@fourier-labs/harbour-contracts 0.73.0 → 0.76.0

package/schema/saas-connection.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/saas-connection.schema.json",
   "title": "SaasConnection",
-  "description": "Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.",
+  "description": "Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. A Basecamp connection (0.76.0, ADR 0022) has no installation either: IT pins the company's Basecamp `account` (chosen from the accounts IT's own Basecamp sign-in belongs to) and maps project aliases to project ids in `channels`; basecamp.project.list runs on the fixed `account` alias. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema", "tenantId", "sourceId", "kind", "provider", "displayName", "status", "version", "channels", "operations", "developmentPreapproval", "createdAt", "updatedAt"],
@@ -16,21 +16,22 @@
     "status": { "$ref": "#/definitions/SaasConnectionStatus" },
     "version": { "type": "integer", "minimum": 1, "description": "Optimistic-concurrency version; every write is conditional on it." },
     "installation": { "$ref": "#/definitions/SaasInstallation" },
+    "account": { "$ref": "#/definitions/BasecampAccount" },
     "channels": {
       "type": "object",
       "maxProperties": 64,
       "propertyNames": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationAlias" },
-      "additionalProperties": { "type": "string", "pattern": "^[A-Z0-9]{5,20}$", "description": "Provider channel ID; only public, non-archived channels are valid." },
-      "description": "Logical channel alias -> provider channel ID, shared by every environment. Always empty for Gmail."
+      "additionalProperties": { "type": "string", "pattern": "^[A-Za-z0-9]{1,32}$", "description": "A Slack channel id (public, non-archived) or a Basecamp project id (digits)." },
+      "description": "Logical alias → provider resource id: a Slack channel id or a Basecamp project id. Always empty for Gmail."
     },
     "operations": {
       "type": "array",
       "minItems": 1,
-      "maxItems": 11,
+      "maxItems": 22,
       "uniqueItems": true,
       "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationOperation" },
       "not": { "contains": { "const": "warehouse.view.read" } },
-      "description": "Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read). Never warehouse.view.read."
+      "description": "Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post, slack.message.update, slack.message.delete, slack.dm.send, slack.user.lookup; Gmail: gmail.thread.list, gmail.thread.read, gmail.message.read, gmail.message.send, gmail.attachment.read; Basecamp (0.76.0): basecamp.project.list, basecamp.todolist.list, basecamp.todo.list, basecamp.todo.create, basecamp.todo.complete, basecamp.message.list, basecamp.message.post, basecamp.comment.list, basecamp.comment.post, basecamp.campfire.post, basecamp.people.list). Never warehouse.view.read."
     },
     "developmentPreapproval": { "$ref": "#/definitions/DevelopmentPreapproval" },
     "oauthClient": { "$ref": "#/definitions/SaasOauthClient" },
@@ -76,8 +77,18 @@
   "definitions": {
     "SaasProvider": {
       "type": "string",
-      "enum": ["slack", "gmail"],
-      "description": "Slack carries an installation and a channel map; Gmail is user-consent only."
+      "enum": ["slack", "gmail", "basecamp"],
+      "description": "Slack carries an installation and a channel map; Gmail is user-consent only; Basecamp is user-consent only with an IT-pinned account and a project map in `channels`."
+    },
+    "BasecampAccount": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "name"],
+      "description": "The pinned Basecamp account (0.76.0, Basecamp only): the one account, among those IT's own Basecamp sign-in belongs to, that every user token on this connection must also belong to and that every project id in `channels` lives in. Absent until IT chooses it; governance refuses every basecamp.* call until then.",
+      "properties": {
+        "id": { "type": "string", "pattern": "^[0-9]{1,20}$", "description": "The Basecamp account id, the first path segment of the API base URL." },
+        "name": { "type": "string", "minLength": 1, "maxLength": 120, "description": "The account's name as Basecamp shows it, for IT to recognise." }
+      }
     },
     "SaasOauthClient": {
       "type": "object",
@@ -237,6 +248,23 @@
       "externalRecipients": { "mode": "allowlist", "allowedDomains": ["partner.example.com"] },
       "createdAt": "2026-09-11T08:00:00Z",
       "updatedAt": "2026-09-11T08:00:00Z"
+    },
+    {
+      "schema": "harbour.saas-connection/1.0",
+      "tenantId": "fourier",
+      "sourceId": "company-basecamp",
+      "kind": "saas",
+      "provider": "basecamp",
+      "displayName": "Company Basecamp",
+      "status": "ACTIVE",
+      "version": 2,
+      "account": { "id": "195539477", "name": "Fourier Labs" },
+      "channels": { "launch": "2085958499" },
+      "operations": ["basecamp.project.list", "basecamp.todolist.list", "basecamp.todo.list", "basecamp.todo.create", "basecamp.todo.complete", "basecamp.message.list", "basecamp.message.post", "basecamp.comment.list", "basecamp.comment.post", "basecamp.campfire.post", "basecamp.people.list"],
+      "developmentPreapproval": { "enabled": true, "hours": 24 },
+      "userModeApproval": "automatic",
+      "createdAt": "2026-10-11T08:00:00Z",
+      "updatedAt": "2026-10-11T08:00:00Z"
     }
   ]
 }