@bevel-software/platform-core-backend 0.23.0 → 0.25.0

package/dist/tenancy/tenant-secrets.d.ts

@@ -2,7 +2,7 @@
 export interface TenantSecrets {
     /** Signs the tenant's login sessions and OAuth state. */
     jwtSecret: string;
-    /** 32 bytes, base64: encrypts the tenant's vault values, MCP OAuth tokens and stored git credential. */
+    /** 32 bytes, base64: encrypts the tenant's vault values, MCP OAuth tokens, stored git credential and personal-data columns. */
     secretsEncKey: string;
     /** HMAC key for the tenant's internal (loopback) tool tokens. */
     internalTokenSecret: string;
@@ -19,6 +19,10 @@ export interface TenantSecrets {
  * export, and nothing per tenant has to be kept safe in the meantime. The
  * cloud app's registry calls this with the same inputs and gets the same
  * answer.
+ *
+ * The personal-data columns are sealed under `secretsEncKey` too (each
+ * tenant's database handle is built with it), so the same one key opens the
+ * whole of a tenant's dump.
  */
 export declare function deriveTenantSecrets(masterKey: string, slug: string): TenantSecrets;
 //# sourceMappingURL=tenant-secrets.d.ts.map

package/dist/tenancy/tenant-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-secrets.d.ts","sourceRoot":"","sources":["../../src/tenancy/tenant-secrets.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,wGAAwG;IACxG,aAAa,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAYlF"}
+{"version":3,"file":"tenant-secrets.d.ts","sourceRoot":"","sources":["../../src/tenancy/tenant-secrets.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,+HAA+H;IAC/H,aAAa,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAYlF"}

package/dist/tenancy/tenant-secrets.js

@@ -13,6 +13,10 @@ const MIN_MASTER_KEY_LENGTH = 32;
  * export, and nothing per tenant has to be kept safe in the meantime. The
  * cloud app's registry calls this with the same inputs and gets the same
  * answer.
+ *
+ * The personal-data columns are sealed under `secretsEncKey` too (each
+ * tenant's database handle is built with it), so the same one key opens the
+ * whole of a tenant's dump.
  */
 export function deriveTenantSecrets(masterKey, slug) {
     if (masterKey.length < MIN_MASTER_KEY_LENGTH) {

package/dist/tenancy/tenant-secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-secrets.js","sourceRoot":"","sources":["../../src/tenancy/tenant-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAYvC,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IACjE,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,qBAAqB,4BAA4B,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClG,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACxC,mBAAmB,EAAE,MAAM,CAAC,uBAAuB,CAAC;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tenant-secrets.js","sourceRoot":"","sources":["../../src/tenancy/tenant-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAYvC,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IACjE,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,qBAAqB,4BAA4B,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClG,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACxC,mBAAmB,EAAE,MAAM,CAAC,uBAAuB,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/kb-template/AGENTS.md

@@ -198,6 +198,8 @@ Write access is not evidence that a file belongs somewhere.
   folder you happen to be able to write to; a wrong guess is discovered much
   later than a question.
 
+{{sharedFileRules}}
+
 ## Access control
 
 Access to any path — reading it as much as writing it — is governed by
@@ -571,6 +573,46 @@ For an `mcp.json` server the declaration lives in `plugin.json`, in the same ext
 
 That is the whole declaration: endpoints, PKCE and the resource indicator come from the server. Add `authorizationUrl`/`tokenUrl` only when `list_tool_setup` reports in `setup.reason` that they could not be discovered.
 
+### Calling a Google API as a service account: `auth_type: google_service_account`
+
+Some Google APIs (Google Ads, Tag Manager, BigQuery, Sheets, …) are called as a **service account**: one shared identity, no sign-in per person. Google does not accept the service account's key on a call. It accepts a short-lived token that has to be minted from the key, so a header holding `${VAR}` cannot do it. Name the key in an `auth` block on an inline tool's `tool_call_template` instead, and the platform mints the token at call time, keeps it until shortly before it expires, and sends it as `Authorization: Bearer <token>`:
+
+```yaml
+---
+id: google_ads
+type: inline
+variables:
+  - { name: GOOGLE_SA_KEY,   scope: admin, label: "Service-account key JSON" }
+  - { name: DEVELOPER_TOKEN, scope: admin, label: "Google Ads developer token" }
+tools:
+  - name: list_accessible_customers
+    description: List the Google Ads customers the service account can reach.
+    inputs: { type: object, properties: {} }
+    outputs: { type: object, properties: {} }
+    tool_call_template:
+      call_template_type: http
+      http_method: GET
+      url: https://googleads.googleapis.com/v22/customers:listAccessibleCustomers
+      headers: { developer-token: "${DEVELOPER_TOKEN}" }
+      auth:
+        auth_type: google_service_account
+        credentials: ${GOOGLE_SA_KEY}
+        scopes: https://www.googleapis.com/auth/adwords
+---
+```
+
+| field | requirement | notes |
+|---|---|---|
+| `credentials` | required | always a `${VAR}`: the vault variable holding the key JSON Google issued for the service account (the whole file, or the file in base64). Admin-scoped, so a writer of the `.tool` stores it once on the tool's page. Never the key itself. |
+| `scopes` | required | the OAuth scopes the API needs: one scope, a space-separated list, or a list |
+| `subject` | optional | a user's email to act as, for a service account granted domain-wide delegation |
+
+The token always comes from Google's own token endpoint; a `token_uri` inside the key is ignored. Give the service account access in the Google product itself (for example add its email as a user of the Google Ads account or the Tag Manager container), or that product refuses every call with an error of its own. When Google refuses the key itself (a revoked key, a scope the account may not have, a subject without delegation), the error names the service account and Google's reason, never the key.
+
+The block works in one place: an inline tool's `tool_call_template` with `call_template_type: http`. Anywhere else (an `sse`, `streamable_http` or `mcp` template, or a `type: http` / `type: mcp` tool that discovers its tools from a `url`) no token would be sent, so the `.tool` is refused and `list_tool_setup` names it under `invalid`, saying where the block was found. It works the same for a `remote: false` tool run by the local `hexis-mcp` server, which mints the token on the machine it runs on.
+
+A service account is one shared identity. To have each person call Google as themselves instead, do not use this block: declare a sign-in variable (`oauth`, above) and send it as `Authorization: Bearer ${VAR}`.
+
 ### Examples
 
 An `http` manual that authenticates with a shared org key and a per-user key:

package/migrations/0016_pii_encryption.sql

@@ -0,0 +1,20 @@
+-- PII column encryption: add the blind-index companion columns, NULLABLE and
+-- unconstrained. The columns are populated — and existing plaintext PII rows
+-- rewritten to AES-256-GCM ciphertext — by the programmatic backfill that runs
+-- right after the SQL history on every start, under the same lock
+-- (`runPiiEncryptionBackfill` in migrate.ts). That same step then applies SET
+-- NOT NULL and swaps the unique constraints (`users_email_unique` →
+-- `users_email_bidx_unq`, `pr_file_approvals_unq` → `pr_file_approvals_bidx_unq`,
+-- `plugin_join_requests_requester_plugin_unq` →
+-- `plugin_join_requests_requester_bidx_plugin_unq`), because a unique index on
+-- a blind-index column can only go up once every row has one. The snapshot
+-- beside this file describes the END state, which is what the next migration
+-- is generated against.
+ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "email_bidx" text;--> statement-breakpoint
+ALTER TABLE "pr_file_approvals" ADD COLUMN IF NOT EXISTS "approver_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "pr_merge_log" ADD COLUMN IF NOT EXISTS "triggered_by_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "pr_comments" ADD COLUMN IF NOT EXISTS "author_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "change_requests" ADD COLUMN IF NOT EXISTS "author_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "change_requests" ADD COLUMN IF NOT EXISTS "apply_failed_by_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "pending_commits" ADD COLUMN IF NOT EXISTS "author_email_bidx" text;--> statement-breakpoint
+ALTER TABLE "plugin_join_requests" ADD COLUMN IF NOT EXISTS "requester_email_bidx" text;