@agent-native/core-corpus 0.210.2 → 0.211.0

package/corpus/templates/analytics/actions/list-sigma-workbooks.ts

@@ -1,5 +1,7 @@
 import { defineAction } from "@agent-native/core/action";
 import { buildDeepLink } from "@agent-native/core/server";
+import { getUserProfiles } from "@agent-native/core/user-profile/server";
+import { isEmailDerivedName } from "@agent-native/core/user-profile/shared";
 import { z } from "zod";
 
 import {
@@ -12,7 +14,23 @@ import {
   requireSigmaMigrationContext,
   sigmaMigrationSetupLink,
 } from "../server/lib/bi-migration/sigma-migration.js";
-import { loadAccessibleDashboardMetadataByIds } from "../server/lib/dashboards-store.js";
+import {
+  loadAccessibleDashboardMetadataByIds,
+  loadOrgDashboardOwnersByIds,
+} from "../server/lib/dashboards-store.js";
+
+// One Sigma page covers most orgs; mapping and dashboard reads take at most
+// 100 ids each, so they run in chunks.
+const WORKBOOK_PAGE_SIZE = 1_000;
+const ID_CHUNK_SIZE = 100;
+
+function chunk<T>(items: readonly T[]): T[][] {
+  const chunks: T[][] = [];
+  for (let i = 0; i < items.length; i += ID_CHUNK_SIZE) {
+    chunks.push(items.slice(i, i + ID_CHUNK_SIZE));
+  }
+  return chunks;
+}
 
 const listSchema = z.object({
   connectionId: z
@@ -33,7 +51,7 @@ const listSchema = z.object({
 
 export default defineAction({
   description:
-    "List Sigma workbooks accessible to the granted Analytics Sigma connection. Returns workbook metadata, preview status, retry eligibility, and a dashboard link only when the current user owns and can access the imported dashboard. Sigma workbook imports remain disabled until the source project mapping can be verified.",
+    "List Sigma workbooks accessible to the granted Analytics Sigma connection. Only workbooks the signed-in Sigma user can access are returned. Each workbook includes its migration status; a migrated workbook includes the Analytics dashboard id, link, and owner email and display name for every org member, plus canOpen and the dashboard title only when the caller can access that dashboard. Migrate an unmigrated workbook; open a migrated one instead of importing it again. Sigma workbook imports remain disabled until the source project mapping can be verified.",
   schema: listSchema,
   http: { method: "GET" },
   readOnly: true,
@@ -60,58 +78,107 @@ export default defineAction({
     const page = await listSigmaWorkbooks({
       connectionId: selection.selected.id,
       page: args.page,
-      limit: 100,
-    });
-    const migrations = await listExternalDashboards({
-      provider: "sigma",
-      sourceIds: page.workbooks.map((workbook) => workbook.workbookId),
-      limit: 100,
+      limit: WORKBOOK_PAGE_SIZE,
     });
+    // Mapping rows are read only for workbooks Sigma returned to this user, so
+    // nobody learns about a migration of a workbook they cannot see in Sigma.
+    const migrations = (
+      await Promise.all(
+        chunk(page.workbooks.map((workbook) => workbook.workbookId)).map(
+          (sourceIds) =>
+            listExternalDashboards({
+              provider: "sigma",
+              sourceIds,
+              limit: ID_CHUNK_SIZE,
+            }),
+        ),
+      )
+    ).flat();
     const migrationBySourceId = new Map(
       migrations.map((migration) => [migration.sourceId, migration]),
     );
     const dashboardIds = migrations.flatMap((migration) =>
-      migration.status === "migrated" &&
-      migration.migratedByCurrentUser &&
-      migration.targetDashboardId
+      migration.status === "migrated" && migration.targetDashboardId
         ? [migration.targetDashboardId]
         : [],
     );
-    const dashboards = await loadAccessibleDashboardMetadataByIds(
-      { email: context.userEmail, orgId: context.orgId },
-      dashboardIds,
-    );
+    const [dashboards, owners] = await Promise.all([
+      Promise.all(
+        chunk(dashboardIds).map((ids) =>
+          loadAccessibleDashboardMetadataByIds(
+            { email: context.userEmail, orgId: context.orgId },
+            ids,
+          ),
+        ),
+      ).then((results) => results.flat()),
+      Promise.all(
+        chunk(dashboardIds).map((ids) =>
+          loadOrgDashboardOwnersByIds(context.orgId, ids),
+        ),
+      ).then((results) => results.flat()),
+    ]);
     const dashboardById = new Map(
       dashboards.map((dashboard) => [dashboard.id, dashboard]),
     );
+    const ownerById = new Map(
+      owners
+        .filter((owner) => owner.kind === "sql")
+        .map((owner) => [owner.id, owner]),
+    );
+
+    const ownerEmailOf = (sourceId: string): string | null => {
+      const migration = migrationBySourceId.get(sourceId);
+      if (migration?.status === "migrated") {
+        const owner = migration.targetDashboardId
+          ? ownerById.get(migration.targetDashboardId)
+          : undefined;
+        return owner?.ownerEmail.toLowerCase() ?? migration.migratedByEmail;
+      }
+      return migration?.status === "migrating"
+        ? migration.migratedByEmail
+        : null;
+    };
+    // Names for the owner avatars, in one batch so the table never looks
+    // people up row by row.
+    const profiles = await getUserProfiles(
+      page.workbooks.flatMap((workbook) => {
+        const email = ownerEmailOf(workbook.workbookId);
+        return email ? [email] : [];
+      }),
+    );
+    const displayNameOf = (email: string): string | null => {
+      const name = profiles.get(email.toLowerCase())?.name?.trim();
+      return name && !isEmailDerivedName(name, email) ? name : null;
+    };
 
     const workbooks = page.workbooks.map((workbook) => {
       const migration = migrationBySourceId.get(workbook.workbookId);
       const status: ExternalDashboardMigrationStatus =
         migration?.status ?? "not_started";
-      const migrationDashboard =
-        migration?.status === "migrated" &&
-        migration.migratedByCurrentUser &&
-        migration.targetDashboardId
-          ? dashboardById.get(migration.targetDashboardId)
+      const targetDashboardId =
+        migration?.status === "migrated"
+          ? (migration.targetDashboardId ?? undefined)
           : undefined;
-      let dashboardId: string | undefined;
-      let dashboardName: string | undefined;
-      if (
-        migration?.status === "migrated" &&
-        migration.migratedByCurrentUser &&
-        migration.targetDashboardId
-      ) {
-        const dashboard = dashboardById.get(migration.targetDashboardId);
-        if (
-          dashboard?.kind === "sql" &&
-          dashboard.ownerEmail.toLowerCase() === context.userEmail &&
-          dashboard.orgId === context.orgId
-        ) {
-          dashboardId = dashboard.id;
-          dashboardName = dashboard.title;
-        }
-      }
+      const owner = targetDashboardId
+        ? ownerById.get(targetDashboardId)
+        : undefined;
+      const accessible = targetDashboardId
+        ? dashboardById.get(targetDashboardId)
+        : undefined;
+      const canOpen = Boolean(
+        owner &&
+        accessible?.kind === "sql" &&
+        accessible.orgId === context.orgId,
+      );
+      const dashboardId = owner ? owner.id : undefined;
+      const migratedOwnerEmail =
+        migration?.status === "migrated"
+          ? ownerEmailOf(workbook.workbookId)
+          : null;
+      const migratingByEmail =
+        migration?.status === "migrating"
+          ? ownerEmailOf(workbook.workbookId)
+          : null;
       return {
         id: workbook.workbookId,
         name: workbook.name,
@@ -124,28 +191,42 @@ export default defineAction({
         ...(dashboardId
           ? {
               dashboardId,
-              dashboardName,
+              ...(canOpen && accessible
+                ? { dashboardName: accessible.title }
+                : {}),
               dashboardUrl: buildDeepLink({
                 app: "analytics",
                 view: "adhoc",
                 params: { dashboardId },
               }),
+              canOpen,
+            }
+          : {}),
+        ...(migratedOwnerEmail
+          ? {
+              migratedOwnerEmail,
+              migratedOwnerName: displayNameOf(migratedOwnerEmail),
             }
           : {}),
         ...(migration?.status === "migrated" &&
         migration.migratedByCurrentUser &&
-        migration.targetDashboardId &&
-        !migrationDashboard
+        targetDashboardId &&
+        !owner
           ? { canRecoverMissingDashboard: true }
           : {}),
+        ...(migratingByEmail
+          ? {
+              migratingByEmail,
+              migratingByName: displayNameOf(migratingByEmail),
+            }
+          : {}),
+        canStartImport: migration?.canStartImport ?? true,
         ...(migration?.status === "migrating" && migration.canRetryStaleClaim
           ? { canRetryStaleClaim: true }
           : {}),
         ...(migration?.flaggedCount
           ? { flaggedCount: migration.flaggedCount }
           : {}),
-        retryableByCurrentUser:
-          status !== "failed" || migration?.migratedByCurrentUser === true,
         ...(migration?.status === "migrated" && !migration.migratedByCurrentUser
           ? { migratedByTeammate: true }
           : {}),

package/corpus/templates/analytics/actions/migrate-sigma-workbook.ts

@@ -14,7 +14,6 @@ import {
   boundExternalDashboardDiagnostics,
   completeExternalDashboard,
   createExternalDashboard,
-  failExternalDashboard,
   listExternalDashboards,
   type ExternalDashboardElementDiagnostic,
 } from "../server/lib/bi-migration/external-dashboards-store.js";
@@ -29,6 +28,7 @@ import {
   requireSigmaMigrationContext,
   sigmaMigrationSetupLink,
 } from "../server/lib/bi-migration/sigma-migration.js";
+import { abandonSigmaImport } from "../server/lib/bi-migration/unfinished-import.js";
 import {
   createDashboardFolder,
   listDashboardFolders,
@@ -431,13 +431,14 @@ export default defineAction({
           sourceIds: [args.workbookId],
           limit: 1,
         });
-        const dashboard =
-          migration?.migratedByCurrentUser && migration.targetDashboardId
-            ? await getDashboard(migration.targetDashboardId, {
-                email: context.email,
-                orgId: context.orgId,
-              })
-            : null;
+        // getDashboard applies the caller's access, so a teammate gets the
+        // link only when they can open the existing dashboard.
+        const dashboard = migration?.targetDashboardId
+          ? await getDashboard(migration.targetDashboardId, {
+              email: context.email,
+              orgId: context.orgId,
+            })
+          : null;
         return {
           status: "already_migrated" as const,
           ...(dashboard?.kind === "sql"
@@ -455,6 +456,11 @@ export default defineAction({
     let failureCode: "dashboard_write_failed" | "verification_failed" =
       "dashboard_write_failed";
     let dashboardWriteSucceeded = false;
+    const id = dashboardIdFor({
+      orgId: context.orgId,
+      userEmail: context.userEmail,
+      workbookId: args.workbookId,
+    });
     try {
       const installedAt = new Date().toISOString();
       const compiled = compileSigmaDashboard({
@@ -462,11 +468,6 @@ export default defineAction({
         review,
         installedAt,
       });
-      const id = dashboardIdFor({
-        orgId: context.orgId,
-        userEmail: context.userEmail,
-        workbookId: args.workbookId,
-      });
       const existing = await getDashboard(id, {
         email: context.email,
         orgId: context.orgId,
@@ -560,12 +561,14 @@ export default defineAction({
         _receipt,
       };
     } catch (error) {
-      await failExternalDashboard({
-        provider: "sigma",
-        sourceId: args.workbookId,
+      await abandonSigmaImport({
+        workbookId: args.workbookId,
         claimToken: claim.claimToken,
         failureCode,
-        preservePreviousMigration: !dashboardWriteSucceeded,
+        dashboardId: id,
+        wroteDashboard: dashboardWriteSucceeded,
+        previousDashboardId: claim.record.targetDashboardId,
+        ctx: { email: context.email, orgId: context.orgId },
       });
       throw error;
     }

package/corpus/templates/analytics/actions/revoke-analytics-public-key.ts

@@ -19,6 +19,10 @@ export default defineAction({
   schema: z.object({
     id: z.string().describe("Public key row id to revoke."),
   }),
+  // It creates, changes, or revokes a credential or who may use one: every
+  // call needs the user's approval, and "always allow" is not offered.
+  needsApproval: true,
+  allowPersistentApproval: false,
   run: async (args) => {
     return revokeAnalyticsPublicKey(resolveScope(), args.id);
   },