@superblocksteam/shared 0.9607.2 → 0.9608.0

package/src/types/codeSecurity/index.ts

@@ -2,6 +2,8 @@
 // server handlers and the UI so the two can't drift. The taxonomy below is
 // mirrored by the PackageVulnerability DB entity (its columns import these).
 
+import semver from 'semver';
+
 export type Ecosystem = 'npm';
 export type VulnerabilitySource = 'osv';
 export type AdvisoryKind = 'vulnerability' | 'malware';
@@ -13,7 +15,7 @@ export type SeverityLevel = (typeof SEVERITY_LEVELS)[number];
 
 // needs_review: version couldn't be pinned, so a "clear" verdict would be unearned.
 export type DependencyScanStatus = 'clear' | 'needs_review' | 'unresolved';
-export const DEPENDENCY_SCAN_DATE_FILTERS = ['all', 'today', '-7d', '-30d', 'ytd'] as const;
+export const DEPENDENCY_SCAN_DATE_FILTERS = ['all', 'none', 'today', '-7d', '-30d', 'ytd'] as const;
 export type DependencyScanDateFilter = (typeof DEPENDENCY_SCAN_DATE_FILTERS)[number];
 export type DependencyScanOrder = 'asc' | 'desc';
 export const DEPENDENCY_SCAN_SORTS = ['severity', 'last_updated', 'last_published'] as const;
@@ -26,6 +28,21 @@ export function parseDependencyScanDateFilter(value: string | null | undefined):
   return 'all';
 }
 
+// Pins a package usage row to the single version the org scan evaluates it
+// against: the resolved version when we have one, otherwise the minimum
+// version satisfying the declared range. Shared between the server (which
+// produces AdvisoryDetail.currentVersion this way) and the UI (which must key
+// its own package rows identically to look advisories back up) so the two
+// can't drift into looking up different version strings for the same package.
+export function resolveScannedPackageVersion(declared: string, resolved: string | null | undefined): string | null {
+  const source = resolved && resolved.length > 0 ? resolved : declared;
+  try {
+    return semver.minVersion(source)?.version ?? null;
+  } catch {
+    return null;
+  }
+}
+
 export interface AdvisoryDetail {
   advisoryId: string;
   source: VulnerabilitySource;
@@ -63,3 +80,68 @@ export interface DependencyScanSummary {
   publishedWithVulns: number;
   totalProjects: number;
 }
+
+// Wire contract for GET /api/v2/applications/package-usage, backed by the
+// application_package_usage table: one row per (application, commit,
+// package). Shared so the server handler and the UI's SBOM view can't drift.
+export interface AppPackageUsageItem {
+  application_id: string;
+  application_name: string;
+  commit_id: string;
+  commit_message: string | null;
+  is_deployed: boolean;
+  package_name: string;
+  package_version_declared: string;
+  package_version_resolved: string | null;
+  dependency_source: string | null;
+  indexed_at: string;
+}
+
+export interface AppPackageUsageResponse {
+  source: 'all' | 'deployed' | 'not_deployed';
+  deployed_filter: boolean | null;
+  package_name: string | null;
+  application_id: string | null;
+  commit_id: string | null;
+  package_version_declared: string | null;
+  package_version_resolved: string | null;
+  dependency_source: string | null;
+  limit: number;
+  offset: number;
+  total: number;
+  items: AppPackageUsageItem[];
+}
+
+// Minimal CycloneDX 1.5 JSON document, hand-built server-side from
+// application_package_usage rows for one (application, commit) — see
+// service/codeSecurity/sbom.ts. Only the fields this feature populates are
+// modeled; CycloneDX defines many more optional fields we don't emit.
+export interface CycloneDxProperty {
+  name: string;
+  value: string;
+}
+
+export interface CycloneDxComponent {
+  type: 'library';
+  name: string;
+  version: string;
+  purl: string;
+  properties: CycloneDxProperty[];
+}
+
+export interface CycloneDxBom {
+  bomFormat: 'CycloneDX';
+  specVersion: '1.5';
+  serialNumber: string;
+  version: 1;
+  metadata: {
+    timestamp: string;
+    component: {
+      type: 'application';
+      name: string;
+      version: string;
+      'bom-ref': string;
+    };
+  };
+  components: CycloneDxComponent[];
+}

package/src/types/datasource/auth.test.ts

@@ -148,10 +148,12 @@ describe('extractPublic normalizes boolean tokenScope for OAUTH2_CODE', () => {
   test('preserves the PKCE marker', () => {
     const result = extractPublic(IntegrationAuthType.OAUTH2_CODE, {
       clientId: 'public-client',
-      usePkce: true
+      usePkce: true,
+      usePkceClientSecret: 'true'
     });
 
     expect(result.usePkce).toBe(true);
+    expect(result.usePkceClientSecret).toBe(true);
   });
 
   test('normalizes boolean true tokenScope to TokenScope.DATASOURCE', () => {

package/src/types/datasource/auth.ts

@@ -18,6 +18,23 @@ export function getOAuthCodeVerifierStorageKey(oneTimeCode: string): string {
   return `${LS_OAUTH_CODE_VERIFIER_PREFIX}:${oneTimeCode}`;
 }
 
+/**
+ * Persisted integration configuration stores some booleans as strings or
+ * numbers, because form controls and older writers coerced them on the way in
+ * (hence the `FakeBoolean` fields below). Returns the boolean such a value
+ * stands for, or `undefined` when it stands for neither and the caller has to
+ * decide what an unrecognized value means.
+ */
+export function asFakeBoolean(value: unknown): boolean | undefined {
+  if (value === true || value === 'true' || value === 1 || value === '1') {
+    return true;
+  }
+  if (value === false || value === 'false' || value === 0 || value === '0' || value === '' || value === null || value === undefined) {
+    return false;
+  }
+  return undefined;
+}
+
 /**
  * `usePkce` is typed as a boolean but reaches us from persisted integration
  * configuration, where a form checkbox can store it as the string `'true'`.
@@ -25,7 +42,7 @@ export function getOAuthCodeVerifierStorageKey(oneTimeCode: string): string {
  * sites disagree about whether PKCE is on.
  */
 export function isPkceEnabled(usePkce: unknown): boolean {
-  return usePkce === true || usePkce === 'true' || usePkce === 1 || usePkce === '1';
+  return asFakeBoolean(usePkce) === true;
 }
 
 export type AuthId = string;
@@ -344,13 +361,15 @@ type PublicOAuthCodeConfig = {
   userEmail?: string; // Used by integrations that need user identity (e.g., Lakebase Token Federation)
   sendOAuthState?: boolean;
   usePkce?: boolean;
+  usePkceClientSecret?: boolean;
 };
 
 // Persisted configuration can hold the PKCE marker as a string, so the stored
 // shape is wider than the public one that `extractPublic` normalizes it into.
-type OAuthCodeConfig = Omit<PublicOAuthCodeConfig, 'usePkce'> & {
+type OAuthCodeConfig = Omit<PublicOAuthCodeConfig, 'usePkce' | 'usePkceClientSecret'> & {
   clientSecret?: string;
   usePkce?: FakeBoolean;
+  usePkceClientSecret?: FakeBoolean;
 };
 
 export enum TokenScope {
@@ -444,7 +463,8 @@ export const extractPublic = (authType: AuthType | undefined, authConfig: AuthCo
         tokenScope: normalizeTokenScope(authConfig?.tokenScope),
         promptType: authConfig?.promptType,
         sendOAuthState: authConfig?.sendOAuthState,
-        usePkce: isPkceEnabled(authConfig?.usePkce)
+        usePkce: isPkceEnabled(authConfig?.usePkce),
+        usePkceClientSecret: isPkceEnabled(authConfig?.usePkceClientSecret)
       };
     case IntegrationAuthType.OAUTH2_IMPLICIT:
       return {
@@ -609,6 +629,7 @@ export type DatasourceAuthState = DatasourceOneTimeState & {
     scope: string | undefined;
     clientAuthMethod?: ClientAuthMethod;
     usePkce?: boolean;
+    usePkceClientSecret?: boolean;
   };
   origin: string;
 };

package/src/types/group/index.ts

@@ -1,9 +1,7 @@
 import { AssignmentDto } from '../rbac/index.js';
 
 /**
- * This enum is used in DB. DO NOT CHANGE the existing values. It is also
- * indirectly referenced in the authorization.polar file, so references there
- * need to be updated if this changes.
+ * This enum is used in DB. DO NOT CHANGE the existing values.
  */
 export enum GroupType {
   ALL_USERS = 0,

package/src/types/integration/index.ts

@@ -104,6 +104,14 @@ export class SupersetIntegrationDto extends IntegrationBaseDto {
   created?: Date;
   updated?: Date;
   configurations: IntegrationConfigurationDto[];
+  /**
+   * Which data tags this integration is configured for, and whether it has a default
+   * configuration that covers any other tag. Reported separately from `configurations` because
+   * those bodies hold secrets and are withheld from callers who cannot edit the integration,
+   * while the coverage itself is not sensitive.
+   */
+  configuredProfileKeys: string[];
+  hasDefaultConfiguration: boolean;
   slug?: string;
   ownerEmail?: string;
   readOnly: boolean;
@@ -123,7 +131,9 @@ export class SupersetIntegrationDto extends IntegrationBaseDto {
     kind,
     organizationId,
     configurations,
+    configuredProfileKeys,
     demoIntegrationId,
+    hasDefaultConfiguration,
     isUserConfigured,
     ownerEmail,
     slug,
@@ -145,6 +155,8 @@ export class SupersetIntegrationDto extends IntegrationBaseDto {
     kind: IntegrationKind;
     organizationId: string;
     configurations: IntegrationConfigurationDto[];
+    configuredProfileKeys?: string[];
+    hasDefaultConfiguration?: boolean;
     demoIntegrationId?: string;
     isUserConfigured: boolean;
     ownerEmail?: string;
@@ -168,6 +180,8 @@ export class SupersetIntegrationDto extends IntegrationBaseDto {
     this.organizationId = organizationId;
     this.applicationId = applicationId;
     this.configurations = configurations;
+    this.configuredProfileKeys = configuredProfileKeys ?? [];
+    this.hasDefaultConfiguration = hasDefaultConfiguration ?? false;
     this.demoIntegrationId = demoIntegrationId;
     this.isUserConfigured = isUserConfigured;
     this.managedBy = managedBy;

package/src/types/plugin/form.test.ts

@@ -1,6 +1,13 @@
 import { describe, expect, it } from 'vitest';
 
-import { FormComponentType, getDisplayOnlyFieldNames } from './form.js';
+import { IntegrationAuthType } from '../datasource/index.js';
+import {
+  FormComponentType,
+  assertPkcePrerequisites,
+  assertSelectedDropdownOptionsSupported,
+  getDisplayOnlyFieldNames,
+  isDropdownOptionSupported
+} from './form.js';
 import type { FormTemplate } from './form.js';
 
 describe('getDisplayOnlyFieldNames', () => {
@@ -159,3 +166,169 @@ describe('getDisplayOnlyFieldNames', () => {
     expect(result.has('path')).toBe(false);
   });
 });
+
+describe('isDropdownOptionSupported', () => {
+  it('includes versioned options only within their supported range', () => {
+    const option = {
+      key: 'versioned',
+      value: 'versioned',
+      startVersion: '0.0.16',
+      endVersion: '0.0.20'
+    };
+
+    expect(isDropdownOptionSupported(option, '0.0.15')).toBe(false);
+    expect(isDropdownOptionSupported(option, '0.0.16')).toBe(true);
+    expect(isDropdownOptionSupported(option, '0.0.20')).toBe(true);
+    expect(isDropdownOptionSupported(option, '0.0.21')).toBe(false);
+  });
+});
+
+describe('assertPkcePrerequisites', () => {
+  const authCode = { authType: IntegrationAuthType.OAUTH2_CODE };
+
+  it('rejects PKCE with the OAuth state parameter turned off', () => {
+    expect(() => assertPkcePrerequisites({ ...authCode, 'authConfig.usePkce': true, 'authConfig.sendOAuthState': false })).toThrow(
+      'PKCE requires the OAuth state parameter to be enabled.'
+    );
+  });
+
+  it('rejects a stringified PKCE marker with the state parameter turned off', () => {
+    expect(() => assertPkcePrerequisites({ ...authCode, 'authConfig.usePkce': 'true' })).toThrow(
+      'PKCE requires the OAuth state parameter to be enabled.'
+    );
+  });
+
+  it('rejects a stringified state parameter that stands for false', () => {
+    // Checkboxes persist booleans as strings in older configs. The string
+    // 'false' is truthy, so a plain truthiness check would let this through
+    // at save time only for the login flow to refuse it later.
+    expect(() => assertPkcePrerequisites({ ...authCode, 'authConfig.usePkce': true, 'authConfig.sendOAuthState': 'false' })).toThrow(
+      'PKCE requires the OAuth state parameter to be enabled.'
+    );
+  });
+
+  it('accepts PKCE with the state parameter on', () => {
+    expect(() => assertPkcePrerequisites({ ...authCode, 'authConfig.usePkce': true, 'authConfig.sendOAuthState': true })).not.toThrow();
+  });
+
+  it('accepts a stringified state parameter that stands for true', () => {
+    expect(() => assertPkcePrerequisites({ ...authCode, 'authConfig.usePkce': true, 'authConfig.sendOAuthState': 'true' })).not.toThrow();
+  });
+
+  it('leaves ordinary OAuth alone', () => {
+    expect(() => assertPkcePrerequisites({ ...authCode, 'authConfig.sendOAuthState': false })).not.toThrow();
+  });
+
+  it('ignores a leftover PKCE marker on another auth type', () => {
+    // The guard runs on raw form values before dependency clearing, so a
+    // stale usePkce from an earlier authorization-code setup must not block
+    // saving an integration that switched to a different auth type.
+    expect(() =>
+      assertPkcePrerequisites({ authType: 'basic', 'authConfig.usePkce': true, 'authConfig.sendOAuthState': false })
+    ).not.toThrow();
+  });
+});
+
+describe('assertSelectedDropdownOptionsSupported', () => {
+  const template: FormTemplate = {
+    sections: [
+      {
+        name: 'auth',
+        items: [
+          {
+            name: 'authType',
+            secondaryName: 'usePkce',
+            label: 'Authentication method',
+            startVersion: '0.0.1',
+            componentType: FormComponentType.DROPDOWN,
+            options: [
+              { key: 'basic', value: 'basic' },
+              { key: 'oauth', value: 'oauth' },
+              { key: 'pkce', value: 'oauth', secondaryValue: true, startVersion: '0.0.16' }
+            ]
+          }
+        ]
+      }
+    ]
+  };
+
+  it('rejects an unrecognized secondary value instead of skipping version validation', () => {
+    expect(() => assertSelectedDropdownOptionsSupported({ authType: 'oauth', usePkce: 'maybe' }, template, '0.0.15')).toThrow(
+      'The selected authentication method is invalid.'
+    );
+  });
+
+  it.each([
+    ['undefined', undefined],
+    ['null', null],
+    ['false', false],
+    ['empty string', ''],
+    ['the string false', 'false'],
+    ['zero', 0],
+    ['the string zero', '0']
+  ] as const)('accepts the plain option when the secondary marker is %s', (_label, usePkce) => {
+    expect(() => assertSelectedDropdownOptionsSupported({ authType: 'oauth', usePkce }, template, '0.0.15')).not.toThrow();
+  });
+
+  // A marker that round-tripped through a form control comes back as a string
+  // or a number. The runtime reads it as PKCE on, so the form has to agree:
+  // it is the same selection, and the same version gate applies to it.
+  it.each([
+    ['the string true', 'true'],
+    ['one', 1],
+    ['the string one', '1']
+  ] as const)('gates the secondary option on version when the marker is %s', (_label, usePkce) => {
+    expect(() => assertSelectedDropdownOptionsSupported({ authType: 'oauth', usePkce }, template, '0.0.15')).toThrow(
+      'The selected authentication method requires a newer agent version.'
+    );
+    expect(() => assertSelectedDropdownOptionsSupported({ authType: 'oauth', usePkce }, template, '0.0.16')).not.toThrow();
+  });
+
+  it('accepts the plain option when the secondary marker is absent', () => {
+    expect(() => assertSelectedDropdownOptionsSupported({ authType: 'oauth' }, template, '0.0.15')).not.toThrow();
+  });
+
+  it('ignores a stale secondary marker for a primary option that does not use it', () => {
+    expect(() => assertSelectedDropdownOptionsSupported({ authType: 'basic', usePkce: true }, template, '0.0.15')).not.toThrow();
+  });
+
+  it('rejects the secondary option when the plugin version is too old', () => {
+    expect(() => assertSelectedDropdownOptionsSupported({ authType: 'oauth', usePkce: true }, template, '0.0.15')).toThrow(
+      'The selected authentication method requires a newer agent version.'
+    );
+  });
+
+  it('rejects the secondary option when agent support is unreported', () => {
+    expect(() => assertSelectedDropdownOptionsSupported({ authType: 'oauth', usePkce: true }, template, '0.0.1')).toThrow(
+      'Cannot verify that the connected agent supports the selected authentication method.'
+    );
+  });
+
+  it('rejects a version-gated option when its minimum equals the unreported fallback', () => {
+    const fallbackGatedTemplate: FormTemplate = {
+      sections: [
+        {
+          name: 'auth',
+          items: [
+            {
+              name: 'authType',
+              secondaryName: 'usePkce',
+              label: 'Authentication method',
+              startVersion: '0.0.1',
+              componentType: FormComponentType.DROPDOWN,
+              options: [{ key: 'pkce', value: 'oauth', secondaryValue: true, startVersion: '0.0.1' }]
+            }
+          ]
+        }
+      ]
+    };
+
+    expect(() => assertSelectedDropdownOptionsSupported({ authType: 'oauth', usePkce: true }, fallbackGatedTemplate, '0.0.1')).toThrow(
+      'Cannot verify that the connected agent supports the selected authentication method.'
+    );
+  });
+
+  it('accepts the secondary option once the plugin version supports it', () => {
+    expect(() => assertSelectedDropdownOptionsSupported({ authType: 'oauth', usePkce: true }, template, '0.0.16')).not.toThrow();
+  });
+});

package/src/types/plugin/form.ts

@@ -1,6 +1,15 @@
 import { AuthorizationExtraParams, AuthorizationStateConfig, ClientAuthMethod } from '../../plugins/index.js';
-import { AuthConfig, AuthType, DynamicWorkflowConfig, TokenScope } from '../datasource/index.js';
-import { AgentType } from '../organization/index.js';
+import {
+  asFakeBoolean,
+  AuthConfig,
+  AuthType,
+  DynamicWorkflowConfig,
+  IntegrationAuthType,
+  isPkceEnabled,
+  TokenScope
+} from '../datasource/index.js';
+import { AgentType, compareSemVer } from '../organization/index.js';
+import { VERSION_INITIAL } from './index.js';
 
 export interface FormTemplate {
   sections: FormSection[];
@@ -372,6 +381,7 @@ type ConnectOAuthPayload = {
       tokenScope: TokenScope;
       clientAuthMethod?: ClientAuthMethod;
       usePkce?: boolean;
+      usePkceClientSecret?: boolean;
     };
     dynamicWorkflowConfiguration?: DynamicWorkflowConfig;
   };
@@ -465,6 +475,10 @@ export const getDisplayOnlyFieldNames = (template: FormTemplate): Set<string> =>
 export interface DropdownOption {
   key: string;
   value: string;
+  disabled?: boolean;
+  startVersion?: string;
+  endVersion?: string;
+  secondaryValue?: InitialValue;
   enumValue?: number;
   displayName?: string;
   subText?: string;
@@ -479,3 +493,87 @@ export interface DropdownOption {
   prefixWidth?: number;
   hasDivider?: boolean;
 }
+
+export const isDropdownOptionSupported = (option: DropdownOption, pluginVersion: string): boolean =>
+  (!option.startVersion || compareSemVer(option.startVersion, pluginVersion) <= 0) &&
+  (!option.endVersion || compareSemVer(option.endVersion, pluginVersion) >= 0);
+
+/**
+ * Options carry their marker as a real boolean, but the same marker can come
+ * back from persisted configuration as a string or a number. Both sides go
+ * through the coercion the runtime reads use (`isPkceEnabled`) so the form and
+ * the runtime cannot disagree about which option is selected. A value that
+ * stands for neither boolean is compared as-is, so an unrecognized marker
+ * still fails validation instead of matching the option that leaves the
+ * marker unset.
+ */
+const normalizeSecondaryValue = (value: unknown): unknown => asFakeBoolean(value) ?? value;
+
+/**
+ * Find the option a dropdown currently has selected. Options can share a value
+ * and differ only by the secondary marker they set (ordinary versus PKCE
+ * authorization code), so both have to be compared to tell them apart.
+ */
+export function findSelectedDropdownOption(
+  item: { name: string; options: DropdownOption[]; secondaryName?: string },
+  formValues: Record<string, unknown>
+): DropdownOption | undefined {
+  const optionsForValue = item.options.filter((option) => option.value === formValues[item.name]);
+  const usesSecondaryValue = optionsForValue.some((option) => option.secondaryValue !== undefined);
+
+  return optionsForValue.find(
+    (option) =>
+      !item.secondaryName ||
+      !usesSecondaryValue ||
+      normalizeSecondaryValue(option.secondaryValue) === normalizeSecondaryValue(formValues[item.secondaryName])
+  );
+}
+
+export const PKCE_STATE_PARAMETER_REQUIRED_MESSAGE = 'PKCE requires the OAuth state parameter to be enabled.';
+
+/**
+ * PKCE correlates its verifier through the OAuth state parameter, so a PKCE
+ * integration with state turned off cannot log in at all. The login modal
+ * refuses that combination with the same wording; refusing it at save means it
+ * never gets persisted and the user learns about it while they can still fix
+ * it.
+ *
+ * Runs on raw form values before dependency clearing, so the auth type has to
+ * be checked here: a leftover PKCE marker from an earlier authorization-code
+ * setup must not block saving under a different auth type. The state value is
+ * read through asFakeBoolean because older configs persist it as a string,
+ * where a plain truthiness check reads 'false' as on.
+ */
+export function assertPkcePrerequisites(formValues: Record<string, unknown>): void {
+  if (
+    formValues['authType'] === IntegrationAuthType.OAUTH2_CODE &&
+    isPkceEnabled(formValues['authConfig.usePkce']) &&
+    asFakeBoolean(formValues['authConfig.sendOAuthState']) !== true
+  ) {
+    throw new Error(PKCE_STATE_PARAMETER_REQUIRED_MESSAGE);
+  }
+}
+
+export function assertSelectedDropdownOptionsSupported(
+  formValues: Record<string, unknown>,
+  template: FormTemplate | undefined,
+  pluginVersion: string
+): void {
+  for (const section of template?.sections ?? []) {
+    for (const sectionItem of section.items) {
+      for (const item of getRowItemsFromSectionItem(sectionItem)) {
+        if (!('options' in item)) continue;
+        const selectedOption = findSelectedDropdownOption(item, formValues);
+        if (!selectedOption && item.options.some((option) => option.value === formValues[item.name])) {
+          throw new Error('The selected authentication method is invalid.');
+        }
+        if (selectedOption?.startVersion && pluginVersion === VERSION_INITIAL) {
+          throw new Error('Cannot verify that the connected agent supports the selected authentication method.');
+        }
+        if (selectedOption && !isDropdownOptionSupported(selectedOption, pluginVersion)) {
+          throw new Error('The selected authentication method requires a newer agent version.');
+        }
+      }
+    }
+  }
+}

package/src/types/profile/index.ts

@@ -14,6 +14,9 @@ export class Profile {
   allowedInEditor?: boolean;
   allowedInPreview?: boolean;
   allowedInDeployed?: boolean;
+  defaultInEditor?: boolean;
+  defaultInPreview?: boolean;
+  defaultInDeployed?: boolean;
 
   constructor({
     id,
@@ -23,7 +26,10 @@ export class Profile {
     type,
     allowedInEditor,
     allowedInPreview,
-    allowedInDeployed
+    allowedInDeployed,
+    defaultInEditor,
+    defaultInPreview,
+    defaultInDeployed
   }: {
     id: string;
     key: string;
@@ -33,6 +39,9 @@ export class Profile {
     allowedInEditor?: boolean;
     allowedInPreview?: boolean;
     allowedInDeployed?: boolean;
+    defaultInEditor?: boolean;
+    defaultInPreview?: boolean;
+    defaultInDeployed?: boolean;
   }) {
     this.id = id;
     this.key = key;
@@ -42,6 +51,9 @@ export class Profile {
     this.allowedInEditor = allowedInEditor;
     this.allowedInPreview = allowedInPreview;
     this.allowedInDeployed = allowedInDeployed;
+    this.defaultInEditor = defaultInEditor;
+    this.defaultInPreview = defaultInPreview;
+    this.defaultInDeployed = defaultInDeployed;
   }
 }
 
@@ -57,3 +69,9 @@ export type EntityProfileSettings = {
     [ViewMode.DEPLOYED]: EntityModeProfileSettings;
   };
 };
+
+export type ApplicationEnvironmentSettings = EntityProfileSettings & {
+  removedProfiles: Record<string, Array<{ id: string; key: string; displayName: string }>>;
+  needsAttention: Record<ViewMode, boolean>;
+  updated: number;
+};

package/src/types/rbac/index.ts

@@ -180,6 +180,7 @@ export enum ActionTypeEnum {
   DELETE = 'delete',
   DEPLOY = 'deploy',
   MANAGE = 'manage',
+  MANAGE_ENVIRONMENTS = 'manage_environments',
   MANAGE_SCHEDULE = 'manage_schedule',
   MANAGE_VISIBILITY = 'manage_visibility',
   PREVIEW = 'preview',
@@ -262,6 +263,7 @@ export const ActionTypeByResourceType = {
     CREATE: ActionTypeEnum.CREATE,
     DELETE: ActionTypeEnum.DELETE,
     DEPLOY: ActionTypeEnum.DEPLOY,
+    MANAGE_ENVIRONMENTS: ActionTypeEnum.MANAGE_ENVIRONMENTS,
     MANAGE_VISIBILITY: ActionTypeEnum.MANAGE_VISIBILITY,
     PREVIEW: ActionTypeEnum.PREVIEW,
     SHARE: ActionTypeEnum.SHARE,

package/src/types/response/GetRecentApplicationsResponseBody.ts

@@ -0,0 +1,4 @@
+import type { IRecentApplicationDto } from '../application/index.js';
+import type { Pagination } from '../pagination/index.js';
+
+export type GetRecentApplicationsResponseBody = Pagination<IRecentApplicationDto>;

package/src/types/response/index.ts

@@ -41,6 +41,7 @@ export * from './GetPublicApiResponseBody.js';
 export * from './GetPublicOrganizationSummaryResponseBody.js';
 export * from './IssueSuperblocksResponseBody.js';
 export * from './GetAllApplicationsResponseBody.js';
+export * from './GetRecentApplicationsResponseBody.js';
 export * from './PatchApplicationResponseBody.js';
 export * from './PatchHomePageItemsResponseBody.js';
 export * from './ListApplicationBuildsResponseBody.js';