@camstack/addon-google-services 0.1.1 → 0.1.2

package/dist/google-services.addon.js

@@ -35164,6 +35164,7 @@ var OsdNamedTemplateSchema = object({
 });
 /** Where a slot's value comes from. */
 var OsdSourceSchema = discriminatedUnion("kind", [
+	object({ kind: literal("none") }),
 	object({
 		kind: literal("static"),
 		text: string().max(64)
@@ -39524,7 +39525,43 @@ var TrainingProviderDescriptorSchema = object({
 	dataResidencyNote: string(),
 	/** Credentials are present — never the values. */
 	configured: boolean(),
-	defaults: TrainingProviderDefaultsSchema
+	defaults: TrainingProviderDefaultsSchema,
+	/**
+	* Non-secret account fields for the Providers form (e.g. Modal token id).
+	* The secret itself never appears — only a keychain {@link SecretFieldView}
+	* (or `hasTokenSecret` for older clients).
+	*/
+	tokenId: string().optional(),
+	environment: string().optional(),
+	hasTokenSecret: boolean().optional(),
+	/**
+	* Keychain view for the entry's token secret — for `SecretFieldControl` on
+	* edit. Create has no view (`null` / omitted); the form uses a plain
+	* `PasswordInput` instead.
+	*/
+	tokenSecretView: object({
+		$secret: string().nullable(),
+		v: literal(1),
+		set: literal(true),
+		inline: literal(true).optional()
+	}).nullable().optional()
+});
+/**
+* Patch one entry's name, credentials and defaults. Pin with owning `{ addonId }`.
+* An omitted or empty `tokenSecret` means KEEP the stored secret (D787).
+* `{ $secretClear: true }` clears it.
+*/
+var TrainingProviderUpdateEntryInputSchema = object({
+	entryId: string().min(1),
+	name: string().min(1),
+	tokenId: string().optional(),
+	tokenSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	environment: string().optional(),
+	gpuType: string().optional(),
+	region: string().optional(),
+	costCapUsd: number().nonnegative().optional(),
+	maxRuntimeSec: number().int().positive().optional(),
+	failedDatasetGraceHours: number().nonnegative().optional()
 });
 var TrainingCredentialCheckSchema = object({
 	ok: boolean(),
@@ -39594,6 +39631,9 @@ method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "
 }), method(object({ entryId: string().min(1) }), object({ ok: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(TrainingProviderUpdateEntryInputSchema, object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ entryId: string().min(1) }), TrainingCredentialCheckSchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -47155,6 +47195,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"trainingProvider.updateEntry": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"trainingProvider.uploadDataset": {
 		capName: "training-provider",
 		capScope: "system",
@@ -52926,6 +52972,16 @@ function needsRefresh(state, nowMs = Date.now()) {
 	return state.accessExpiresAt <= nowMs;
 }
 //#endregion
+//#region src/oauth-redirect-origin.ts
+/**
+* Google OAuth redirect origin — same role as hub OAuth2 / sign-in
+* (`local-network` cap: `roles.publicEndpoint`), never `internal` (LAN / agents).
+* Google rejects non-localhost `http://` redirect URIs for Web clients.
+*/
+function pickOauthRedirectOrigin(book) {
+	return book.roles.publicEndpoint.resolved ?? book.roles.internal.resolved ?? null;
+}
+//#endregion
 //#region src/google-services.addon.ts
 /**
 * Google Services — hub-only calendar-source over Google Calendar API (OAuth2).
@@ -53066,16 +53122,15 @@ var GoogleServicesAddon = class extends BaseAddon {
 		return new Set(raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0));
 	}
 	async resolveRedirectUri() {
-		const book = await this.ctx.api.localNetwork.getAddresses.query({});
-		const origin = book.roles.internal.resolved ?? book.roles.publicEndpoint.resolved ?? null;
-		if (!origin) throw new Error("No hub address available from local-network — set an Internal address on the Network page.");
+		const origin = pickOauthRedirectOrigin(await this.ctx.api.localNetwork.getAddresses.query({}));
+		if (!origin) throw new Error("No hub public address available from local-network — set a Public endpoint on the Network page (OAuth2 redirects use that role, not Internal).");
 		return `${origin.replace(/\/$/, "")}/addon/${ADDON_ID}${CALLBACK_PATH}`;
 	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
 			id: "google-oauth",
 			title: "Google Calendar OAuth",
-			description: "Create an OAuth client (Web application) in Google Cloud Console with the Calendar API enabled. Register the redirect URI `<hub>/addon/google-services/oauth/callback` (hub = Internal address from Network).",
+			description: "Create an OAuth client (Web application) in Google Cloud Console with the Calendar API enabled. Register the redirect URI `<public-hub>/addon/google-services/oauth/callback` — hub = Public endpoint from Network (same role as sign-in / OAuth2; Google rejects plain LAN http).",
 			columns: 1,
 			fields: [
 				{
@@ -53100,7 +53155,7 @@ var GoogleServicesAddon = class extends BaseAddon {
 					key: "_connectInfo",
 					label: "Connect",
 					format: "html",
-					content: `After saving client id/secret, open <a href="/addon/${ADDON_ID}${START_PATH}">Connect Google Calendar</a> while signed in as admin.`
+					content: `After saving client id/secret, open <a href="/addon/${ADDON_ID}${START_PATH}">Connect Google Calendar</a> while signed in as admin. Redirect URI uses the Network <b>Public endpoint</b> (today typically <code>https://…/addon/google-services/oauth/callback</code>).`
 				}
 			]
 		}] });

package/dist/google-services.addon.mjs

@@ -35160,6 +35160,7 @@ var OsdNamedTemplateSchema = object({
 });
 /** Where a slot's value comes from. */
 var OsdSourceSchema = discriminatedUnion("kind", [
+	object({ kind: literal("none") }),
 	object({
 		kind: literal("static"),
 		text: string().max(64)
@@ -39520,7 +39521,43 @@ var TrainingProviderDescriptorSchema = object({
 	dataResidencyNote: string(),
 	/** Credentials are present — never the values. */
 	configured: boolean(),
-	defaults: TrainingProviderDefaultsSchema
+	defaults: TrainingProviderDefaultsSchema,
+	/**
+	* Non-secret account fields for the Providers form (e.g. Modal token id).
+	* The secret itself never appears — only a keychain {@link SecretFieldView}
+	* (or `hasTokenSecret` for older clients).
+	*/
+	tokenId: string().optional(),
+	environment: string().optional(),
+	hasTokenSecret: boolean().optional(),
+	/**
+	* Keychain view for the entry's token secret — for `SecretFieldControl` on
+	* edit. Create has no view (`null` / omitted); the form uses a plain
+	* `PasswordInput` instead.
+	*/
+	tokenSecretView: object({
+		$secret: string().nullable(),
+		v: literal(1),
+		set: literal(true),
+		inline: literal(true).optional()
+	}).nullable().optional()
+});
+/**
+* Patch one entry's name, credentials and defaults. Pin with owning `{ addonId }`.
+* An omitted or empty `tokenSecret` means KEEP the stored secret (D787).
+* `{ $secretClear: true }` clears it.
+*/
+var TrainingProviderUpdateEntryInputSchema = object({
+	entryId: string().min(1),
+	name: string().min(1),
+	tokenId: string().optional(),
+	tokenSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	environment: string().optional(),
+	gpuType: string().optional(),
+	region: string().optional(),
+	costCapUsd: number().nonnegative().optional(),
+	maxRuntimeSec: number().int().positive().optional(),
+	failedDatasetGraceHours: number().nonnegative().optional()
 });
 var TrainingCredentialCheckSchema = object({
 	ok: boolean(),
@@ -39590,6 +39627,9 @@ method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "
 }), method(object({ entryId: string().min(1) }), object({ ok: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(TrainingProviderUpdateEntryInputSchema, object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ entryId: string().min(1) }), TrainingCredentialCheckSchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -47151,6 +47191,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"trainingProvider.updateEntry": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"trainingProvider.uploadDataset": {
 		capName: "training-provider",
 		capScope: "system",
@@ -52922,6 +52968,16 @@ function needsRefresh(state, nowMs = Date.now()) {
 	return state.accessExpiresAt <= nowMs;
 }
 //#endregion
+//#region src/oauth-redirect-origin.ts
+/**
+* Google OAuth redirect origin — same role as hub OAuth2 / sign-in
+* (`local-network` cap: `roles.publicEndpoint`), never `internal` (LAN / agents).
+* Google rejects non-localhost `http://` redirect URIs for Web clients.
+*/
+function pickOauthRedirectOrigin(book) {
+	return book.roles.publicEndpoint.resolved ?? book.roles.internal.resolved ?? null;
+}
+//#endregion
 //#region src/google-services.addon.ts
 /**
 * Google Services — hub-only calendar-source over Google Calendar API (OAuth2).
@@ -53062,16 +53118,15 @@ var GoogleServicesAddon = class extends BaseAddon {
 		return new Set(raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0));
 	}
 	async resolveRedirectUri() {
-		const book = await this.ctx.api.localNetwork.getAddresses.query({});
-		const origin = book.roles.internal.resolved ?? book.roles.publicEndpoint.resolved ?? null;
-		if (!origin) throw new Error("No hub address available from local-network — set an Internal address on the Network page.");
+		const origin = pickOauthRedirectOrigin(await this.ctx.api.localNetwork.getAddresses.query({}));
+		if (!origin) throw new Error("No hub public address available from local-network — set a Public endpoint on the Network page (OAuth2 redirects use that role, not Internal).");
 		return `${origin.replace(/\/$/, "")}/addon/${ADDON_ID}${CALLBACK_PATH}`;
 	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
 			id: "google-oauth",
 			title: "Google Calendar OAuth",
-			description: "Create an OAuth client (Web application) in Google Cloud Console with the Calendar API enabled. Register the redirect URI `<hub>/addon/google-services/oauth/callback` (hub = Internal address from Network).",
+			description: "Create an OAuth client (Web application) in Google Cloud Console with the Calendar API enabled. Register the redirect URI `<public-hub>/addon/google-services/oauth/callback` — hub = Public endpoint from Network (same role as sign-in / OAuth2; Google rejects plain LAN http).",
 			columns: 1,
 			fields: [
 				{
@@ -53096,7 +53151,7 @@ var GoogleServicesAddon = class extends BaseAddon {
 					key: "_connectInfo",
 					label: "Connect",
 					format: "html",
-					content: `After saving client id/secret, open <a href="/addon/${ADDON_ID}${START_PATH}">Connect Google Calendar</a> while signed in as admin.`
+					content: `After saving client id/secret, open <a href="/addon/${ADDON_ID}${START_PATH}">Connect Google Calendar</a> while signed in as admin. Redirect URI uses the Network <b>Public endpoint</b> (today typically <code>https://…/addon/google-services/oauth/callback</code>).`
 				}
 			]
 		}] });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-google-services",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Google Services — Google Calendar as a CamStack calendar-source via OAuth2.",
   "keywords": [
     "camstack",