@startsimpli/integrations 0.2.20 → 0.2.22

package/src/components/pages/ConnectionsPage.tsx

@@ -44,20 +44,131 @@ import {
 import type {
   Connection,
   ConnectionChoice,
+  ConnectionChoicePage,
+  ConnectionInvokeResult,
   ConnectionPermissions,
   ConnectionTarget,
   ConnectorAction,
   ConnectorCatalogEntry,
   ConnectorFieldSpec,
   ConnectionsApi,
+  MemberConnectionRow,
+  MemberConnectionsApi,
 } from './types';
+import { MemberConnectionRoster } from './MemberConnectionRoster';
 
-export interface ConnectionsPageProps {
-  api: ConnectionsApi;
-  foundrySlug: string;
-  classNames?: Partial<Record<
-    'root' | 'section' | 'heading' | 'card' | 'button' | 'muted' | 'error', string
-  >>;
+type ClassNames = Partial<Record<
+  'root' | 'section' | 'heading' | 'card' | 'button' | 'muted' | 'error', string
+>>;
+
+/**
+ * TWO SURFACES, ONE COMPOSER (bd startsim-768w.22.25.6).
+ *
+ * A discriminated union rather than an optional slug, because the two modes do
+ * not merely differ in their arguments — `personal` has no slug ANYWHERE, which
+ * is the member surface's whole security property (see `MemberConnectionsApi`).
+ * Making `foundrySlug` optional would let a personal mount pass one and read as
+ * though it meant something.
+ */
+export type ConnectionsPageProps =
+  | {
+    mode?: 'foundry';
+    api: ConnectionsApi;
+    foundrySlug: string;
+    classNames?: ClassNames;
+  }
+  | {
+    mode: 'personal';
+    api: MemberConnectionsApi;
+    /** There is no slug on this surface. The token's audience names the foundry. */
+    foundrySlug?: never;
+    classNames?: ClassNames;
+  };
+
+/**
+ * The api as the components below use it: SLUGLESS, because the slug is a
+ * property of the mount and not of any control on the page.
+ *
+ * The foundry-level verbs are optional, and that is what gates the UI. A control
+ * renders when the verb behind it exists, so personal mode cannot render a
+ * button whose handler would be `undefined` — the type checker, not a
+ * `mode === 'personal'` sprinkled through nine call sites, is what keeps the
+ * two surfaces honest.
+ */
+interface BoundApi {
+  connectorCatalog(): Promise<{ results: ConnectorCatalogEntry[] }>;
+  connections(): Promise<{ results: Connection[]; permissions: ConnectionPermissions }>;
+  connect(input: {
+    connector_key: string;
+    name?: string;
+    credentials?: Record<string, unknown>;
+    config?: Record<string, unknown>;
+    capabilities_enabled?: string[];
+  }): Promise<Connection>;
+  checkConnection(id: string): Promise<{ ok: boolean; account_label: string; detail: string }>;
+  rotateCredential(id: string, credentials: Record<string, unknown>): Promise<Connection>;
+  disconnect(id: string): Promise<void>;
+  updateConnection?(id: string, input: {
+    name?: string; capabilities_enabled?: string[]; config?: Record<string, unknown>;
+  }): Promise<Connection>;
+  connectionChoices?(id: string, params?: { kind?: string; cursor?: string }):
+    Promise<ConnectionChoicePage>;
+  wireTarget?(id: string, input: {
+    choice_id: string; name?: string; options?: Record<string, unknown>;
+  }): Promise<ConnectionTarget>;
+  confirmTarget?(id: string, destinationId: string): Promise<ConnectionTarget>;
+  connectionActions?(id: string): Promise<{ results: ConnectorAction[] }>;
+  invokeConnectionAction?(id: string, action: string, input: {
+    destination_id: string; record_type?: string; records?: unknown[];
+  }): Promise<ConnectionInvokeResult>;
+  /** Per-member governance (bd startsim-768w.22.25.8). Foundry mode only, and
+      absent on an api that predates the endpoints — see `ConnectionsApi`. */
+  setMemberConnectorPolicy?(connectorKey: string, allowed: boolean): Promise<unknown>;
+  memberConnections?(): Promise<{
+    results: MemberConnectionRow[]; permissions: ConnectionPermissions;
+  }>;
+  disconnectMemberConnection?(id: string): Promise<void>;
+}
+
+function bindApi(props: ConnectionsPageProps): BoundApi {
+  if (props.mode === 'personal') {
+    // Already slugless. Passed through rather than wrapped, so nothing here can
+    // grow a slug argument by accident.
+    return props.api;
+  }
+  const { api, foundrySlug: slug } = props;
+  // Bound only when the injected client HAS them, so `verb in api` stays the
+  // test the components run — a wrapper that always exists and throws inside
+  // would render the control and fail on click.
+  const memberPolicy = api.setMemberConnectorPolicy
+    ? { setMemberConnectorPolicy: (key: string, allowed: boolean) =>
+      api.setMemberConnectorPolicy!(slug, key, allowed) }
+    : {};
+  const roster = api.memberConnections
+    ? { memberConnections: () => api.memberConnections!(slug) }
+    : {};
+  const cutMember = api.disconnectMemberConnection
+    ? { disconnectMemberConnection: (id: string) =>
+      api.disconnectMemberConnection!(slug, id) }
+    : {};
+  return {
+    ...memberPolicy,
+    ...roster,
+    ...cutMember,
+    connectorCatalog: () => api.connectorCatalog(slug),
+    connections: () => api.connections(slug),
+    connect: (input) => api.connect(slug, input),
+    checkConnection: (id) => api.checkConnection(slug, id),
+    rotateCredential: (id, credentials) => api.rotateCredential(slug, id, credentials),
+    disconnect: (id) => api.disconnect(slug, id),
+    updateConnection: (id, input) => api.updateConnection(slug, id, input),
+    connectionChoices: (id, params) => api.connectionChoices(slug, id, params),
+    wireTarget: (id, input) => api.wireTarget(slug, id, input),
+    confirmTarget: (id, destinationId) => api.confirmTarget(slug, id, destinationId),
+    connectionActions: (id) => api.connectionActions(slug, id),
+    invokeConnectionAction: (id, action, input) =>
+      api.invokeConnectionAction(slug, id, action, input),
+  };
 }
 
 const DEFAULTS = {
@@ -85,19 +196,49 @@ const CAPABILITY_COPY: Record<string, string> = {
   writeback_credential: 'Issue a token this vendor uses to call us',
 };
 
-/** A refusal must read as a refusal, not as an empty page. */
-function readFailureMessage(err: unknown): string {
+/**
+ * A refusal must read as a refusal, not as an empty page — and it must name the
+ * refusal that actually happened. This runs in ONE place: the catch around the
+ * two GETs `reload` makes. So trace which 403 can reach here on each surface.
+ *
+ * Control plane: the caller lacks the connections permission on this foundry.
+ *
+ * Member surface: `IsSeatedMember` denied — no ACTIVE `CompanyMembership` and
+ * not the org's `owner`. That is the ONLY 403 either GET produces;
+ * `MyConnectorCatalogView` answers a foundry that has allowed nothing with
+ * `{results: []}` and a 200, and `MyConnectionsView.get` runs no per-connector
+ * policy at all. The allowlist refusal (`_NOT_ALLOWED`) is raised by the POST,
+ * lands in `CatalogCard`'s own catch, and renders the server's wording verbatim.
+ * Blaming the allowlist here would send someone whose SEAT is gone to ask an
+ * admin to allow a connector — the admin could allow every one of them and this
+ * page would still refuse.
+ */
+function readFailureMessage(err: unknown, personal: boolean): string {
   const status = (err as { status?: number })?.status;
   if (status === 403) {
-    return 'You do not have access to this foundry’s connections. Ask an admin for the connections permission.';
+    return personal
+      ? 'You are not a member of this foundry, or your access to it has ended. Ask an admin to add you.'
+      : 'You do not have access to this foundry’s connections. Ask an admin for the connections permission.';
   }
   if (status === 401) return 'Your session has expired. Sign in again.';
   const message = (err as { message?: string })?.message;
   return message || 'Could not load connections.';
 }
 
-export function ConnectionsPage({ api, foundrySlug, classNames = {} }: ConnectionsPageProps) {
+export function ConnectionsPage(props: ConnectionsPageProps) {
+  const { classNames = {} } = props;
+  const personal = props.mode === 'personal';
   const cn = { ...DEFAULTS, ...classNames };
+  // Keyed on the PARTS, never on `props` — a props object is a new object every
+  // render, so memoising on it would rebuild the binding each time, change
+  // `reload`'s identity each time, and turn the load effect into a loop.
+  const injected = props.api;
+  const slug = props.mode === 'personal' ? undefined : props.foundrySlug;
+  const api = React.useMemo(
+    () => bindApi(props),
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [personal, injected, slug],
+  );
 
   const [catalog, setCatalog] = React.useState<ConnectorCatalogEntry[]>([]);
   const [connections, setConnections] = React.useState<Connection[]>([]);
@@ -111,19 +252,22 @@ export function ConnectionsPage({ api, foundrySlug, classNames = {} }: Connectio
     setLoading(true);
     try {
       const [cat, conns] = await Promise.all([
-        api.connectorCatalog(foundrySlug),
-        api.connections(foundrySlug),
+        // In personal mode this is the ALLOWED catalog, already narrowed by the
+        // foundry's policy server-side. Rendered as handed: filtering here would
+        // put the withheld connectors in the browser to be filtered out of.
+        api.connectorCatalog(),
+        api.connections(),
       ]);
       setCatalog(cat.results ?? []);
       setConnections(conns.results ?? []);
       setPermissions(conns.permissions ?? { view: true, manage: false, issue_tokens: false });
       setLoadError('');
     } catch (err) {
-      setLoadError(readFailureMessage(err));
+      setLoadError(readFailureMessage(err, personal));
     } finally {
       setLoading(false);
     }
-  }, [api, foundrySlug]);
+  }, [api, personal]);
 
   React.useEffect(() => { void reload(); }, [reload]);
 
@@ -134,16 +278,26 @@ export function ConnectionsPage({ api, foundrySlug, classNames = {} }: Connectio
   return (
     <div className={cn.root}>
       <section className={cn.section}>
-        <h2 className={cn.heading}>Connected accounts</h2>
+        {/* WHOSE ACCOUNTS THESE ARE. On the member surface the list is already
+            owner-scoped server-side (`for_owner`), and the heading has to say so
+            — a member looking at "Connected accounts" inside their foundry's app
+            has no way to tell whether they are seeing the foundry's keys. */}
+        <h2 className={cn.heading}>
+          {personal ? 'Your connected accounts' : 'Connected accounts'}
+        </h2>
         {loading && connections.length === 0 ? <p className={cn.muted}>Loading…</p> : null}
         {!loading && connections.length === 0 ? (
-          <p className={cn.muted}>Nothing connected yet.</p>
+          <p className={cn.muted}>
+            {personal
+              ? 'You have not connected an account yet.'
+              : 'Nothing connected yet.'}
+          </p>
         ) : null}
         {connections.map((connection) => (
           <ConnectionCard
             key={connection.id}
             api={api}
-            foundrySlug={foundrySlug}
+            personal={personal}
             connection={connection}
             // The CONNECTOR's own catalog row. It carries the capability list,
             // so the card can offer a capability this connection does not have
@@ -160,17 +314,30 @@ export function ConnectionsPage({ api, foundrySlug, classNames = {} }: Connectio
       </section>
 
       <section className={cn.section}>
-        <h2 className={cn.heading}>Available connectors</h2>
+        <h2 className={cn.heading}>
+          {personal ? 'Connect your own account' : 'Available connectors'}
+        </h2>
+        {personal && !loading && catalog.length === 0 ? (
+          <p className={cn.muted}>
+            Your foundry has not opened any connector to members yet. An admin
+            decides which ones you may connect your own account on.
+          </p>
+        ) : null}
         {catalog.map((entry) => (
           <CatalogCard
             key={entry.key}
             api={api}
-            foundrySlug={foundrySlug}
+            personal={personal}
             entry={entry}
-            // What this foundry ALREADY has on this connector. A second vendor
-            // account is legitimate and stays possible; an admin who is really
-            // trying to install a new key is not, and they are the ones this
-            // form used to swallow.
+            /* Refreshing the CATALOG is what makes a flipped toggle stick — the
+               allowed flag rides on the row, so re-reading connections alone
+               would leave the switch showing the value it was rendered with. */
+            onPolicyChanged={reload}
+            // What ALREADY exists on this connector — in personal mode that is
+            // the member's own cards and nobody else's, because `connections`
+            // came back owner-scoped. A second vendor account is legitimate and
+            // stays possible; someone who is really trying to install a rotated
+            // key is not, and they are the ones this form used to swallow.
             existing={connections.filter((c) => c.connector_key === entry.key)}
             canManage={permissions.manage}
             classNames={cn}
@@ -178,6 +345,24 @@ export function ConnectionsPage({ api, foundrySlug, classNames = {} }: Connectio
           />
         ))}
       </section>
+
+      {/* THE OTHER HALF OF THE ALLOWLIST (bd startsim-768w.22.25.8): who has
+          actually connected. Its own component, and deliberately not folded into
+          the two sections above — those render the viewer's own rows and this
+          one enumerates OTHER PEOPLE'S accounts, which is a different entity, a
+          different serializer and a different disclosure. Keeping "list every
+          member's connections" outside the component whose security property is
+          that personal and foundry rows never mix means one forgotten `personal`
+          guard cannot leak it. It renders in foundry mode only, and only when
+          the api has the verb. */}
+      {!personal && api.memberConnections ? (
+        <MemberConnectionRoster
+          list={api.memberConnections}
+          disconnect={api.disconnectMemberConnection}
+          canManage={permissions.manage}
+          classNames={cn}
+        />
+      ) : null}
     </div>
   );
 }
@@ -256,16 +441,19 @@ function orderCapabilities(declared: string[], selected: Iterable<string>): stri
 // --------------------------------------------------------------------------
 
 function CatalogCard({
-  api, foundrySlug, entry, existing, canManage, classNames: cn, onConnected,
+  api, personal, entry, existing, canManage, classNames: cn, onConnected,
+  onPolicyChanged,
 }: {
-  api: ConnectionsApi;
-  foundrySlug: string;
+  api: BoundApi;
+  personal: boolean;
   entry: ConnectorCatalogEntry;
-  /** Cards this foundry already holds on this connector. */
+  /** Cards already held on this connector — the foundry's, or the member's own. */
   existing: Connection[];
   canManage: boolean;
   classNames: typeof DEFAULTS;
   onConnected: () => void;
+  /** Re-read the catalog after the member toggle is written. Foundry mode only. */
+  onPolicyChanged?: () => void;
 }) {
   const [open, setOpen] = React.useState(false);
   const [values, setValues] = React.useState<Record<string, unknown>>({});
@@ -303,7 +491,7 @@ function CatalogCard({
         // recordings are stored.
         if (typeof v === 'boolean' || typeof v === 'number' || v) config[spec.key] = v;
       }
-      await api.connect(foundrySlug, {
+      await api.connect({
         connector_key: entry.key, name: entry.name, credentials, config,
         // Always sent. Leaving it off is what wrote the inert cards.
         capabilities_enabled: orderCapabilities(entry.capabilities, capabilities),
@@ -345,6 +533,20 @@ function CatalogCard({
         ) : null}
       </div>
 
+      {/* On the card it governs, not on a settings list of its own — an admin
+          should not have to hold two lists of connectors in their head to know
+          which ones members can use. */}
+      {!personal && api.setMemberConnectorPolicy && entry.member_policy ? (
+        <MemberPolicyToggle
+          connectorKey={entry.key}
+          policy={entry.member_policy}
+          canManage={canManage}
+          write={api.setMemberConnectorPolicy}
+          classNames={cn}
+          onChanged={onPolicyChanged}
+        />
+      ) : null}
+
       {open ? (
         <div className="mt-4 space-y-3">
           {/* SAID BEFORE THE KEY IS PASTED, not after the server refuses.
@@ -414,6 +616,105 @@ function CatalogCard({
   );
 }
 
+// --------------------------------------------------------------------------
+//  who may connect their OWN account (bd startsim-768w.22.25.8)
+// --------------------------------------------------------------------------
+
+/**
+ * ONE CONNECTOR, ONE DECISION: may this foundry's members connect their own
+ * account on it?
+ *
+ * DEFAULT-DENY, and the copy has to carry that, because the switch is not a
+ * display preference. Turning it on means members send THEIR vendor data into
+ * this foundry, under their own credentials, for this foundry to store and
+ * process — an admin is agreeing to receive that, and is entitled to read it in
+ * those words before flipping anything.
+ *
+ * TURNING IT OFF IS NOT A KILL SWITCH, and saying so in the confirmation rather
+ * than in a docs page is the point. Off stops NEW personal connections
+ * immediately; every connection that already exists keeps running, with its
+ * credential and its scheduled fetches. Ending those is one explicit disconnect
+ * per person from the roster below — destructive, irreversible, and never a side
+ * effect of tightening a default. The wording here is the server's own, lifted
+ * from `apps/connectors/services/policy.py` so the two cannot drift apart.
+ *
+ * A connector that CANNOT be opened yet renders disabled WITH the server's
+ * reason instead of vanishing: an admin who cannot find Dropbox in this list
+ * would reasonably conclude the catalog is broken, when the real answer is that
+ * the member surface has no OAuth path yet.
+ *
+ * THE THIRD STATE IS THE ONE THAT MATTERS: already allowed, and no longer
+ * openable — a connector opened while it was an API key that has since moved to
+ * OAuth, or whose class stopped importing. The server answers `settable: true`
+ * with a `reason`, because the only move an ON switch offers is OFF and the
+ * write always accepts that. Disabling it on `reason` alone would draw a switch
+ * an admin cannot turn off, which is the exact opposite of what a governance
+ * control is for. It renders live, with the reason as a one-way warning.
+ */
+function MemberPolicyToggle({
+  connectorKey, policy, canManage, write, classNames: cn, onChanged,
+}: {
+  connectorKey: string;
+  policy: NonNullable<ConnectorCatalogEntry['member_policy']>;
+  canManage: boolean;
+  write: (connectorKey: string, allowed: boolean) => Promise<unknown>;
+  classNames: typeof DEFAULTS;
+  onChanged?: () => void;
+}) {
+  const [busy, setBusy] = React.useState(false);
+  const [error, setError] = React.useState('');
+  const id = `member-policy-${connectorKey}`;
+
+  async function set(allowed: boolean) {
+    setBusy(true);
+    setError('');
+    try {
+      await write(connectorKey, allowed);
+      onChanged?.();
+    } catch (err) {
+      setError((err as { message?: string })?.message || 'Could not save that.');
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return (
+    <div className="mt-3 border-t border-gray-100 pt-3" data-member-policy={connectorKey}>
+      <label htmlFor={id} className="flex items-start gap-2 text-sm">
+        <input
+          id={id}
+          type="checkbox"
+          className="mt-0.5"
+          checked={policy.allowed}
+          disabled={busy || !canManage || !policy.settable}
+          onChange={(event) => void set(event.target.checked)}
+        />
+        <span>
+          <span className="text-gray-900">Members may connect their own account</span>
+          <span className={`block ${cn.muted}`}>
+            {policy.settable
+              ? 'Each member signs in with their own key, and sees only their own'
+                + ' data. Allowing this means their vendor data flows into this'
+                + ' foundry. Turning it off later stops new connections — the ones'
+                + ' already connected keep running until you disconnect them below.'
+              : policy.reason}
+          </span>
+          {/* Settable AND blocked: open today, unopenable tomorrow. Said next to
+              the switch rather than after the click, because the click is the
+              irreversible half. */}
+          {policy.settable && policy.reason ? (
+            <span className={`block ${cn.error}`} data-member-policy-oneway={connectorKey}>
+              This is on, but can no longer be turned back on once off:{' '}
+              {policy.reason}
+            </span>
+          ) : null}
+        </span>
+      </label>
+      {error ? <p className={cn.error} role="alert">{error}</p> : null}
+    </div>
+  );
+}
+
 // --------------------------------------------------------------------------
 //  replacing the key on a connection that already exists
 // --------------------------------------------------------------------------
@@ -437,10 +738,9 @@ function CatalogCard({
  * rotation quietly a config change.
  */
 function ReplaceKeyForm({
-  api, foundrySlug, connection, entry, classNames: cn, onDone,
+  api, connection, entry, classNames: cn, onDone,
 }: {
-  api: ConnectionsApi;
-  foundrySlug: string;
+  api: BoundApi;
   connection: Connection;
   entry?: ConnectorCatalogEntry;
   classNames: typeof DEFAULTS;
@@ -499,7 +799,7 @@ function ReplaceKeyForm({
         onClick={() => {
           setBusy(true);
           setError('');
-          api.rotateCredential(foundrySlug, connection.id, submitted)
+          api.rotateCredential(connection.id, submitted)
             .then(() => { setValues({}); onDone(); })
             // The server's typed answer, verbatim: it already scrubbed itself of
             // the values just submitted, and "the vendor rejected this key" is
@@ -541,10 +841,9 @@ function ReplaceKeyForm({
  * `ingest_transcripts` the off position is the whole privacy posture.
  */
 function ConnectionSettingsForm({
-  api, foundrySlug, connection, fields, classNames: cn, onDone,
+  api, connection, fields, classNames: cn, onDone,
 }: {
-  api: ConnectionsApi;
-  foundrySlug: string;
+  api: BoundApi;
   connection: Connection;
   fields: ConnectorFieldSpec[];
   classNames: typeof DEFAULTS;
@@ -578,7 +877,7 @@ function ConnectionSettingsForm({
             ? Number(value)
             : value;
       }
-      await api.updateConnection(foundrySlug, connection.id, { config });
+      await api.updateConnection!(connection.id, { config });
       onDone();
     } catch (err) {
       setError((err as { message?: string })?.message || 'Those settings were not saved.');
@@ -615,10 +914,10 @@ function ConnectionSettingsForm({
 }
 
 function ConnectionCard({
-  api, foundrySlug, connection, entry, canManage, classNames: cn, onChanged,
+  api, personal, connection, entry, canManage, classNames: cn, onChanged,
 }: {
-  api: ConnectionsApi;
-  foundrySlug: string;
+  api: BoundApi;
+  personal: boolean;
   connection: Connection;
   /** This connector's catalog row: its capabilities AND its field schema. */
   entry?: ConnectorCatalogEntry;
@@ -692,7 +991,7 @@ function ConnectionCard({
               className={cn.button}
               disabled={Boolean(busy)}
               onClick={() => void guard('check', async () => {
-                const res = await api.checkConnection(foundrySlug, connection.id);
+                const res = await api.checkConnection(connection.id);
                 setNotice(res.detail || (res.ok ? 'Connection is healthy.' : ''));
                 onChanged();
               })}
@@ -714,19 +1013,26 @@ function ConnectionCard({
             >
               {replacing ? 'Cancel' : 'Replace key'}
             </button>
-            <button
-              type="button"
-              className={cn.button}
-              disabled={Boolean(busy)}
-              onClick={() => void guard('discover', async () => {
-                const page = await api.connectionChoices(foundrySlug, connection.id);
-                setChoices(page.results ?? []);
-                const available = await api.connectionActions(foundrySlug, connection.id);
-                setActions(available.results ?? []);
-              })}
-            >
-              {busy === 'discover' ? 'Loading…' : 'Workflows'}
-            </button>
+            {/* DISCOVER -> WIRE -> FIRE is foundry-level and stays there. The
+                member router serves no choices, targets or actions at all, so
+                the control is gated on the verb EXISTING rather than on a mode
+                flag — there is no way to render a button here whose handler is
+                undefined. */}
+            {api.connectionChoices && api.connectionActions ? (
+              <button
+                type="button"
+                className={cn.button}
+                disabled={Boolean(busy)}
+                onClick={() => void guard('discover', async () => {
+                  const page = await api.connectionChoices!(connection.id);
+                  setChoices(page.results ?? []);
+                  const available = await api.connectionActions!(connection.id);
+                  setActions(available.results ?? []);
+                })}
+              >
+                {busy === 'discover' ? 'Loading…' : 'Workflows'}
+              </button>
+            ) : null}
             {/* SETTINGS, which this card has never had. A connector's
                 `config_schema` ships on every catalog row and was rendered
                 exactly once — on the connect form, before the account existed.
@@ -735,7 +1041,7 @@ function ConnectionCard({
                 recordings of people's conversations are stored was reachable
                 only by editing the database. `ReplaceKeyForm` already pointed at
                 "the connection's own settings" as if this existed. */}
-            {configFields.length ? (
+            {configFields.length && api.updateConnection ? (
               <button
                 type="button"
                 className={cn.button}
@@ -769,7 +1075,6 @@ function ConnectionCard({
       {settingsOpen ? (
         <ConnectionSettingsForm
           api={api}
-          foundrySlug={foundrySlug}
           connection={connection}
           fields={configFields}
           classNames={cn}
@@ -780,7 +1085,6 @@ function ConnectionCard({
       {replacing ? (
         <ReplaceKeyForm
           api={api}
-          foundrySlug={foundrySlug}
           connection={connection}
           entry={entry}
           classNames={cn}
@@ -809,7 +1113,7 @@ function ConnectionCard({
               className={cn.button}
               disabled={Boolean(busy)}
               onClick={() => void guard('disconnect', async () => {
-                await api.disconnect(foundrySlug, connection.id);
+                await api.disconnect(connection.id);
                 setConfirmingDisconnect(false);
                 setNotice('Disconnected.');
                 onChanged();
@@ -837,21 +1141,26 @@ function ConnectionCard({
         scope="connection"
         declared={offered}
         selected={selected}
-        disabled={!canManage || Boolean(busy)}
+        // On the member surface there is no PATCH, so the picker is
+        // INFORMATIONAL rather than absent. A member chose these at connect time
+        // and `POST` accepted them; hiding the list afterwards would make that
+        // choice look like it never happened, and leave them unable to see what
+        // their own account is doing.
+        disabled={!canManage || !api.updateConnection || Boolean(busy)}
         idPrefix={`connection-${connection.id}`}
         onToggle={(capability, on) => setSelected((prev) => (
           on ? [...prev, capability] : prev.filter((c) => c !== capability)
         ))}
         classNames={cn}
       >
-        {canManage ? (
+        {canManage && api.updateConnection ? (
           <div className="mt-2 flex items-center gap-3">
             <button
               type="button"
               className={cn.button}
               disabled={!dirty || pending.length === 0 || Boolean(busy)}
               onClick={() => void guard('capabilities', async () => {
-                await api.updateConnection(foundrySlug, connection.id, {
+                await api.updateConnection!(connection.id, {
                   capabilities_enabled: pending,
                 });
                 setNotice('Saved.');
@@ -866,6 +1175,11 @@ function ConnectionCard({
               </span>
             ) : null}
           </div>
+        ) : personal ? (
+          <p className={cn.muted}>
+            Chosen when you connected. Ask an admin to change what this account
+            may do, or disconnect it and connect again.
+          </p>
         ) : null}
       </CapabilityPicker>
 
@@ -897,7 +1211,7 @@ function ConnectionCard({
                   className={cn.button}
                   disabled={Boolean(busy)}
                   onClick={() => void guard('wire', async () => {
-                    setTarget(await api.wireTarget(foundrySlug, connection.id, {
+                    setTarget(await api.wireTarget!(connection.id, {
                       choice_id: choice.id,
                     }));
                   })}
@@ -925,7 +1239,7 @@ function ConnectionCard({
               className={cn.button}
               disabled={Boolean(busy)}
               onClick={() => void guard('confirm', async () => {
-                setTarget(await api.confirmTarget(foundrySlug, connection.id, target.id));
+                setTarget(await api.confirmTarget!(connection.id, target.id));
               })}
             >
               Confirm this target
@@ -940,8 +1254,8 @@ function ConnectionCard({
                   className={cn.button}
                   disabled={Boolean(busy)}
                   onClick={() => void guard('invoke', async () => {
-                    const result = await api.invokeConnectionAction(
-                      foundrySlug, connection.id, available.name,
+                    const result = await api.invokeConnectionAction!(
+                      connection.id, available.name,
                       { destination_id: target.id, records: [] },
                     );
                     // `accepted` is not `completed`. Saying "done" here would