@vellumai/assistant 0.6.5 → 0.6.6

package/src/oauth/oauth-store.ts

@@ -1,7 +1,7 @@
 /**
  * CRUD store for OAuth providers, apps, and connections.
  *
- * Backed by Drizzle + SQLite. All JSON fields (default_scopes, scope_policy,
+ * Backed by Drizzle + SQLite. All JSON fields (default_scopes, available_scopes,
  * extra_params, granted_scopes, metadata) are stored as serialized JSON strings.
  *
  * Note: TS field names use camelCase from the platform's naming
@@ -31,6 +31,7 @@ import {
   setSecureKeyAsync,
 } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
+import type { AvailableScopes } from "./connect-types.js";
 import { tryRevokeOAuthToken } from "./revoke.js";
 
 const log = getLogger("oauth-store");
@@ -56,12 +57,10 @@ export type OAuthConnectionRow = typeof oauthConnections.$inferSelect;
  * loopbackPort, injectionTemplates, appType, setupNotes,
  * identityUrl, identityMethod, identityHeaders, identityBody,
  * identityResponsePaths, identityFormat, identityOkField, featureFlag,
- * scopeSeparator)
+ * scopeSeparator, defaultScopes, availableScopes)
  * and display metadata (displayLabel, description, dashboardUrl,
  * clientIdPlaceholder, logoUrl, requiresClientSecret) propagate to existing
- * installations on every startup, while user-customizable fields
- * (defaultScopes, scopePolicy) are only written on the
- * initial insert. baseUrl is backfilled from seed data when null
+ * installations on every startup. baseUrl is backfilled from seed data when null
  * (e.g. legacy rows created before the column existed) but preserved
  * if the user has set a custom value.
  */
@@ -82,10 +81,11 @@ export function seedProviders(
     revokeBodyTemplate?: Record<string, string>;
     baseUrl?: string;
     defaultScopes: string[];
-    scopePolicy: Record<string, unknown>;
+    availableScopes?: AvailableScopes;
     scopeSeparator?: string;
     authorizeParams?: Record<string, string>;
     managedServiceConfigKey?: string;
+    managedServiceIsPaid?: boolean;
     displayLabel?: string;
     description?: string;
     dashboardUrl?: string | null;
@@ -136,7 +136,9 @@ export function seedProviders(
       : null;
     const baseUrl = p.baseUrl ?? null;
     const defaultScopes = JSON.stringify(p.defaultScopes);
-    const scopePolicy = JSON.stringify(p.scopePolicy);
+    const availableScopes = p.availableScopes
+      ? JSON.stringify(p.availableScopes)
+      : null;
     // Coerce empty string to the default space separator. An empty separator
     // would join scopes into a single concatenated token (e.g. "readwrite"),
     // which is never a valid OAuth authorize URL value.
@@ -145,6 +147,7 @@ export function seedProviders(
       ? JSON.stringify(p.authorizeParams)
       : null;
     const managedServiceConfigKey = p.managedServiceConfigKey ?? null;
+    const managedServiceIsPaid = p.managedServiceIsPaid === true;
     const displayLabel = p.displayLabel ?? null;
     const description = p.description ?? null;
     const dashboardUrl = p.dashboardUrl ?? null;
@@ -182,7 +185,7 @@ export function seedProviders(
         userinfoUrl,
         baseUrl,
         defaultScopes,
-        scopePolicy,
+        availableScopes,
         scopeSeparator,
         authorizeParams,
         pingUrl,
@@ -192,6 +195,7 @@ export function seedProviders(
         revokeUrl,
         revokeBodyTemplate,
         managedServiceConfigKey,
+        managedServiceIsPaid,
         displayLabel,
         description,
         dashboardUrl,
@@ -224,6 +228,7 @@ export function seedProviders(
           userinfoUrl,
           baseUrl: sql`COALESCE(${oauthProviders.baseUrl}, ${baseUrl})`,
           defaultScopes,
+          availableScopes,
           scopeSeparator,
           authorizeParams,
           pingUrl,
@@ -233,6 +238,7 @@ export function seedProviders(
           revokeUrl,
           revokeBodyTemplate,
           managedServiceConfigKey,
+          managedServiceIsPaid,
           displayLabel,
           description,
           dashboardUrl,
@@ -294,10 +300,11 @@ export function registerProvider(params: {
   revokeBodyTemplate?: Record<string, string>;
   baseUrl?: string;
   defaultScopes: string[];
-  scopePolicy: Record<string, unknown>;
+  availableScopes?: AvailableScopes;
   scopeSeparator?: string;
   authorizeParams?: Record<string, string>;
   managedServiceConfigKey?: string;
+  managedServiceIsPaid?: boolean;
   displayLabel?: string;
   description?: string;
   dashboardUrl?: string;
@@ -341,7 +348,9 @@ export function registerProvider(params: {
     userinfoUrl: params.userinfoUrl ?? null,
     baseUrl: params.baseUrl ?? null,
     defaultScopes: JSON.stringify(params.defaultScopes),
-    scopePolicy: JSON.stringify(params.scopePolicy),
+    availableScopes: params.availableScopes
+      ? JSON.stringify(params.availableScopes)
+      : null,
     // Coerce empty string to the default space separator (see seedProviders).
     scopeSeparator: params.scopeSeparator || " ",
     authorizeParams: params.authorizeParams
@@ -357,6 +366,7 @@ export function registerProvider(params: {
       ? JSON.stringify(params.revokeBodyTemplate)
       : null,
     managedServiceConfigKey: params.managedServiceConfigKey ?? null,
+    managedServiceIsPaid: params.managedServiceIsPaid === true,
     displayLabel: params.displayLabel ?? null,
     description: params.description ?? null,
     dashboardUrl: params.dashboardUrl ?? null,
@@ -396,7 +406,7 @@ export function registerProvider(params: {
 /**
  * Update mutable fields on an existing provider. Only the fields explicitly
  * provided (not `undefined`) are written; everything else is left unchanged.
- * JSON fields (defaultScopes, scopePolicy, authorizeParams, pingHeaders, pingBody)
+ * JSON fields (defaultScopes, availableScopes, authorizeParams, pingHeaders, pingBody)
  * are serialized with JSON.stringify before storage.
  *
  * Returns the updated provider row, or `undefined` if no provider with the
@@ -419,7 +429,7 @@ export function updateProvider(
     revokeBodyTemplate: Record<string, string> | null;
     baseUrl: string;
     defaultScopes: string[];
-    scopePolicy: Record<string, unknown>;
+    availableScopes: AvailableScopes | null;
     scopeSeparator: string;
     authorizeParams: Record<string, string>;
     displayLabel: string;
@@ -445,6 +455,7 @@ export function updateProvider(
     identityFormat: string;
     identityOkField: string;
     featureFlag: string;
+    managedServiceIsPaid: boolean;
   }>,
 ): OAuthProviderRow | undefined {
   const existing = getProvider(provider);
@@ -478,8 +489,11 @@ export function updateProvider(
   if (params.baseUrl !== undefined) set.baseUrl = params.baseUrl;
   if (params.defaultScopes !== undefined)
     set.defaultScopes = JSON.stringify(params.defaultScopes);
-  if (params.scopePolicy !== undefined)
-    set.scopePolicy = JSON.stringify(params.scopePolicy);
+  if (params.availableScopes !== undefined)
+    set.availableScopes =
+      params.availableScopes === null
+        ? null
+        : JSON.stringify(params.availableScopes);
   if (params.scopeSeparator !== undefined)
     // Coerce empty string to the default space separator (see seedProviders).
     set.scopeSeparator = params.scopeSeparator || " ";
@@ -513,6 +527,8 @@ export function updateProvider(
   if (params.identityOkField !== undefined)
     set.identityOkField = params.identityOkField;
   if (params.featureFlag !== undefined) set.featureFlag = params.featureFlag;
+  if (params.managedServiceIsPaid !== undefined)
+    set.managedServiceIsPaid = params.managedServiceIsPaid;
 
   db.update(oauthProviders)
     .set(set)

package/src/oauth/provider-serializer.ts

@@ -32,6 +32,7 @@ export interface SerializedProviderSummary {
   requires_client_secret: boolean;
   logo_url: string | null;
   supports_managed_mode: boolean;
+  managed_service_is_paid: boolean;
   feature_flag: string | null;
 }
 
@@ -86,8 +87,11 @@ function _serializeProvider(
     clientIdPlaceholder: row.clientIdPlaceholder ?? null,
     requiresClientSecret: !!(row.requiresClientSecret ?? 1),
     supportsManagedMode: !!row.managedServiceConfigKey,
+    managedServiceIsPaid: !!row.managedServiceIsPaid,
     defaultScopes: row.defaultScopes ? JSON.parse(row.defaultScopes) : [],
-    scopePolicy: row.scopePolicy ? JSON.parse(row.scopePolicy) : {},
+    availableScopes: row.availableScopes
+      ? JSON.parse(row.availableScopes)
+      : null,
     scopeSeparator: row.scopeSeparator,
     extraParams: authorizeParams ? JSON.parse(authorizeParams) : null,
     pingHeaders: row.pingHeaders ? JSON.parse(row.pingHeaders) : null,
@@ -140,6 +144,7 @@ export function serializeProviderSummary(
     requires_client_secret: !!(row.requiresClientSecret ?? 1),
     logo_url: row.logoUrl ?? null,
     supports_managed_mode: !!row.managedServiceConfigKey,
+    managed_service_is_paid: !!row.managedServiceIsPaid,
     feature_flag: row.featureFlag ?? null,
   };
 }

package/src/oauth/seed-providers.ts

@@ -1,3 +1,4 @@
+import type { AvailableScopes } from "./connect-types.js";
 import { seedProviders } from "./oauth-store.js";
 
 /**
@@ -7,7 +8,7 @@ import { seedProviders } from "./oauth-store.js";
  * every startup. Only Vellum implementation fields (authorizeUrl, tokenExchangeUrl,
  * refreshUrl, tokenEndpointAuthMethod, userinfoUrl, authorizeParams,
  * pingUrl, pingMethod, pingHeaders, pingBody, revokeUrl, revokeBodyTemplate,
- * managedServiceConfigKey,
+ * managedServiceConfigKey, managedServiceIsPaid,
  * loopbackPort, injectionTemplates, appType, setupNotes,
  * identityUrl, identityMethod, identityHeaders, identityBody,
  * identityResponsePaths, identityFormat, identityOkField, featureFlag,
@@ -15,12 +16,10 @@ import { seedProviders } from "./oauth-store.js";
  * and display metadata (displayLabel,
  * description, dashboardUrl, clientIdPlaceholder, requiresClientSecret,
  * logoUrl)
- * are overwritten on subsequent startups — user-customizable
- * fields (scopePolicy) are only
- * written on initial insert and preserved across restarts.
- * defaultScopes are also overwritten on subsequent startups so that
- * upstream scope additions (e.g. new Gmail API scopes) propagate to
- * existing installations.
+ * are overwritten on subsequent startups.
+ * defaultScopes and availableScopes are also overwritten on subsequent
+ * startups so that upstream scope additions (e.g. new Gmail API scopes)
+ * propagate to existing installations.
  */
 export const PROVIDER_SEED_DATA: Record<
   string,
@@ -40,14 +39,11 @@ export const PROVIDER_SEED_DATA: Record<
     revokeBodyTemplate?: Record<string, string>;
     baseUrl?: string;
     defaultScopes: string[];
-    scopePolicy: {
-      allowAdditionalScopes: boolean;
-      allowedOptionalScopes: string[];
-      forbiddenScopes: string[];
-    };
+    availableScopes?: AvailableScopes;
     scopeSeparator?: string;
     authorizeParams?: Record<string, string>;
     managedServiceConfigKey?: string;
+    managedServiceIsPaid?: boolean;
     displayLabel: string;
     description: string;
     dashboardUrl: string | null;
@@ -95,14 +91,8 @@ export const PROVIDER_SEED_DATA: Record<
       "https://www.googleapis.com/auth/userinfo.email",
       "https://www.googleapis.com/auth/contacts.readonly",
     ],
-    scopePolicy: {
-      allowAdditionalScopes: true,
-      allowedOptionalScopes: [
-        "https://www.googleapis.com/auth/drive.readonly",
-        "https://www.googleapis.com/auth/drive.file",
-      ],
-      forbiddenScopes: [],
-    },
+    availableScopes:
+      "https://developers.google.com/identity/protocols/oauth2/scopes",
     authorizeParams: { access_type: "offline", prompt: "consent" },
     loopbackPort: 17321,
     managedServiceConfigKey: "google-oauth",
@@ -160,11 +150,7 @@ export const PROVIDER_SEED_DATA: Record<
       "search:read",
       "reactions:write",
     ],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
+    availableScopes: "https://api.slack.com/scopes",
     authorizeParams: {
       user_scope:
         "channels:read,channels:history,groups:read,groups:history,im:read,im:history,im:write,mpim:read,mpim:history,users:read,chat:write,search:read,reactions:write",
@@ -198,11 +184,6 @@ export const PROVIDER_SEED_DATA: Record<
     clientIdPlaceholder: null,
     logoUrl: "https://cdn.simpleicons.org/notion",
     defaultScopes: [],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
     authorizeParams: { owner: "user" },
     tokenEndpointAuthMethod: "client_secret_basic",
     tokenExchangeBodyFormat: "json",
@@ -237,16 +218,16 @@ export const PROVIDER_SEED_DATA: Record<
       "tweet.read",
       "tweet.write",
       "users.read",
+      "like.read",
+      "bookmark.read",
       "offline.access",
     ],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
+    availableScopes:
+      "https://developer.x.com/en/docs/authentication/oauth-2-0/authorization-code",
     tokenEndpointAuthMethod: "client_secret_basic",
     loopbackPort: 17335,
     managedServiceConfigKey: "twitter-oauth",
+    managedServiceIsPaid: true,
     injectionTemplates: [
       {
         hostPattern: "api.x.com",
@@ -279,16 +260,8 @@ export const PROVIDER_SEED_DATA: Record<
     clientIdPlaceholder: null,
     logoUrl: "https://cdn.simpleicons.org/github",
     defaultScopes: ["repo", "read:user", "notifications"],
-    scopePolicy: {
-      allowAdditionalScopes: true,
-      allowedOptionalScopes: [
-        "read:org",
-        "write:discussion",
-        "gist",
-        "project",
-      ],
-      forbiddenScopes: ["delete_repo", "admin:org"],
-    },
+    availableScopes:
+      "https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps",
     managedServiceConfigKey: "github-oauth",
     loopbackPort: 17332,
     injectionTemplates: [
@@ -320,11 +293,20 @@ export const PROVIDER_SEED_DATA: Record<
     clientIdPlaceholder: null,
     logoUrl: "https://cdn.simpleicons.org/linear",
     defaultScopes: ["read", "write", "issues:create"],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
+    availableScopes: [
+      { scope: "read", description: "Read access for the user's account" },
+      { scope: "write", description: "Write access for the user's account" },
+      {
+        scope: "issues:create",
+        description: "Create new issues and attachments",
+      },
+      { scope: "comments:create", description: "Create new issue comments" },
+      {
+        scope: "timeSchedule:write",
+        description: "Create and modify time schedules",
+      },
+      { scope: "admin", description: "Full access to admin-level endpoints" },
+    ],
     scopeSeparator: ",",
     authorizeParams: { prompt: "consent" },
     loopbackPort: 17324,
@@ -369,11 +351,8 @@ export const PROVIDER_SEED_DATA: Record<
       "user-library-read",
       "user-library-modify",
     ],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
+    availableScopes:
+      "https://developer.spotify.com/documentation/web-api/concepts/scopes",
     tokenEndpointAuthMethod: "client_secret_basic",
     loopbackPort: 17333,
     injectionTemplates: [
@@ -401,11 +380,18 @@ export const PROVIDER_SEED_DATA: Record<
     clientIdPlaceholder: null,
     logoUrl: "https://cdn.simpleicons.org/todoist",
     defaultScopes: ["data:read_write"],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: ["data:delete"],
-    },
+    availableScopes: [
+      {
+        scope: "data:read",
+        description: "Read-only access to tasks and projects",
+      },
+      {
+        scope: "data:read_write",
+        description: "Read and write access to tasks and projects",
+      },
+      { scope: "data:delete", description: "Delete tasks and projects" },
+      { scope: "project:delete", description: "Delete entire projects" },
+    ],
     loopbackPort: 17325,
     injectionTemplates: [
       {
@@ -440,11 +426,8 @@ export const PROVIDER_SEED_DATA: Record<
       "guilds.members.read",
       "messages.read",
     ],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: ["bot"],
-      forbiddenScopes: [],
-    },
+    availableScopes:
+      "https://discord.com/developers/docs/topics/oauth2#shared-resources-oauth2-scopes",
     loopbackPort: 17326,
     injectionTemplates: [
       {
@@ -477,11 +460,7 @@ export const PROVIDER_SEED_DATA: Record<
       "files.content.write",
       "sharing.read",
     ],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
+    availableScopes: "https://developers.dropbox.com/oauth-guide",
     authorizeParams: { token_access_type: "offline" },
     loopbackPort: 17327,
     injectionTemplates: [
@@ -516,11 +495,7 @@ export const PROVIDER_SEED_DATA: Record<
     clientIdPlaceholder: null,
     logoUrl: "https://cdn.simpleicons.org/asana",
     defaultScopes: ["default"],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
+    availableScopes: "https://developers.asana.com/docs/oauth-scopes",
     loopbackPort: 17328,
     injectionTemplates: [
       {
@@ -551,11 +526,7 @@ export const PROVIDER_SEED_DATA: Record<
       "data.records:write",
       "schema.bases:read",
     ],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
+    availableScopes: "https://airtable.com/developers/web/api/scopes",
     tokenEndpointAuthMethod: "client_secret_basic",
     loopbackPort: 17329,
     injectionTemplates: [
@@ -589,14 +560,8 @@ export const PROVIDER_SEED_DATA: Record<
       "crm.objects.deals.write",
       "crm.objects.companies.read",
     ],
-    scopePolicy: {
-      allowAdditionalScopes: true,
-      allowedOptionalScopes: [
-        "crm.objects.companies.write",
-        "crm.objects.owners.read",
-      ],
-      forbiddenScopes: [],
-    },
+    availableScopes:
+      "https://developers.hubspot.com/docs/guides/apps/authentication/scopes",
     loopbackPort: 17330,
     injectionTemplates: [
       {
@@ -623,11 +588,7 @@ export const PROVIDER_SEED_DATA: Record<
     clientIdPlaceholder: null,
     logoUrl: "https://cdn.simpleicons.org/figma",
     defaultScopes: ["files:read", "file_comments:write"],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
+    availableScopes: "https://developers.figma.com/docs/rest-api/scopes/",
     tokenEndpointAuthMethod: "client_secret_basic",
     loopbackPort: 17331,
     injectionTemplates: [
@@ -669,11 +630,8 @@ export const PROVIDER_SEED_DATA: Record<
       "Calendars.ReadWrite",
       "MailboxSettings.ReadWrite",
     ],
-    scopePolicy: {
-      allowAdditionalScopes: true,
-      allowedOptionalScopes: ["Contacts.Read", "Files.Read", "Tasks.ReadWrite"],
-      forbiddenScopes: [],
-    },
+    availableScopes:
+      "https://learn.microsoft.com/en-us/graph/permissions-reference",
     authorizeParams: { prompt: "consent" },
     tokenEndpointAuthMethod: "client_secret_post",
     loopbackPort: 17334,
@@ -707,11 +665,6 @@ export const PROVIDER_SEED_DATA: Record<
     requiresClientSecret: false,
     logoUrl: "https://cdn.simpleicons.org/slack",
     defaultScopes: [],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
   },
 
   telegram: {
@@ -726,11 +679,6 @@ export const PROVIDER_SEED_DATA: Record<
     requiresClientSecret: false,
     logoUrl: "https://cdn.simpleicons.org/telegram",
     defaultScopes: [],
-    scopePolicy: {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
   },
 };
 

package/src/outbound-proxy/http-forwarder.ts

@@ -27,12 +27,19 @@ const HOP_BY_HOP = new Set([
  * Optional callback for credential injection or policy gating.
  * Called before the upstream request is sent. Returns extra headers
  * to merge, or null to reject the request.
+ *
+ * `method` and `requestHeaders` are populated for plain-HTTP proxied
+ * requests (absolute-URL form). For HTTPS CONNECT tunnels the proxy has
+ * not yet terminated TLS and cannot see HTTP-level details, so these are
+ * left undefined.
  */
 export type PolicyCallback = (
   hostname: string,
   port: number | null,
   path: string,
   scheme: "http" | "https",
+  method?: string,
+  requestHeaders?: IncomingMessage["headers"],
 ) => Promise<Record<string, string> | null>;
 
 /**
@@ -141,6 +148,8 @@ export function forwardHttpRequest(
       parsed.port ? Number(parsed.port) : null,
       path,
       "http",
+      clientReq.method,
+      clientReq.headers,
     )
       .then((extraHeaders) => {
         if (extraHeaders == null) {