||
|
||||
export type UpdateCompanyMember = z.infer<typeof updateCompanyMemberSchema>;
|
||||
|
||||
export const updateCompanyMemberWithPermissionsSchema = z.object({
|
||||
membershipRole: z.enum(HUMAN_COMPANY_MEMBERSHIP_ROLES).optional().nullable(),
|
||||
status: z.enum(MEMBERSHIP_STATUSES).optional(),
|
||||
grants: updateMemberPermissionsSchema.shape.grants.default([]),
|
||||
}).refine((value) => value.membershipRole !== undefined || value.status !== undefined, {
|
||||
message: "membershipRole or status is required",
|
||||
});
|
||||
|
||||
export type UpdateCompanyMemberWithPermissions = z.infer<typeof updateCompanyMemberWithPermissionsSchema>;
|
||||
|
||||
export const updateUserCompanyAccessSchema = z.object({
|
||||
companyIds: z.array(z.string().uuid()).default([]),
|
||||
});
|
||||
|
||||
export type UpdateUserCompanyAccess = z.infer<typeof updateUserCompanyAccessSchema>;
|
||||
|
||||
export const searchAdminUsersQuerySchema = z.object({
|
||||
query: z.string().trim().max(120).optional().default(""),
|
||||
});
|
||||
|
||||
export type SearchAdminUsersQuery = z.infer<typeof searchAdminUsersQuerySchema>;
|
||||
|
||||
const profileImageAssetPathPattern = /^\/api\/assets\/[^/?#]+\/content(?:\?[^#]*)?(?:#.*)?$/;
|
||||
|
||||
function isValidProfileImage(value: string): boolean {
|
||||
if (profileImageAssetPathPattern.test(value)) return true;
|
||||
|
||||
try {
|
||||
const url = new URL(value);
|
||||
return url.protocol === "https:" || url.protocol === "http:";
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
const profileImageSchema = z
|
||||
.string()
|
||||
.trim()
|
||||
.min(1)
|
||||
.max(4000)
|
||||
.refine(isValidProfileImage, { message: "Invalid profile image URL" });
|
||||
|
||||
export const currentUserProfileSchema = z.object({
|
||||
id: z.string().min(1),
|
||||
email: z.string().email().nullable(),
|
||||
name: z.string().min(1).max(120).nullable(),
|
||||
image: profileImageSchema.nullable(),
|
||||
});
|
||||
|
||||
export type CurrentUserProfile = z.infer<typeof currentUserProfileSchema>;
|
||||
|
||||
export const authSessionSchema = z.object({
|
||||
session: z.object({
|
||||
id: z.string().min(1),
|
||||
userId: z.string().min(1),
|
||||
}),
|
||||
user: currentUserProfileSchema,
|
||||
});
|
||||
|
||||
export type AuthSession = z.infer<typeof authSessionSchema>;
|
||||
|
||||
export const updateCurrentUserProfileSchema = z.object({
|
||||
name: z.string().trim().min(1).max(120),
|
||||
image: z
|
||||
.union([profileImageSchema, z.literal(""), z.null()])
|
||||
.optional()
|
||||
.transform((value) => value === "" ? null : value),
|
||||
});
|
||||
|
||||
export type UpdateCurrentUserProfile = z.infer<typeof updateCurrentUserProfileSchema>;
|
||||
|
|
|
|||
|
|
@ -99,7 +99,6 @@ export const workspaceRuntimeServiceSchema = z.object({
|
|||
createdAt: z.coerce.date(),
|
||||
updatedAt: z.coerce.date(),
|
||||
}).strict();
|
||||
|
||||
export const executionWorkspaceCloseReadinessSchema = z.object({
|
||||
workspaceId: z.string().uuid(),
|
||||
state: executionWorkspaceCloseReadinessStateSchema,
|
||||
|
|
|
|||
|
|
@ -253,22 +253,36 @@ export {
|
|||
createCompanyInviteSchema,
|
||||
createOpenClawInvitePromptSchema,
|
||||
acceptInviteSchema,
|
||||
listCompanyInvitesQuerySchema,
|
||||
listJoinRequestsQuerySchema,
|
||||
claimJoinRequestApiKeySchema,
|
||||
boardCliAuthAccessLevelSchema,
|
||||
createCliAuthChallengeSchema,
|
||||
resolveCliAuthChallengeSchema,
|
||||
currentUserProfileSchema,
|
||||
authSessionSchema,
|
||||
updateCurrentUserProfileSchema,
|
||||
updateCompanyMemberSchema,
|
||||
updateCompanyMemberWithPermissionsSchema,
|
||||
updateMemberPermissionsSchema,
|
||||
searchAdminUsersQuerySchema,
|
||||
updateUserCompanyAccessSchema,
|
||||
type CreateCompanyInvite,
|
||||
type CreateOpenClawInvitePrompt,
|
||||
type AcceptInvite,
|
||||
type ListCompanyInvitesQuery,
|
||||
type ListJoinRequestsQuery,
|
||||
type ClaimJoinRequestApiKey,
|
||||
type BoardCliAuthAccessLevel,
|
||||
type CreateCliAuthChallenge,
|
||||
type ResolveCliAuthChallenge,
|
||||
type CurrentUserProfile,
|
||||
type AuthSession,
|
||||
type UpdateCurrentUserProfile,
|
||||
type UpdateCompanyMember,
|
||||
type UpdateCompanyMemberWithPermissions,
|
||||
type UpdateMemberPermissions,
|
||||
type SearchAdminUsersQuery,
|
||||
type UpdateUserCompanyAccess,
|
||||
} from "./access.js";
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue