mirror of
https://github.com/alkimake/paperclip.git
synced 2026-06-15 18:30:39 +09:00
7a329fb8bb
## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies. > - The REST API is the control-plane boundary for companies, agents, plugins, adapters, costs, invites, and issue mutations. > - Several routes still relied on broad board or company access checks without consistently enforcing the narrower actor, company, and active-checkout boundaries those operations require. > - That can allow agents or non-admin users to mutate sensitive resources outside the intended governance path. > - This pull request hardens the route authorization layer and adds regression coverage for the audited API surfaces. > - The benefit is tighter multi-company isolation, safer plugin and adapter administration, and stronger enforcement of active issue ownership. ## What Changed - Added route-level authorization checks for budgets, plugin administration/scoped routes, adapter management, company import/export, direct agent creation, invite test resolution, and issue mutation/write surfaces. - Enforced active checkout ownership for agent-authenticated issue mutations, while preserving explicit management overrides for permitted managers. - Restricted sensitive adapter and plugin management operations to instance-admin or properly scoped actors. - Tightened company portability and invite probing routes so agents cannot cross company boundaries. - Updated access constants and the Company Access UI copy for the new active-checkout management grant. - Added focused regression tests covering cross-company denial, agent self-mutation denial, admin-only operations, and active checkout ownership. - Rebased the branch onto `public-gh/master` and fixed validation fallout from the rebase: heartbeat-context route ordering and a company import/export e2e fixture that now opts out of direct-hire approval before using direct agent creation. - Updated onboarding and signoff e2e setup to create seed agents through `/agent-hires` plus board approval, so they remain compatible with the approval-gated new-agent default. - Addressed Greptile feedback by removing a duplicate company export API alias, avoiding N+1 reporting-chain lookups in active-checkout override checks, allowing agent mutations on unassigned `in_progress` issues, and blocking NAT64 invite-probe targets. ## Verification - `pnpm exec vitest run server/src/__tests__/issues-goal-context-routes.test.ts cli/src/__tests__/company-import-export-e2e.test.ts` - `pnpm exec vitest run server/src/__tests__/plugin-routes-authz.test.ts server/src/__tests__/adapter-routes-authz.test.ts server/src/__tests__/agent-permissions-routes.test.ts server/src/__tests__/company-portability-routes.test.ts server/src/__tests__/costs-service.test.ts server/src/__tests__/invite-test-resolution-route.test.ts server/src/__tests__/issue-agent-mutation-ownership-routes.test.ts server/src/__tests__/agent-adapter-validation-routes.test.ts` - `pnpm exec vitest run server/src/__tests__/issue-agent-mutation-ownership-routes.test.ts` - `pnpm exec vitest run server/src/__tests__/invite-test-resolution-route.test.ts` - `pnpm -r typecheck` - `pnpm --filter server typecheck` - `pnpm --filter ui typecheck` - `pnpm build` - `pnpm test:e2e -- tests/e2e/onboarding.spec.ts tests/e2e/signoff-policy.spec.ts` - `pnpm test:e2e -- tests/e2e/signoff-policy.spec.ts` - `pnpm test:run` was also run. It failed under default full-suite parallelism with two order-dependent failures in `plugin-routes-authz.test.ts` and `routines-e2e.test.ts`; both files passed when rerun directly together with `pnpm exec vitest run server/src/__tests__/plugin-routes-authz.test.ts server/src/__tests__/routines-e2e.test.ts`. ## Risks - Medium risk: this changes authorization behavior across multiple sensitive API surfaces, so callers that depended on broad board/company access may now receive `403` or `409` until they use the correct governance path. - Direct agent creation now respects the company-level board-approval requirement; integrations that need pending hires should use `/api/companies/:companyId/agent-hires`. - Active in-progress issue mutations now require checkout ownership or an explicit management override, which may reveal workflow assumptions in older automation. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used OpenAI Codex, GPT-5 coding agent, tool-using workflow with local shell, Git, GitHub CLI, and repository tests. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [ ] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
60 lines
2.1 KiB
TypeScript
60 lines
2.1 KiB
TypeScript
import type {
|
|
Company,
|
|
CompanyPortabilityExportRequest,
|
|
CompanyPortabilityExportPreviewResult,
|
|
CompanyPortabilityExportResult,
|
|
CompanyPortabilityImportRequest,
|
|
CompanyPortabilityImportResult,
|
|
CompanyPortabilityPreviewRequest,
|
|
CompanyPortabilityPreviewResult,
|
|
UpdateCompanyBranding,
|
|
} from "@paperclipai/shared";
|
|
import { api } from "./client";
|
|
|
|
export type CompanyStats = Record<string, { agentCount: number; issueCount: number }>;
|
|
|
|
export const companiesApi = {
|
|
list: () => api.get<Company[]>("/companies"),
|
|
get: (companyId: string) => api.get<Company>(`/companies/${companyId}`),
|
|
stats: () => api.get<CompanyStats>("/companies/stats"),
|
|
create: (data: {
|
|
name: string;
|
|
description?: string | null;
|
|
budgetMonthlyCents?: number;
|
|
}) =>
|
|
api.post<Company>("/companies", data),
|
|
update: (
|
|
companyId: string,
|
|
data: Partial<
|
|
Pick<
|
|
Company,
|
|
| "name"
|
|
| "description"
|
|
| "status"
|
|
| "budgetMonthlyCents"
|
|
| "requireBoardApprovalForNewAgents"
|
|
| "feedbackDataSharingEnabled"
|
|
| "brandColor"
|
|
| "logoAssetId"
|
|
>
|
|
>,
|
|
) => api.patch<Company>(`/companies/${companyId}`, data),
|
|
updateBranding: (companyId: string, data: UpdateCompanyBranding) =>
|
|
api.patch<Company>(`/companies/${companyId}/branding`, data),
|
|
archive: (companyId: string) => api.post<Company>(`/companies/${companyId}/archive`, {}),
|
|
remove: (companyId: string) => api.delete<{ ok: true }>(`/companies/${companyId}`),
|
|
exportBundle: (
|
|
companyId: string,
|
|
data: CompanyPortabilityExportRequest,
|
|
) =>
|
|
api.post<CompanyPortabilityExportResult>(`/companies/${companyId}/exports`, data),
|
|
exportPreview: (
|
|
companyId: string,
|
|
data: CompanyPortabilityExportRequest,
|
|
) =>
|
|
api.post<CompanyPortabilityExportPreviewResult>(`/companies/${companyId}/exports/preview`, data),
|
|
importPreview: (data: CompanyPortabilityPreviewRequest) =>
|
|
api.post<CompanyPortabilityPreviewResult>("/companies/import/preview", data),
|
|
importBundle: (data: CompanyPortabilityImportRequest) =>
|
|
api.post<CompanyPortabilityImportResult>("/companies/import", data),
|
|
};
|