@vellumai/assistant 0.8.6 → 0.8.7-dev.202606052118.34cd356

package/src/runtime/routes/migration-rollback-routes.ts

@@ -19,6 +19,7 @@ import {
   loadCheckpoints,
   rollbackWorkspaceMigrations,
 } from "../../workspace/migrations/runner.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -160,11 +161,14 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "admin_rollbackmigrations_post",
     endpoint: "admin/rollback-migrations",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Rollback migrations",
     description:
       "Roll back DB and/or workspace migrations to a specified target version. Restricted to gateway service principals.",
     tags: ["admin"],
-    requirePolicyEnforcement: true,
     handler: handleRollbackMigrations,
     requestBody: z.object({
       targetDbVersion: z

package/src/runtime/routes/migration-routes.ts

@@ -41,6 +41,7 @@ import { getLogger } from "../../util/logger.js";
 import { getWorkspaceDir, getWorkspaceHooksDir } from "../../util/platform.js";
 import { APP_VERSION } from "../../version.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   validateGcsSignedUrl,
   type ValidateGcsSignedUrlOptions,
@@ -1852,6 +1853,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_validate_post",
     endpoint: "migrations/validate",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Validate a .vbundle archive",
     description:
       "Upload a .vbundle archive for validation. Accepts raw binary or multipart form data.",
@@ -1867,6 +1872,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_export_post",
     endpoint: "migrations/export",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Export a .vbundle archive",
     description:
       "Generate and download a .vbundle archive of the assistant's data. Optional JSON body for metadata.",
@@ -1880,6 +1889,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_importpreflight_post",
     endpoint: "migrations/import-preflight",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Dry-run import analysis",
     description:
       "Validate a .vbundle archive and return a report of what would change on import without modifying data.",
@@ -1897,6 +1910,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_import_post",
     endpoint: "migrations/import",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Import a .vbundle archive",
     description:
       "Commit a .vbundle archive import to disk — destructive. Accepts the bundle as raw bytes (application/octet-stream), multipart/form-data, or a JSON body with `{ url }` carrying a signed URL the daemon fetches.",
@@ -1927,6 +1944,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_exporttogcs_post",
     endpoint: "migrations/export-to-gcs",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Start an async export streamed to a GCS signed URL",
     description:
       "Kick off a background export job that PUTs a freshly-built .vbundle archive to the supplied GCS signed URL. Returns 202 with a job_id the caller can poll via the job-status endpoint. Fails fast with 409 if another export job is already pending or running.",
@@ -1953,6 +1974,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_importfromgcs_post",
     endpoint: "migrations/import-from-gcs",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Start an async .vbundle import from a signed GCS URL",
     description:
       "Schedule a background import job that fetches the bundle at `bundle_url` and streams it through the importer. Returns 202 with a `job_id`; poll `GET /v1/migrations/jobs/{job_id}` for status. 409 if another import is already in flight.",
@@ -1977,6 +2002,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "migrations_jobs_by_job_id_get",
     endpoint: "migrations/jobs/:job_id",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get migration job status",
     description:
       "Return the current status of an async migration job (export or import). The response discriminates on `status`: `processing` (pending or running), `complete` (with `result`), or `failed` (with `error`, `error_code`, optional `upstream_status`).",

package/src/runtime/routes/notification-routes.ts

@@ -12,6 +12,7 @@ import { editNotification } from "../../notifications/edit-notification.js";
 import { emitNotificationSignal } from "../../notifications/emit-signal.js";
 import { listEvents } from "../../notifications/events-store.js";
 import type { AttentionHints } from "../../notifications/signal.js";
+import { ACTOR_PRINCIPALS, LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -196,6 +197,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "emit_notification_signal",
     endpoint: "notifications/emit",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleEmitSignal,
     summary: "Emit a notification signal",
     description:
@@ -213,6 +218,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "edit_notification",
     endpoint: "notifications/edit",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleEditNotification,
     summary: "Edit an already-sent notification",
     description:
@@ -241,6 +250,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "list_notification_events",
     endpoint: "notifications/events",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleListEvents,
     summary: "List notification events",
     description:
@@ -263,11 +276,14 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "notificationintentresult_post",
     endpoint: "notification-intent-result",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Report notification delivery result",
     description:
       "Client acknowledgment for local notification delivery outcome.",
     tags: ["notifications"],
-    requirePolicyEnforcement: true,
     handler: handleNotificationIntentResult,
     requestBody: z.object({
       deliveryId: z.string().describe("Notification delivery ID"),

package/src/runtime/routes/oauth-apps.ts

@@ -6,6 +6,8 @@
  * bearer-token authenticated via the standard runtime auth middleware.
  */
 
+import { z } from "zod";
+
 import { orchestrateOAuthConnect } from "../../oauth/connect-orchestrator.js";
 import {
   deleteApp,
@@ -21,11 +23,9 @@ import {
   upsertApp,
 } from "../../oauth/oauth-store.js";
 import { serializeProviderSummary } from "../../oauth/provider-serializer.js";
-import {
-  BadRequestError,
-  InternalError,
-  NotFoundError,
-} from "./errors.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
+import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
+import { oauthProviderSummarySchema } from "./oauth-providers.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 function parseGrantedScopes(
@@ -130,17 +130,14 @@ async function handleUpsertApp({ body = {} }: RouteHandlerArgs) {
   const clientId = b.client_id as string | undefined;
 
   if (!providerKey || !clientId) {
-    throw new BadRequestError(
-      "provider_key and client_id are required",
-    );
+    throw new BadRequestError("provider_key and client_id are required");
   }
 
   const clientSecretOpts = b.client_secret
     ? { clientSecretValue: b.client_secret as string }
     : b.client_secret_credential_path
       ? {
-          clientSecretCredentialPath:
-            b.client_secret_credential_path as string,
+          clientSecretCredentialPath: b.client_secret_credential_path as string,
         }
       : undefined;
 
@@ -296,6 +293,38 @@ async function handleConnectApp({ pathParams = {}, body }: RouteHandlerArgs) {
   return { ok: true };
 }
 
+// ---------------------------------------------------------------------------
+// Schemas
+// ---------------------------------------------------------------------------
+
+/** Custom OAuth app registration (snake_case wire shape from `formatAppRow`). */
+const oauthAppSchema = z.object({
+  id: z.string(),
+  provider_key: z.string(),
+  client_id: z.string(),
+  created_at: z.number(),
+  updated_at: z.number(),
+});
+
+/** OAuth connection linked to a custom OAuth app. */
+const oauthAppConnectionSchema = z.object({
+  id: z.string(),
+  provider_key: z.string(),
+  account_info: z.string().nullable(),
+  granted_scopes: z.array(z.string()),
+  status: z.string(),
+  has_refresh_token: z.boolean(),
+  expires_at: z.number().nullable(),
+  created_at: z.number(),
+  updated_at: z.number(),
+});
+
+const oauthAppCredentialsSchema = z.object({
+  provider_key: z.string(),
+  client_id: z.string(),
+  client_secret: z.string(),
+});
+
 // ---------------------------------------------------------------------------
 // Route definitions
 // ---------------------------------------------------------------------------
@@ -305,10 +334,13 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_apps_get",
     endpoint: "oauth/apps",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List OAuth apps",
     description: "List OAuth apps filtered by provider_key.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     queryParams: [
       {
         name: "provider_key",
@@ -317,17 +349,24 @@ export const ROUTES: RouteDefinition[] = [
         description: "OAuth provider key to filter by",
       },
     ],
+    responseBody: z.object({
+      provider: oauthProviderSummarySchema.nullable(),
+      apps: z.array(oauthAppSchema),
+    }),
     handler: handleListApps,
   },
   {
     operationId: "oauth_apps_by_query_get",
     endpoint: "oauth/apps/lookup",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get OAuth app",
     description:
       "Look up a single OAuth app by ID, provider + client_id, or provider (most recent).",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     queryParams: [
       {
         name: "id",
@@ -345,29 +384,43 @@ export const ROUTES: RouteDefinition[] = [
         description: "OAuth client ID (requires provider)",
       },
     ],
+    responseBody: z.object({ app: oauthAppSchema }),
     handler: handleGetApp,
   },
   {
     operationId: "oauth_apps_upsert",
     endpoint: "oauth/apps/upsert",
     method: "POST",
-    policyKey: "oauth/apps.upsert",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Upsert OAuth app",
     description:
       "Create or return an existing OAuth app registration. Updates client secret if provided.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
+    requestBody: z.object({
+      provider_key: z.string(),
+      client_id: z.string(),
+      client_secret: z.string().optional(),
+      client_secret_credential_path: z.string().optional(),
+    }),
+    responseBody: z.object({ app: oauthAppSchema }),
     handler: handleUpsertApp,
   },
   {
     operationId: "oauth_apps_post",
     endpoint: "oauth/apps",
     method: "POST",
-    policyKey: "oauth/apps.create",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Create OAuth app",
     description: "Register a new OAuth app with client credentials.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
+    requestBody: oauthAppCredentialsSchema,
+    responseBody: z.object({ app: oauthAppSchema }),
     responseStatus: "201",
     handler: handleCreateApp,
   },
@@ -375,42 +428,65 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_apps_delete",
     endpoint: "oauth/apps/:id",
     method: "DELETE",
-    policyKey: "oauth/apps.delete",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete OAuth app",
-    description:
-      "Delete an OAuth app and disconnect all its connections.",
+    description: "Delete an OAuth app and disconnect all its connections.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
+    responseBody: z.object({ ok: z.boolean() }),
     handler: handleDeleteApp,
   },
   {
     operationId: "oauth_apps_connections_get",
     endpoint: "oauth/apps/:appId/connections",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List OAuth connections",
     description: "List connections for an OAuth app.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
+    responseBody: z.object({
+      connections: z.array(oauthAppConnectionSchema),
+    }),
     handler: handleListConnections,
   },
   {
     operationId: "oauth_connections_delete",
     endpoint: "oauth/connections/:id",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Disconnect OAuth connection",
     description: "Disconnect a single OAuth connection.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
+    responseBody: z.object({ ok: z.boolean() }),
     handler: handleDeleteConnection,
   },
   {
     operationId: "oauth_apps_connect_post",
     endpoint: "oauth/apps/:appId/connect",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Start OAuth connect",
     description: "Start an OAuth connect flow for an app.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
+    requestBody: z.object({
+      scopes: z.array(z.string()).optional(),
+      callback_transport: z.enum(["loopback", "gateway"]).optional(),
+    }),
+    responseBody: z.union([
+      z.object({ auth_url: z.string(), state: z.string() }),
+      z.object({ ok: z.literal(true) }),
+    ]),
     handler: handleConnectApp,
   },
 ];

package/src/runtime/routes/oauth-commands-routes.ts

@@ -38,6 +38,7 @@ import { VellumPlatformClient } from "../../platform/client.js";
 import { withValidToken } from "../../security/token-manager.js";
 import { matchHostPattern } from "../../tools/credentials/host-pattern-match.js";
 import { getLogger } from "../../util/logger.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -977,23 +978,28 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_disconnect",
     endpoint: "oauth/disconnect",
     method: "POST",
-    policyKey: "oauth/disconnect",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Disconnect OAuth provider",
     description:
       "Disconnect an OAuth provider and remove associated credentials (BYO or managed).",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleDisconnect,
   },
   {
     operationId: "oauth_mode_get",
     endpoint: "oauth/mode",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Get OAuth mode",
     description:
       "Get the current OAuth mode (managed or your-own) for a provider.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     queryParams: [
       {
         name: "provider",
@@ -1008,22 +1014,27 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_mode_set",
     endpoint: "oauth/mode",
     method: "POST",
-    policyKey: "oauth/mode.set",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Set OAuth mode",
     description: "Set the OAuth mode (managed or your-own) for a provider.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleModeSet,
   },
   {
     operationId: "oauth_status",
     endpoint: "oauth/status",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Get OAuth status",
     description:
       "Show OAuth connection status for a specified provider (BYO or managed).",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     queryParams: [
       {
         name: "provider",
@@ -1038,57 +1049,69 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_ping",
     endpoint: "oauth/ping",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Ping OAuth provider",
     description:
       "Verify an OAuth token is valid by hitting the provider's configured health-check endpoint.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handlePing,
   },
   {
     operationId: "oauth_token",
     endpoint: "oauth/token",
     method: "POST",
-    policyKey: "oauth/token",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Get OAuth token",
     description: "Retrieve a valid OAuth access token for a BYO-mode provider.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleToken,
   },
   {
     operationId: "oauth_request",
     endpoint: "oauth/request",
     method: "POST",
-    policyKey: "oauth/request",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Make authenticated OAuth request",
     description:
       "Make an authenticated HTTP request through an OAuth connection (supports curl-like interface).",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleRequest,
   },
   {
     operationId: "oauth_managed_connect_start",
     endpoint: "oauth/managed-connect/start",
     method: "POST",
-    policyKey: "oauth/managed-connect.start",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Start managed OAuth connect",
     description:
       "Start a managed (platform) OAuth connect flow and return the connect URL.",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     handler: handleManagedConnect,
   },
   {
     operationId: "oauth_managed_connect_poll",
     endpoint: "oauth/managed-connect/poll",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Poll managed OAuth connections",
     description:
       "Fetch active platform connections for a provider (used to detect new connections after managed connect).",
     tags: ["oauth"],
-    requirePolicyEnforcement: true,
     queryParams: [
       {
         name: "provider",

package/src/runtime/routes/oauth-connect-routes.ts

@@ -21,6 +21,7 @@ import {
   getProvider,
 } from "../../oauth/oauth-store.js";
 import { getLogger } from "../../util/logger.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -185,6 +186,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_oauth_connect_start",
     endpoint: "internal/oauth/connect/start",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Start daemon-owned OAuth connect flow",
     description:
       "Starts an OAuth connect flow in the daemon and returns the authorization URL for the CLI to open in the browser.",
@@ -202,6 +207,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_oauth_connect_status",
     endpoint: "internal/oauth/connect/status/:state",
     method: "GET",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Poll daemon OAuth connect flow status",
     description:
       "Returns the current status of an in-flight daemon-owned OAuth connect flow (pending/complete/error).",

package/src/runtime/routes/oauth-lifecycle-routes.ts

@@ -9,6 +9,7 @@
 import { z } from "zod";
 
 import { getConfig, invalidateConfigCache } from "../../config/loader.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // ── Handlers ──────────────────────────────────────────────────────────
@@ -30,7 +31,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "oauth_connection_changed",
     endpoint: "oauth/connection-changed",
     method: "POST",
-    policyKey: "oauth/connection-changed",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleOAuthConnectionChanged,
     summary: "Notify the assistant that an OAuth connection changed",
     description: