@k2b/cloud 0.31.0 → 0.33.0

package/src/ai/vision-tool.ts

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
+import { aiMissingChatFileError } from "./file-error";
 import { aiProjectFilePathFromMount } from "./file-mount";
 import { aiFileStore, normalizeAiFilePath } from "./files-store";
 import { PdfPages, renderPdfPages } from "./pdf-render";
@@ -53,7 +54,7 @@ export const createCloudAiViewImageTool = (options: { resolveModel?: () => Promi
     if (snapshotRequired && !snapshot) throw new Error(`Attached image snapshot is unavailable: ${path}`);
     const stored =
       projectFile ?? snapshot ?? (projectPath === null ? await aiFileStore.read({ conversationId: ctx.conversationId, path }) : null);
-    if (!stored) throw new Error(`No such file: ${path}`);
+    if (!stored) throw aiMissingChatFileError(path, ctx.localToolsEnabled);
     const pdf = stored.mediaType === "application/pdf";
     if (!pdf && !isAiImageMediaType(stored.mediaType)) throw new Error(`${path} is not a supported image or PDF (${stored.mediaType}).`);
     if (!pdf && input.pages !== undefined) throw new Error("pages can only be used with a PDF.");

package/src/api/admin-identity.ts

@@ -5,6 +5,7 @@ import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { listApps } from "../_internal/registry";
 import { CapabilityAppIdSchema } from "../contracts/capabilities";
+import { AI_INFERENCE_SCOPE } from "../contracts/shared";
 import { type AuthContext, auth, err, respond, v } from "../server";
 import { audit } from "../services/audit";
 import { getIdentitySigningKeyStatus, identityMetrics, revokeIdentitySigningKey, rewrapIdentitySigningKeys } from "../services/identity";
@@ -63,7 +64,11 @@ const ServiceAccountStatusInputSchema = z.object({ status: z.enum(["active", "di
 const ServiceAccountApiKeyInputSchema = z
   .object({
     name: z.string().trim().min(1).max(120),
-    scopes: z.array(z.string().trim().min(1).max(64)).max(20).default([]),
+    scopes: z
+      .array(z.string().trim().min(1).max(64))
+      .max(20)
+      .default([])
+      .refine((scopes) => !scopes.includes(AI_INFERENCE_SCOPE), "ai:inference is reserved for models-only personal API keys"),
     expiresAt: z.iso.datetime().nullable().optional(),
   })
   .strict();

package/src/api/app-approval-actions.ts

@@ -0,0 +1,36 @@
+import { submitAiTurnAction } from "../ai/runtime";
+import { aiConversations } from "../ai/store";
+import { APP_ACTION_LIMITS } from "../contracts/app-approval";
+import type { AppDeviceActions } from "../services/app-approval";
+import { listPending } from "../services/approvals";
+import { appActionSummary, appActionView } from "../services/approvals/device";
+
+export const createDeviceActions = (appName: (appId: string, locale: string) => string): AppDeviceActions => {
+  const view: AppDeviceActions["view"] = async ({ userId, issuer, actionId }) => {
+    const { items } = await listPending({ approverUserId: userId, id: actionId, limit: 1 });
+    return items[0] ? appActionView(items[0], { issuer, appName }) : null;
+  };
+  return {
+    inbox: async ({ userId, issuer }) => {
+      const { items, count } = await listPending({ approverUserId: userId, limit: APP_ACTION_LIMITS.inboxActions });
+      const views = await Promise.all(items.map((row) => appActionView(row, { issuer, appName })));
+      return { actions: views.map(appActionSummary), moreActions: Math.max(0, count - items.length) };
+    },
+    view,
+    decide: async ({ userId, deviceId, issuer, actionId, digest, approved }) => {
+      const current = await view({ userId, issuer, actionId });
+      if (!current || current.digest !== digest) return false;
+      const pending = await aiConversations.findPendingTurnActionByApproval({ approvalId: actionId, ownerUserId: userId });
+      if (!pending) return false;
+      const result = await submitAiTurnAction({
+        conversationId: pending.conversationId,
+        turnId: pending.turnId,
+        callId: pending.callId,
+        action: { type: "approval_response", approved },
+        decidedBy: { userId, via: "cloud_login", deviceId },
+        signedInSession: false,
+      });
+      return result.ok;
+    },
+  };
+};

package/src/api/app-approval.ts

@@ -16,13 +16,15 @@ import {
 } from "../contracts/app-approval";
 import { type AuthContext, auth, rateLimit, v } from "../server";
 import { type AppApprovalActor, AppApprovalError, appApproval, type createAppApprovalService } from "../services/app-approval";
+import { appNameIn } from "../ssr/runtime";
+import { createDeviceActions } from "./app-approval-actions";
 
 const PairingIdSchema = z.object({ pairingId: z.string().uuid() }).strict();
 const DevicePageSchema = z.object({ after: z.string().uuid().optional() }).strict();
 type Service = ReturnType<typeof createAppApprovalService>;
 
 /** This is a separate credential surface, never a user API-key or OAuth scope. */
-export const createAppApprovalRoutes = (service: Service = appApproval) => {
+export const createAppApprovalRoutes = (service: Service = appApproval, actions = createDeviceActions) => {
   const actor = async (c: Parameters<typeof auth.session.getToken>[0]): Promise<AppApprovalActor> => {
     // The web session (or an explicit bearer session), never the mobile app's session: a phone
     // that pairs sign-in devices would hand out authority that outlives its removal.
@@ -104,7 +106,13 @@ export const createAppApprovalRoutes = (service: Service = appApproval) => {
       "/device",
       describeRoute({ tags: ["App approval"], summary: "Execute a one-use signed device command" }),
       v("json", AppDeviceRequestSchema),
-      async (c) => c.json(await service.deviceCommand(c.req.valid("json"))),
+      async (c) =>
+        c.json(
+          await service.deviceCommand(
+            c.req.valid("json"),
+            actions((appId, locale) => appNameIn(c, appId, locale, appId)),
+          ),
+        ),
     )
     .post(
       "/login/start",

package/src/api/approvals-loader.ts

@@ -0,0 +1,15 @@
+import type { Context } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { resolveAiChatRequestContext } from "../ai/request-context";
+import type { ApprovalListQuery, ApprovalPage } from "../contracts/approvals";
+import type { AuthContext } from "../server/middleware/auth";
+import { listPending, presentPendingApproval } from "../services/approvals/list";
+import { getLocalizedRuntimeContext } from "../ssr/runtime";
+
+export const loadPendingApprovals = async <T extends AuthContext>(c: Context<T>, query: ApprovalListQuery): Promise<ApprovalPage> => {
+  const ctx = await resolveAiChatRequestContext(c);
+  if (ctx instanceof Response) throw new HTTPException(403, { res: ctx });
+  const page = await listPending({ approverUserId: ctx.ownerUserId, appId: query.app, link: query.link, cursor: query.cursor });
+  const apps = getLocalizedRuntimeContext(c).apps;
+  return { ...page, items: page.items.map((row) => presentPendingApproval(row, apps)) };
+};

package/src/api/approvals.ts

@@ -0,0 +1,120 @@
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import { toAiActionFailureResponse } from "../ai/http";
+import { resolveAiChatRequestContext } from "../ai/request-context";
+import { submitAiTurnAction } from "../ai/runtime";
+import { aiConversations } from "../ai/store";
+import {
+  APPROVAL_CLIENT_HEADER,
+  ApprovalCountsSchema,
+  ApprovalDecisionInputSchema,
+  ApprovalDecisionResultSchema,
+  ApprovalListQuerySchema,
+  ApprovalPageSchema,
+} from "../contracts/approvals";
+import { ErrorResponseSchema } from "../contracts/shared";
+import { rateLimit } from "../server";
+import { respond } from "../server/api";
+import { type AuthContext, auth } from "../server/middleware/auth";
+import { jsonResponse, requiresAuth } from "../server/middleware/openapi";
+import { v } from "../server/middleware/validator";
+import { ok } from "../server/services";
+import { approvalDecisionChannel, countPending } from "../services/approvals";
+import { decodeApprovalCursor } from "../services/approvals/cursor";
+import { loadPendingApprovals } from "./approvals-loader";
+
+export const approvalRoutes = new Hono<AuthContext>()
+  .use(rateLimit())
+  .use(auth.requireRole("authenticated"))
+  .get(
+    "/",
+    describeRoute({
+      tags: ["Approvals"],
+      summary: "List pending Action approvals",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(ApprovalPageSchema, "Pending approvals"),
+        400: jsonResponse(ErrorResponseSchema, "Invalid query"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(ErrorResponseSchema, "User-backed actor required"),
+      },
+    }),
+    v(
+      "query",
+      ApprovalListQuerySchema.refine((query) => !query.cursor || decodeApprovalCursor(query.cursor) !== null, "Invalid approval cursor."),
+    ),
+    async (c) => respond(c, ok(await loadPendingApprovals(c, c.req.valid("query")))),
+  )
+  .get(
+    "/counts",
+    describeRoute({
+      tags: ["Approvals"],
+      summary: "Count pending Action approvals",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(ApprovalCountsSchema, "Approval counts"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(ErrorResponseSchema, "User-backed actor required"),
+      },
+    }),
+    async (c) => {
+      const ctx = await resolveAiChatRequestContext(c);
+      if (ctx instanceof Response) return ctx;
+      return respond(c, ok(await countPending({ approverUserId: ctx.ownerUserId })));
+    },
+  )
+  .post(
+    "/:id/decision",
+    bodyLimit({ maxSize: 1024 }),
+    describeRoute({
+      tags: ["Approvals"],
+      summary: "Decide an Action approval and continue its chat",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(ApprovalDecisionResultSchema, "Approval decision"),
+        400: jsonResponse(ErrorResponseSchema, "Invalid decision"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(ErrorResponseSchema, "Decision refused"),
+        404: jsonResponse(ErrorResponseSchema, "Open approval not found"),
+        409: jsonResponse(ErrorResponseSchema, "Already decided differently"),
+        413: jsonResponse(ErrorResponseSchema, "Request body too large"),
+      },
+    }),
+    v("param", z.object({ id: z.uuid() })),
+    v("json", ApprovalDecisionInputSchema),
+    async (c) => {
+      const ctx = await resolveAiChatRequestContext(c);
+      if (ctx instanceof Response) return ctx;
+      const pending = await aiConversations.findPendingTurnActionByApproval({
+        approvalId: c.req.valid("param").id,
+        ownerUserId: ctx.ownerUserId,
+      });
+      if (!pending)
+        return toAiActionFailureResponse(c, {
+          ok: false,
+          status: 404,
+          message: "This request has expired — the assistant already moved on.",
+        });
+      const decision = c.req.valid("json");
+      const result = await submitAiTurnAction({
+        conversationId: pending.conversationId,
+        turnId: pending.turnId,
+        callId: pending.callId,
+        action: { type: "approval_response", ...decision },
+        decidedBy: {
+          userId: ctx.ownerUserId,
+          via: approvalDecisionChannel({
+            credentialKind: c.get("credentialKind"),
+            actor: ctx.actor,
+            client: c.req.header(APPROVAL_CLIENT_HEADER),
+          }),
+        },
+        toolApprovalContext: ctx.toolApprovalContext,
+        signedInSession: ctx.signedInSession,
+      });
+      if (!result.ok) return toAiActionFailureResponse(c, result);
+      return respond(c, ok({ status: decision.approved ? ("approved" as const) : ("rejected" as const) }));
+    },
+  );

package/src/api/index.ts

@@ -33,6 +33,7 @@ import adminOutgoingMailRoutes from "./admin-outgoing-mail";
 import adminRailRoutes from "./admin-rail";
 import { adminAnnouncementRoutes, announcementRoutes } from "./announcements";
 import { createAppApprovalRoutes } from "./app-approval";
+import { approvalRoutes } from "./approvals";
 import { appDiscoveryRoutes } from "./apps";
 import { createAuthRoutes } from "./auth";
 import { createCapabilityRoutes } from "./capabilities";
@@ -44,6 +45,7 @@ import { createSearchRoutes } from "./search";
 import { createSyncOpsProxyRoutes } from "./sync-ops";
 import { createWidgetRoutes } from "./widgets";
 
+export { createAiOpenAiRoutes } from "../ai/openai-api";
 export { type CapabilityDispatchDependencies, dispatchCapability } from "./capabilities";
 export { cliPluginListRoutes } from "./cli-plugins";
 export { createPwaPhoneRoutes } from "./pwa-phone";
@@ -72,6 +74,7 @@ const buildCoreApi = (options: CoreApiOptions) => {
     .route("/me", meRoutes)
     .route("/accounts", accountsEntitiesRoutes)
     .route("/apps", appDiscoveryRoutes)
+    .route("/approvals", approvalRoutes)
     .route("/announcements", announcementRoutes)
     .route("/admin/core/ai-usage", adminAiUsageRoutes)
     .route("/admin/core/ai-quotas", adminAiQuotaRoutes)

package/src/api/me.ts

@@ -4,7 +4,7 @@
  * third-party management lives in the accounts admin app.
  */
 
-import { ok } from "@k2b/stdlib";
+import { err, fail, ok } from "@k2b/stdlib";
 import { type Context, Hono, type MiddlewareHandler } from "hono";
 import { createMiddleware } from "hono/factory";
 import { describeRoute } from "hono-openapi";
@@ -51,6 +51,7 @@ import {
   webauthn,
 } from "../services";
 import { MandatePolicyV1Schema } from "../services/mandates";
+import { coreSettings } from "../services/settings/api";
 
 import { createMeRailRoutes } from "./me-rail";
 import { createMeWebVitalsRoutes } from "./me-web-vitals";
@@ -614,13 +615,14 @@ const app = new Hono<AuthContext>()
     describeRoute({
       tags: ["Me"],
       summary: "Create current user API key",
-      description: "Create a user-bound API key for the authenticated account. The raw token is returned once.",
+      description:
+        "Create a personal API key with full access (default) or models-only access to the OpenAI-compatible API when enabled. The raw token is returned once.",
       ...requiresAuth,
       responses: {
         201: jsonResponse(CreateUserApiKeyResponseSchema, "API key created"),
         400: jsonResponse(ErrorResponseSchema, "Failed to create API key"),
         401: jsonResponse(ErrorResponseSchema, "Authentication required"),
-        403: jsonResponse(ErrorResponseSchema, "Not permitted for API keys or other credentials"),
+        403: jsonResponse(ErrorResponseSchema, "Credential not permitted or models-only API turned off"),
       },
     }),
     v("json", CreateUserApiKeySchema),
@@ -630,7 +632,14 @@ const app = new Hono<AuthContext>()
         async () => {
           const user = c.get("user");
           const data = c.req.valid("json");
+          if (data.access === "models" && !(await coreSettings.get<boolean>("ai.openai_api_enabled")))
+            return fail(
+              err.forbidden(
+                "Models-only API keys are turned off. An administrator can turn on the OpenAI-compatible API in the AI settings.",
+              ),
+            );
           return serviceAccountCredentials.createUserApiToken({
+            access: data.access,
             user,
             name: data.name,
             expiresAt: data.expiresAt ?? null,

package/src/approvals/Approvals.browser-harness.tsx

@@ -0,0 +1,16 @@
+import { LocaleProvider } from "@k2b/ui";
+import { render } from "solid-js/web";
+import Approvals from "./Approvals";
+
+/** Renders the real list for a browser test, which answers the approvals API with invented requests. */
+const host = document.getElementById("root");
+if (!host) throw new Error("Missing harness root");
+const layout = new URLSearchParams(location.search).get("layout") === "band" ? "band" : "list";
+render(
+  () => (
+    <LocaleProvider locale={document.documentElement.lang || "en"}>
+      <Approvals app="assistant" layout={layout} />
+    </LocaleProvider>
+  ),
+  host,
+);