@carlonicora/nextjs-jsonapi 3.22.0 → 3.24.0

package/src/features/oauth/hooks/useOAuthConsent.ts

@@ -3,6 +3,7 @@
 import { useCallback, useEffect, useState } from "react";
 import { OAuthConsentInfo, OAuthConsentRequest } from "../interfaces/oauth.interface";
 import { OAuthService } from "../data/oauth.service";
+import { useCurrentUserContextOptional } from "../../user/contexts/CurrentUserContext";
 
 export interface UseOAuthConsentReturn {
   /** Client and scope info for consent display */
@@ -17,6 +18,10 @@ export interface UseOAuthConsentReturn {
   deny: () => Promise<void>;
   /** Whether approve/deny is in progress */
   isSubmitting: boolean;
+  /** The studio (company) the authorization is granted for */
+  companyId: string | undefined;
+  /** Select the studio (company) the authorization is granted for */
+  setCompanyId: (id: string) => void;
 }
 
 /**
@@ -37,11 +42,35 @@ export interface UseOAuthConsentReturn {
  * // On button click: approve() or deny()
  * ```
  */
-export function useOAuthConsent(params: OAuthConsentRequest): UseOAuthConsentReturn {
+export function useOAuthConsent(
+  params: OAuthConsentRequest,
+  options?: {
+    /**
+     * The studio open in the host app's session. Apps that keep the signed-in
+     * user in their own context (not the package UserProvider) pass it here;
+     * it wins over the package context.
+     */
+    defaultCompanyId?: string;
+  },
+): UseOAuthConsentReturn {
   const [clientInfo, setClientInfo] = useState<OAuthConsentInfo | null>(null);
   const [isLoading, setIsLoading] = useState(true);
   const [error, setError] = useState<Error | null>(null);
   const [isSubmitting, setIsSubmitting] = useState(false);
+  const [companyId, setCompanyId] = useState<string | undefined>(undefined);
+  const contextCompanyId = useCurrentUserContextOptional()?.company?.id;
+  const currentCompanyId = options?.defaultCompanyId ?? contextCompanyId;
+
+  // Seed the studio choice once the user's companies arrive: the studio open in
+  // the web session when it is in the list, otherwise the first one.
+  useEffect(() => {
+    const companies = clientInfo?.companies ?? [];
+    if (companies.length === 0) return;
+    if (companyId && companies.some((company) => company.id === companyId)) return;
+
+    const current = currentCompanyId ? companies.find((company) => company.id === currentCompanyId) : undefined;
+    setCompanyId(current?.id ?? companies[0]?.id);
+  }, [clientInfo, currentCompanyId, companyId]);
 
   // Fetch client info on mount
   useEffect(() => {
@@ -83,7 +112,7 @@ export function useOAuthConsent(params: OAuthConsentRequest): UseOAuthConsentRet
     setError(null);
 
     try {
-      const result = await OAuthService.approveAuthorization(params);
+      const result = await OAuthService.approveAuthorization({ ...params, companyId });
 
       // Redirect to client with authorization code
       if (result.redirectUrl) {
@@ -95,7 +124,7 @@ export function useOAuthConsent(params: OAuthConsentRequest): UseOAuthConsentRet
       setIsSubmitting(false);
     }
     // Note: Don't set isSubmitting to false on success - we're redirecting
-  }, [params]);
+  }, [params, companyId]);
 
   const deny = useCallback(async (): Promise<void> => {
     setIsSubmitting(true);
@@ -123,5 +152,7 @@ export function useOAuthConsent(params: OAuthConsentRequest): UseOAuthConsentRet
     approve,
     deny,
     isSubmitting,
+    companyId,
+    setCompanyId,
   };
 }

package/src/features/oauth/interfaces/oauth.interface.ts

@@ -89,13 +89,15 @@ export interface OAuthConsentRequest {
   codeChallenge?: string;
   /** PKCE method: 'S256' (recommended) or 'plain' */
   codeChallengeMethod?: string;
+  /** The studio (company) the issued tokens are bound to; sent as `company_id` on approve */
+  companyId?: string;
 }
 
 /**
  * Scope information for display in consent screen
  */
 export interface OAuthScopeInfo {
-  /** The scope identifier (e.g., 'photographs:read') */
+  /** The scope identifier (e.g., 'read', 'mcp') */
   scope: string;
   /** Human-readable scope name */
   name: string;
@@ -111,6 +113,8 @@ export interface OAuthScopeInfo {
 export interface OAuthConsentInfo {
   client: OAuthClientInterface;
   scopes: OAuthScopeInfo[];
+  /** The caller's companies, ordered by name; the user picks one when there is more than one */
+  companies?: Array<{ id: string; name: string }>;
 }
 
 /**
@@ -130,36 +134,18 @@ export const OAUTH_SCOPE_DISPLAY: Record<string, OAuthScopeInfo> = {
     description: "Write access to your data",
     icon: "pencil",
   },
-  "photographs:read": {
-    scope: "photographs:read",
-    name: "View Photographs",
-    description: "Access and download your photo library",
-    icon: "image",
-  },
-  "photographs:write": {
-    scope: "photographs:write",
-    name: "Upload Photographs",
-    description: "Add new photos to your rolls",
-    icon: "upload",
-  },
-  "rolls:read": {
-    scope: "rolls:read",
-    name: "View Rolls",
-    description: "See your film rolls and collections",
-    icon: "film",
-  },
-  "rolls:write": {
-    scope: "rolls:write",
-    name: "Manage Rolls",
-    description: "Create and modify film rolls",
-    icon: "folder-plus",
-  },
   profile: {
     scope: "profile",
     name: "View Profile",
     description: "Access your name and email",
     icon: "user",
   },
+  mcp: {
+    scope: "mcp",
+    name: "MCP Server Access",
+    description: "Let an AI assistant read and act on your data through the MCP server",
+    icon: "shield",
+  },
   admin: {
     scope: "admin",
     name: "Administrative Access",

package/src/hooks/__tests__/useDataListRetriever.test.ts

@@ -243,7 +243,7 @@ describe("useDataListRetriever", () => {
       const retriever = vi.fn().mockResolvedValue(mockData);
 
       const { result } = renderHook(() =>
-        useDataListRetriever({
+        useDataListRetriever<(typeof mockData)[number]>({
           retriever,
           module: mockModule,
         }),

package/dist/AssistantInterface-RvZzlcA_.d.ts

@@ -1,36 +0,0 @@
-import { A as ApiDataInterface } from './ApiDataInterface-BcZeXy5X.js';
-
-type AssistantInput = {
-    firstMessage: string;
-    title?: string;
-    howToMode?: boolean;
-    limitToHowToId?: string;
-    handbookMode?: boolean;
-    limitToHandbookPageId?: string;
-    /**
-     * BlockNote document behind `firstMessage`. Sent alongside the flattened
-     * text so the server can re-derive the content and read `@`-mentions from
-     * the inline nodes; the flattened text is never trusted on its own.
-     */
-    contentBlocks?: unknown[];
-    /**
-     * Resource the thread is bound to (e.g. a campaign). Confines every agent
-     * data-access point in the run to that resource's scope.
-     */
-    boundContent?: {
-        type: string;
-        id: string;
-    };
-};
-interface AssistantInterface extends ApiDataInterface {
-    get title(): string;
-    get messageCount(): number;
-    /** Agent engine the thread runs on — `"operator"` or undefined (responder). */
-    get engine(): string | undefined;
-    /** JSON:API type of the resource this thread is bound to, when bound. */
-    get boundContentType(): string | undefined;
-    /** Id of the resource this thread is bound to, when bound. */
-    get boundContentId(): string | undefined;
-}
-
-export type { AssistantInput as A, AssistantInterface as a };

package/dist/AssistantInterface-jL56dyNc.d.mts

@@ -1,36 +0,0 @@
-import { A as ApiDataInterface } from './ApiDataInterface-BcZeXy5X.mjs';
-
-type AssistantInput = {
-    firstMessage: string;
-    title?: string;
-    howToMode?: boolean;
-    limitToHowToId?: string;
-    handbookMode?: boolean;
-    limitToHandbookPageId?: string;
-    /**
-     * BlockNote document behind `firstMessage`. Sent alongside the flattened
-     * text so the server can re-derive the content and read `@`-mentions from
-     * the inline nodes; the flattened text is never trusted on its own.
-     */
-    contentBlocks?: unknown[];
-    /**
-     * Resource the thread is bound to (e.g. a campaign). Confines every agent
-     * data-access point in the run to that resource's scope.
-     */
-    boundContent?: {
-        type: string;
-        id: string;
-    };
-};
-interface AssistantInterface extends ApiDataInterface {
-    get title(): string;
-    get messageCount(): number;
-    /** Agent engine the thread runs on — `"operator"` or undefined (responder). */
-    get engine(): string | undefined;
-    /** JSON:API type of the resource this thread is bound to, when bound. */
-    get boundContentType(): string | undefined;
-    /** Id of the resource this thread is bound to, when bound. */
-    get boundContentId(): string | undefined;
-}
-
-export type { AssistantInput as A, AssistantInterface as a };