@sentry/junior-google 0.243.0 → 0.245.0

package/README.md

@@ -4,8 +4,8 @@ Proof of concept. Junior acts as its own Google Workspace account, for example
 `junior@sentry.io`. Junior does not use the Google credentials of the people it
 helps. Tracking issue: getsentry/junior#2063.
 
-This version supports Calendar and reading Google Docs. Gmail and Drive
-writes are out of scope.
+This version supports Calendar and reading Google Docs, Sheets, and Slides.
+Gmail and Drive writes are out of scope.
 
 ## Surfaces
 
@@ -42,17 +42,26 @@ writes are out of scope.
   annotation on the Conversation. Junior shows its card with the next reply.
   The card shows the title, time, and attendees, and links to the event. A
   change to an event replaces its card.
-- `searchGoogleDocs` finds Google Docs that are shared with Junior's account,
-  by words in the title or text. Docs that are only shared by public link are
-  not found, because Drive search only covers files the account has.
-- `readGoogleDoc` reads one Doc as Markdown, from a link or a document id. It
-  works for Docs shared with Junior's account and for Docs shared with anyone
-  who has the link. Drive exports the Doc, so the Docs API is not used. A
-  link's `resourcekey` value is sent to Google, because older Docs shared by
-  link need it. Results stop at 100,000 characters.
-- `listGoogleDocComments` reads the comments and replies on one Doc, 100 per
-  call. Each comment gives its author name, text, the Doc text it is attached
-  to, and whether it is resolved.
+- `searchGoogleFiles` finds Google Docs, Sheets, and Slides that are shared
+  with Junior's account, by words in the title or text. A search can ask for only
+  some of these types. Files that are only shared by public link are not found,
+  because Drive search only covers files the account has.
+- The read tools take a link or a file id. They work for files shared with
+  Junior's account and for files shared with anyone who has the link. A link's
+  `resourcekey` value is sent to Google, because older files shared by link
+  need it. Each result stops at 100,000 characters.
+- `readGoogleDoc` reads one Doc as Markdown. Drive exports the Doc, so the
+  Docs API is not used.
+- `readGoogleSheet` reads the cells of one Sheet as CSV, with values formatted
+  as the Sheet shows them. It reads every tab, or one A1 range such as
+  `Budget!A1:F50`. The result names every tab, so Junior can ask for a smaller
+  range when a Sheet is too large. A Drive CSV export has only the first tab,
+  so this tool uses the Sheets API.
+- `readGoogleSlides` reads the text and speaker notes of each slide, with
+  tables as `|` rows. It uses the Slides API to keep slide numbers and notes.
+- `listGoogleFileComments` reads the comments and replies on one Doc, Sheet,
+  or Slides file, 100 per call. Each comment gives its author name, text, the
+  file text it is attached to, and whether it is resolved.
 - The **Google account** page on the dashboard Admin page shows whether the
   account is connected. Its Connect button starts Google sign-in.
 - `junior google connect` and `junior google status` are the operator CLI.
@@ -69,7 +78,7 @@ own.
 2. Google sign-in opens with PKCE and a single-use state value.
 3. The admin signs in as the configured account, not as themselves.
 4. Junior checks that the identity token names the configured account. It also
-   checks that Google granted every Calendar and Docs scope. If a check
+   checks that Google granted every Calendar and Drive scope. If a check
    fails, Junior revokes the grant and stores nothing.
 5. Junior stores the refresh token in the `junior_google_accounts` table.
 
@@ -95,9 +104,11 @@ request and the tool asks an admin to reconnect.
   also keeps events that other people organize out of reach.
 - Calendar scopes are `calendar.events.freebusy`, `calendar.events.readonly`,
   and `calendar.events.owned`.
-- The Docs scope is `drive.readonly`. The Drive comments API accepts no
-  narrower read scope. Junior permits only these Drive requests: file search,
-  file metadata, export, and comment reads.
+- The Drive scope is `drive.readonly`. The Drive comments API accepts no
+  narrower read scope, and the Sheets and Slides APIs also accept it. Junior
+  permits only these requests: Drive file search, file metadata, export, and
+  comment reads; Sheets metadata and cell reads; and Slides reads. Each
+  request must go to the host of its own API.
 - Junior also requests `openid email` to verify the account during sign-in.
 
 ## Setup
@@ -107,9 +118,11 @@ sign-in requests only its own scopes, so dashboard sign-in still asks only for
 identity.
 
 1. In the Google Cloud project of the dashboard OAuth client, enable the
-   Google Calendar API and the Google Drive API.
+   Google Calendar API, Google Drive API, Google Sheets API, and Google Slides
+   API. If an API is not enabled, its tool tells the requester that an admin
+   must enable it.
 2. On the OAuth consent screen, use user type **Internal** and add the
-   Calendar and Docs scopes above. `drive.readonly` is a restricted scope.
+   Calendar and Drive scopes above. `drive.readonly` is a restricted scope.
    An Internal app does not need Google verification for it.
 3. On the OAuth client, add these redirect URIs:
    - `https://<junior host>/api/plugins/google/oauth/callback`
@@ -143,11 +156,13 @@ variables are set. The Admin page shows **Not configured** until then.
 - Anyone who can talk to Junior can ask it to read a colleague's calendar.
   Junior returns what its own account can see, so set the sharing default
   with that in mind.
-- Anyone who can talk to Junior can also ask it to read any Doc shared with
-  Junior's account. Share a Doc with that account only when everyone who can
+- Anyone who can talk to Junior can also ask it to read any file shared with
+  Junior's account. Share a file with that account only when everyone who can
   talk to Junior may read it.
-- `drive.readonly` lets the account read every Drive file it can open, not
-  only Docs. The tools read Google Docs only.
+- `drive.readonly` lets the account read every Drive file it can open. The
+  tools read only Google Docs, Sheets, and Slides.
+- `readGoogleSheet` does not return formulas, notes on cells, or charts.
+  `readGoogleSlides` does not describe images or charts.
 - Google does not expose the working hours that people set in Calendar.
   Junior uses each calendar's time zone and one shared workday instead.
 - Junior cannot find or book meeting rooms. Room discovery needs the Admin

package/dist/config.d.ts

@@ -18,8 +18,9 @@ export declare const GOOGLE_ALLOWED_DOMAINS_ENV = "GOOGLE_WORKSPACE_ALLOWED_DOMA
  *   still decide how much detail each calendar shows.
  * - `calendar.events.owned`: create and change events on Junior's own
  *   calendar.
- * - `drive.readonly`: search, export, and read comments on Docs. The Drive
- *   comments API accepts no narrower read scope.
+ * - `drive.readonly`: search Drive, export Docs, read Sheets and Slides, and
+ *   read comments. The Drive comments API accepts no narrower read scope. The
+ *   Sheets and Slides APIs also accept this scope.
  */
 export declare const GOOGLE_API_SCOPES: readonly ["https://www.googleapis.com/auth/calendar.events.freebusy", "https://www.googleapis.com/auth/calendar.events.owned", "https://www.googleapis.com/auth/calendar.events.readonly", "https://www.googleapis.com/auth/drive.readonly"];
 /** Identity scopes used only to verify which account signed in. */

package/dist/credentials.d.ts

@@ -6,56 +6,87 @@
  * callers get no Google credential at all.
  */
 import { type EgressHookContext, type IssueCredentialHookContext, type PluginCredentialResult, type PluginGrant } from "@sentry/junior-plugin-api";
+/** Calendar and Drive API host. */
 export declare const GOOGLE_API_DOMAIN = "www.googleapis.com";
+/** Every host that receives Junior's Google access token. */
+export declare const GOOGLE_API_DOMAINS: string[];
 /** Google API operations that plugin tools may perform. */
 export declare const GOOGLE_OPERATIONS: {
     readonly "google.calendar.event.create": {
         readonly access: "write";
+        readonly host: "www.googleapis.com";
         readonly method: "POST";
         readonly path: RegExp;
     };
     readonly "google.calendar.event.delete": {
         readonly access: "write";
+        readonly host: "www.googleapis.com";
         readonly method: "DELETE";
         readonly path: RegExp;
     };
     readonly "google.calendar.event.get": {
         readonly access: "read";
+        readonly host: "www.googleapis.com";
         readonly method: "GET";
         readonly path: RegExp;
     };
     readonly "google.calendar.event.update": {
         readonly access: "write";
+        readonly host: "www.googleapis.com";
         readonly method: "PATCH";
         readonly path: RegExp;
     };
     readonly "google.calendar.events.list": {
         readonly access: "read";
+        readonly host: "www.googleapis.com";
         readonly method: "GET";
         readonly path: RegExp;
     };
     readonly "google.calendar.freebusy.query": {
         readonly access: "read";
+        readonly host: "www.googleapis.com";
         readonly method: "POST";
         readonly path: RegExp;
     };
     readonly "google.drive.comments.list": {
         readonly access: "read";
+        readonly host: "www.googleapis.com";
         readonly method: "GET";
         readonly path: RegExp;
     };
     readonly "google.drive.file.export": {
         readonly access: "read";
+        readonly host: "www.googleapis.com";
         readonly method: "GET";
         readonly path: RegExp;
     };
     readonly "google.drive.file.get": {
         readonly access: "read";
+        readonly host: "www.googleapis.com";
         readonly method: "GET";
         readonly path: RegExp;
     };
     readonly "google.drive.files.list": {
         readonly access: "read";
+        readonly host: "www.googleapis.com";
+        readonly method: "GET";
+        readonly path: RegExp;
+    };
+    readonly "google.sheets.spreadsheet.get": {
+        readonly access: "read";
+        readonly host: "sheets.googleapis.com";
+        readonly method: "GET";
+        readonly path: RegExp;
+    };
+    readonly "google.sheets.values.batchGet": {
+        readonly access: "read";
+        readonly host: "sheets.googleapis.com";
+        readonly method: "GET";
+        readonly path: RegExp;
+    };
+    readonly "google.slides.presentation.get": {
+        readonly access: "read";
+        readonly host: "slides.googleapis.com";
         readonly method: "GET";
         readonly path: RegExp;
     };

package/dist/index.d.ts

@@ -2,9 +2,9 @@
  * Google plugin runtime boundary.
  *
  * Junior acts as its own Google Workspace account. A Junior admin connects
- * that account out of band, through the dashboard Admin page or the CLI. Calendar
- * and Docs tools use host-owned egress, and the sandbox gets no Google
- * credential.
+ * that account out of band, through the dashboard Admin page or the CLI.
+ * Calendar, Docs, Sheets, and Slides tools use host-owned egress, and the
+ * sandbox gets no Google credential.
  */
 import { type PluginRegistration } from "@sentry/junior-plugin-api";
 /** Register Junior's Google Workspace plugin. */