@nuxtagentic/integrations 0.0.0-stage → 0.1.0

package/schema.ts

@@ -0,0 +1,179 @@
+import {
+  hasOrgRole,
+  model,
+  t,
+  type AccessResult,
+  type CloudConfigUser,
+  type WhereBuilder,
+} from '@cloudconfig/core'
+import { getIntegrationDefinition } from './runtime/shared/catalog'
+
+/** An approval moves pending → approved | rejected, then approved → completed | failed. */
+const approvalTransitions: Record<string, string[]> = {
+  pending: ['approved', 'rejected'],
+  approved: ['completed', 'failed'],
+}
+
+/**
+ * Your own connections, plus the workspace's shared ones while you are a
+ * member. Membership comes from the session on every request, so leaving an
+ * organization hides its connections at once.
+ */
+function visibleConnections(user: CloudConfigUser | null, where: WhereBuilder): AccessResult {
+  if (!user) {
+    return false
+  }
+  const own = {
+    type: 'group' as const,
+    logic: 'and' as const,
+    children: [where('scope', 'eq', 'user'), where('ownerId', 'eq', user.id)],
+  }
+  const organization = user.organization?.id
+  if (typeof organization !== 'number') {
+    return own
+  }
+  return {
+    type: 'group',
+    logic: 'or',
+    children: [
+      own,
+      {
+        type: 'group',
+        logic: 'and',
+        children: [where('scope', 'eq', 'workspace'), where('organizationId', 'eq', organization)],
+      },
+    ],
+  }
+}
+
+/** Changing a shared connection is for organization owners and admins only. */
+function manageableConnections(user: CloudConfigUser | null, where: WhereBuilder): AccessResult {
+  if (!user) {
+    return false
+  }
+  if (hasOrgRole(user, 'owner', 'admin')) {
+    return visibleConnections(user, where)
+  }
+  return {
+    type: 'group',
+    logic: 'and',
+    children: [where('scope', 'eq', 'user'), where('ownerId', 'eq', user.id)],
+  }
+}
+
+export const integrationsModels = {
+  /**
+   * One catalog integration bound to a CloudConfig Connect connection, with the
+   * actions agents may use through it. Tokens never live here: Connect seals
+   * them and checks who may use them on every call.
+   */
+  integrationConnection: model(
+    {
+      provider: t.text().required().index(),
+      workspace: t.text().required().index(),
+      /** `user` acts as the person who connected; `workspace` is shared with the organization. */
+      scope: t.select(['user', 'workspace']).default('user'),
+      organizationId: t.number().index(),
+      /** The Connect connection. Zero for unconnected example records. */
+      connectionId: t.number().default(0).index(),
+      /** Connect's public uid, for the connection's event endpoint. */
+      connectionUid: t.text().default('').serverOnly(),
+      account: t.text().default(''),
+      label: t.text().default(''),
+      enabled: t.boolean().default(true),
+      /** Allowed action ids, or MCP tool names. */
+      permissions: t.json().default([]),
+      /** MCP tool names that need an owner's approval before they run. */
+      approvals: t.json().default([]),
+      /** Non-secret per-connection values (Google Ads customer, …). */
+      settings: t.json().default({}),
+      ownerId: t.number().required().serverOnly(),
+    },
+    {
+      access: {
+        list: ({ user, where }) => visibleConnections(user, where),
+        read: ({ user, where }) => visibleConnections(user, where),
+        create: ({ user, input }) =>
+          !!user &&
+          input?.ownerId === user.id &&
+          (input.scope !== 'workspace' ||
+            (input.organizationId === user.organization?.id && hasOrgRole(user, 'owner', 'admin'))),
+        update: ({ user, where }) => manageableConnections(user, where),
+        delete: ({ user, where }) => manageableConnections(user, where),
+      },
+      validate: (input, existing) => {
+        const provider = getIntegrationDefinition(String(input.provider))
+        if (!provider || !input.workspace) {
+          return [{ path: 'provider', message: 'Choose an integration and workspace.' }]
+        }
+        if (
+          existing &&
+          (input.provider !== existing.provider ||
+            input.workspace !== existing.workspace ||
+            input.scope !== existing.scope ||
+            input.connectionId !== existing.connectionId)
+        ) {
+          return [
+            {
+              path: 'provider',
+              message: 'Connections cannot be moved to another account or workspace.',
+            },
+          ]
+        }
+        if (input.scope === 'workspace' && typeof input.organizationId !== 'number') {
+          return [{ path: 'scope', message: 'Shared connections belong to an organization.' }]
+        }
+        const permissions = input.permissions
+        if (!Array.isArray(permissions) || permissions.some((id) => typeof id !== 'string')) {
+          return [{ path: 'permissions', message: 'Choose the actions agents may use.' }]
+        }
+        // MCP servers define their own tools; catalog integrations a fixed set.
+        if (
+          !provider.auth.mcp &&
+          permissions.some((id) => !provider.actions.some((action) => action.id === id))
+        ) {
+          return [
+            { path: 'permissions', message: 'Choose permissions supported by this integration.' },
+          ]
+        }
+        return []
+      },
+    },
+  ),
+  integrationApproval: model(
+    {
+      connectionId: t.number().required(),
+      action: t.text().required(),
+      input: t.json().required(),
+      status: t
+        .select(['pending', 'approved', 'rejected', 'completed', 'failed'])
+        .default('pending'),
+      result: t.json(),
+      continuation: t.json().serverOnly(),
+      ownerId: t.number().required().serverOnly(),
+    },
+    {
+      access: {
+        list: ({ user, where }) => (user ? where('ownerId', 'eq', user.id) : false),
+        read: ({ user, where }) => (user ? where('ownerId', 'eq', user.id) : false),
+        create: ({ user, input }) => !!user && input?.ownerId === user.id,
+        update: ({ user, input, where }) =>
+          user && input?.ownerId === user.id ? where('ownerId', 'eq', user.id) : false,
+      },
+      validate: (input, existing) => {
+        if (!existing) {
+          return []
+        }
+        if (JSON.stringify(input.continuation) !== JSON.stringify(existing.continuation)) {
+          return [{ path: 'continuation', message: 'Keep the original run continuation.' }]
+        }
+        const allowed = approvalTransitions[String(existing.status)] ?? []
+        return allowed.includes(String(input.status))
+          ? []
+          : [{ path: 'status', message: 'This approval has already been handled.' }]
+      },
+    },
+  ),
+}
+
+export type IntegrationsConfig = { models: typeof integrationsModels }