Use typed Convex ID validators across workspace APIs

Rhys Sullivan committed 8 months ago

Commit a11d7b61 parent 96afda918 files · +111 −89Browse files

Unified · Split

18 files

executor/packages/database/convex/accountsInternal.ts +3 −2
executor/packages/database/convex/billing.ts +3 −2
executor/packages/database/convex/billingInternal.ts +5 −4
executor/packages/database/convex/billingSync.ts +2 −1
executor/packages/database/convex/database/approvals.ts +4 −3
executor/packages/database/convex/database/tasks.ts +5 −4
executor/packages/database/convex/database/tool_calls.ts +2 −1
executor/packages/database/convex/executor.ts +6 −5
executor/packages/database/convex/executorNode.ts +19 −18
executor/packages/database/convex/invites.ts +9 −8
executor/packages/database/convex/organizationMembers.ts +4 −3
executor/packages/database/convex/organizations.ts +3 −2
executor/packages/database/convex/runtimeCallbacks.ts +2 −1
executor/packages/database/convex/toolRegistry.ts +21 −20
executor/packages/database/convex/typedV.ts +4 −0
executor/packages/database/convex/workspace.ts +10 −8
executor/packages/database/convex/workspaceAuthInternal.ts +6 −5
executor/packages/database/convex/workspaces.ts +3 −2

executor/packages/database/convex/accountsInternal.ts+3−2

@@ -3,6 +3,7 @@ import { internal } from "./_generated/api"; · 2 unmodified lines
3	3	import { internalAction, internalMutation } from "./_generated/server";
4	4	import { deleteCurrentAccountBatchStep } from "../src/accounts/delete-current-account-batch";
5	5	import { safeRunAfter } from "../src/lib/scheduler";
	6	+import { vv } from "./typedV";
6	7
7	8	const DEFAULT_DELETE_BATCH_SIZE = 200;
8	9
@@ -16,7 +17,7 @@ function normalizeBatchSize(value: number \| undefined): number { · 7 unmodified lines
16	17
17	18	export const processDeleteCurrentAccountBatch = internalMutation({
18	19	args: {
19		− accountId: v.id("accounts"),
	20	+ accountId: vv.id("accounts"),
20	21	batchSize: v.optional(v.number()),
21	22	},
22	23	handler: async (ctx, args) => {
@@ -38,7 +39,7 @@ export const processDeleteCurrentAccountBatch = internalMutation({ · 15 unmodified lines
38	39
39	40	export const runDeleteCurrentAccount = internalAction({
40	41	args: {
41		− accountId: v.id("accounts"),
	42	+ accountId: vv.id("accounts"),
42	43	batchSize: v.optional(v.number()),
43	44	},
44	45	handler: async (ctx, args) => {

executor/packages/database/convex/billing.ts+3−2

@@ -1,6 +1,7 @@
1	1	import { StripeSubscriptions } from "@convex-dev/stripe";
2	2	import { v } from "convex/values";
3	3	import { components, internal } from "./_generated/api";
	4	+import { vv } from "./typedV";
4	5	import { customAction, organizationMutation, organizationQuery } from "../../core/src/function-builders";
5	6	import {
6	7	createCustomerPortalHandler,
@@ -22,7 +23,7 @@ export const getSummary = organizationQuery({ · 15 unmodified lines
22	23	export const createSubscriptionCheckout = customAction({
23	24	method: "POST",
24	25	args: {
25		− organizationId: v.id("organizations"),
	26	+ organizationId: vv.id("organizations"),
26	27	priceId: v.string(),
27	28	successUrl: v.optional(v.string()),
28	29	cancelUrl: v.optional(v.string()),
@@ -36,7 +37,7 @@ export const createSubscriptionCheckout = customAction({ · 7 unmodified lines
36	37	export const createCustomerPortal = customAction({
37	38	method: "POST",
38	39	args: {
39		− organizationId: v.id("organizations"),
	40	+ organizationId: vv.id("organizations"),
40	41	returnUrl: v.optional(v.string()),
41	42	sessionId: v.optional(v.string()),
42	43	},

executor/packages/database/convex/billingInternal.ts+5−4

@@ -8,6 +8,7 @@ import { · 7 unmodified lines
8	8	upsertCustomerLinkHandler,
9	9	upsertSeatStateHandler,
10	10	} from "../src/billing/internal-handlers";
	11	+import { vv } from "./typedV";
11	12
12	13	export const getBillingAccessForRequest = internalOrganizationQuery({
13	14	args: {},
@@ -18,7 +19,7 @@ export const getBillingAccessForRequest = internalOrganizationQuery({ · 4 unmodified lines
18	19
19	20	export const getSeatSyncSnapshot = internalQuery({
20	21	args: {
21		− organizationId: v.id("organizations"),
	22	+ organizationId: vv.id("organizations"),
22	23	},
23	24	handler: async (ctx, args) => {
24	25	return await getSeatSyncSnapshotHandler(ctx, args);
@@ -27,7 +28,7 @@ export const getSeatSyncSnapshot = internalQuery({ · 2 unmodified lines
27	28
28	29	export const upsertCustomerLink = internalMutation({
29	30	args: {
30		− organizationId: v.id("organizations"),
	31	+ organizationId: vv.id("organizations"),
31	32	stripeCustomerId: v.string(),
32	33	},
33	34	handler: async (ctx, args) => {
@@ -37,7 +38,7 @@ export const upsertCustomerLink = internalMutation({ · 3 unmodified lines
37	38
38	39	export const bumpSeatSyncVersion = internalMutation({
39	40	args: {
40		− organizationId: v.id("organizations"),
	41	+ organizationId: vv.id("organizations"),
41	42	},
42	43	handler: async (ctx, args) => {
43	44	return await bumpSeatSyncVersionHandler(ctx, args);
@@ -46,7 +47,7 @@ export const bumpSeatSyncVersion = internalMutation({ · 2 unmodified lines
46	47
47	48	export const upsertSeatState = internalMutation({
48	49	args: {
49		− organizationId: v.id("organizations"),
	50	+ organizationId: vv.id("organizations"),
50	51	desiredSeats: v.number(),
51	52	lastAppliedSeats: v.union(v.number(), v.null()),
52	53	syncError: v.union(v.string(), v.null()),

executor/packages/database/convex/billingSync.ts+2−1

@@ -2,12 +2,13 @@ import { StripeSubscriptions } from "@convex-dev/stripe"; · 1 unmodified line
2	2	import { v } from "convex/values";
3	3	import { components, internal } from "./_generated/api";
4	4	import { internalAction } from "./_generated/server";
	5	+import { vv } from "./typedV";
5	6
6	7	const stripeClient = new StripeSubscriptions(components.stripe, {});
7	8
8	9	export const syncSeatQuantity = internalAction({
9	10	args: {
10		− organizationId: v.id("organizations"),
	11	+ organizationId: vv.id("organizations"),
11	12	expectedVersion: v.number(),
12	13	},
13	14	handler: async (ctx, args) => {

executor/packages/database/convex/database/approvals.ts+4−3

@@ -4,6 +4,7 @@ import { mapApproval } from "../../src/database/mappers"; · 3 unmodified lines
4	4	import { getApprovalDoc, getTaskDoc } from "../../src/database/readers";
5	5	import { approvalStatusValidator, jsonObjectValidator } from "../../src/database/validators";
6	6	import type { TaskStatus } from "../../../core/src/types";
	7	+import { vv } from "../typedV";
7	8
8	9	export const createApproval = internalMutation({
9	10	args: {
@@ -52,7 +53,7 @@ export const getApproval = internalQuery({ · 42 unmodified lines
52	53
53	54	export const listApprovals = internalQuery({
54	55	args: {
55		− workspaceId: v.id("workspaces"),
	56	+ workspaceId: vv.id("workspaces"),
56	57	status: v.optional(approvalStatusValidator),
57	58	},
58	59	handler: async (ctx, args) => {
@@ -78,7 +79,7 @@ export const listApprovals = internalQuery({ · 19 unmodified lines
78	79	});
79	80
80	81	export const listPendingApprovals = internalQuery({
81		− args: { workspaceId: v.id("workspaces") },
	82	+ args: { workspaceId: vv.id("workspaces") },
82	83	handler: async (ctx, args) => {
83	84	const docs = await ctx.db
84	85	.query("approvals")
@@ -145,7 +146,7 @@ export const resolveApproval = internalMutation({ · 60 unmodified lines
145	146	});
146	147
147	148	export const getApprovalInWorkspace = internalQuery({
148		− args: { approvalId: v.string(), workspaceId: v.id("workspaces") },
	149	+ args: { approvalId: v.string(), workspaceId: vv.id("workspaces") },
149	150	handler: async (ctx, args) => {
150	151	const doc = await getApprovalDoc(ctx, args.approvalId);
151	152	if (!doc \|\| doc.workspaceId !== args.workspaceId) {

executor/packages/database/convex/database/tasks.ts+5−4

@@ -8,6 +8,7 @@ import { · 7 unmodified lines
8	8	storageAccessTypeValidator,
9	9	storageScopeTypeValidator,
10	10	} from "../../src/database/validators";
	11	+import { vv } from "../typedV";
11	12	import { DEFAULT_TASK_TIMEOUT_MS, MAX_TASK_TIMEOUT_MS } from "../../src/task/constants";
12	13	import { isTerminalTaskStatus } from "../../src/task/status";
13	14
@@ -62,8 +63,8 @@ export const createTask = internalMutation({ · 48 unmodified lines
62	63	runtimeId: v.string(),
63	64	timeoutMs: v.optional(v.number()),
64	65	metadata: v.optional(jsonObjectValidator),
65		− workspaceId: v.id("workspaces"),
66		− accountId: v.optional(v.id("accounts")),
	66	+ workspaceId: vv.id("workspaces"),
	67	+ accountId: v.optional(vv.id("accounts")),
67	68	clientId: v.optional(v.string()),
68	69	},
69	70	handler: async (ctx, args) => {
@@ -107,7 +108,7 @@ export const getTask = internalQuery({ · 37 unmodified lines
107	108	});
108	109
109	110	export const listTasks = internalQuery({
110		− args: { workspaceId: v.id("workspaces") },
	111	+ args: { workspaceId: vv.id("workspaces") },
111	112	handler: async (ctx, args) => {
112	113	const docs = await ctx.db
113	114	.query("tasks")
@@ -132,7 +133,7 @@ export const listQueuedTaskIds = internalQuery({ · 18 unmodified lines
132	133	});
133	134
134	135	export const getTaskInWorkspace = internalQuery({
135		− args: { taskId: v.string(), workspaceId: v.id("workspaces") },
	136	+ args: { taskId: v.string(), workspaceId: vv.id("workspaces") },
136	137	handler: async (ctx, args) => {
137	138	const doc = await getTaskDoc(ctx, args.taskId);
138	139	if (!doc \|\| doc.workspaceId !== args.workspaceId) {

executor/packages/database/convex/database/tool_calls.ts+2−1

@@ -3,12 +3,13 @@ import { internalMutation, internalQuery } from "../_generated/server"; · 2 unmodified lines
3	3	import { mapToolCall } from "../../src/database/mappers";
4	4	import { getToolCallDoc } from "../../src/database/readers";
5	5	import { terminalToolCallStatusValidator } from "../../src/database/validators";
	6	+import { vv } from "../typedV";
6	7
7	8	export const upsertToolCallRequested = internalMutation({
8	9	args: {
9	10	taskId: v.string(),
10	11	callId: v.string(),
11		− workspaceId: v.id("workspaces"),
	12	+ workspaceId: vv.id("workspaces"),
12	13	toolPath: v.string(),
13	14	},
14	15	handler: async (ctx, args) => {

executor/packages/database/convex/executor.ts+6−5

@@ -10,6 +10,7 @@ import { · 9 unmodified lines
10	10	resolveApprovalInternalHandler,
11	11	} from "../src/executor/handlers";
12	12	import { jsonObjectValidator } from "../src/database/validators";
	13	+import { vv } from "./typedV";
13	14
14	15	export const createTask = customAction({
15	16	method: "POST",
@@ -18,9 +19,9 @@ export const createTask = customAction({ · 2 unmodified lines
18	19	timeoutMs: v.optional(v.number()),
19	20	runtimeId: v.optional(v.string()),
20	21	metadata: v.optional(jsonObjectValidator),
21		− workspaceId: v.id("workspaces"),
	22	+ workspaceId: vv.id("workspaces"),
22	23	sessionId: v.optional(v.string()),
23		− accountId: v.optional(v.id("accounts")),
	24	+ accountId: v.optional(vv.id("accounts")),
24	25	waitForResult: v.optional(v.boolean()),
25	26	},
26	27	handler: async (ctx, args) => {
@@ -34,8 +35,8 @@ export const createTaskInternal = internalMutation({ · 7 unmodified lines
34	35	timeoutMs: v.optional(v.number()),
35	36	runtimeId: v.optional(v.string()),
36	37	metadata: v.optional(jsonObjectValidator),
37		− workspaceId: v.id("workspaces"),
38		− accountId: v.id("accounts"),
	38	+ workspaceId: vv.id("workspaces"),
	39	+ accountId: vv.id("accounts"),
39	40	clientId: v.optional(v.string()),
40	41	scheduleAfterCreate: v.optional(v.boolean()),
41	42	},
@@ -60,7 +61,7 @@ export const resolveApproval = workspaceMutation({ · 18 unmodified lines
60	61
61	62	export const resolveApprovalInternal = internalMutation({
62	63	args: {
63		− workspaceId: v.id("workspaces"),
	64	+ workspaceId: vv.id("workspaces"),
64	65	approvalId: v.string(),
65	66	decision: v.union(v.literal("approved"), v.literal("denied")),
66	67	reviewerId: v.optional(v.string()),

executor/packages/database/convex/executorNode.ts+19−18

@@ -26,6 +26,7 @@ import { previewOpenApiSourceUpgradeForContext, type OpenApiUpgradeDiffPreview } · 25 unmodified lines
26	26	import { getStorageProvider, type StorageEncoding, type StorageProvider } from "../src/runtime/storage_provider";
27	27	import { shouldTouchStorageOnRead } from "../src/runtime/storage_touch_policy";
28	28	import { shouldRefreshStorageUsage } from "../src/runtime/storage_usage_refresh";
	29	+import { vv } from "./typedV";
29	30
30	31	function isReadOnlySql(sql: string): boolean {
31	32	const trimmed = sql.trim().toLowerCase();
@@ -109,8 +110,8 @@ async function touchStorageInstance( · 77 unmodified lines
109	110	export const listToolsWithWarnings = customAction({
110	111	method: "POST",
111	112	args: {
112		− workspaceId: v.id("workspaces"),
113		− accountId: v.optional(v.id("accounts")),
	113	+ workspaceId: vv.id("workspaces"),
	114	+ accountId: v.optional(vv.id("accounts")),
114	115	sessionId: v.optional(v.string()),
115	116	includeDetails: v.optional(v.boolean()),
116	117	includeSourceMeta: v.optional(v.boolean()),
@@ -181,8 +182,8 @@ export const listToolsWithWarnings = customAction({ · 64 unmodified lines
181	182
182	183	export const listToolsInternal = internalAction({
183	184	args: {
184		− workspaceId: v.id("workspaces"),
185		− accountId: v.optional(v.id("accounts")),
	185	+ workspaceId: vv.id("workspaces"),
	186	+ accountId: v.optional(vv.id("accounts")),
186	187	clientId: v.optional(v.string()),
187	188	},
188	189	handler: async (ctx, args): Promise<ToolDescriptor[]> => {
@@ -192,8 +193,8 @@ export const listToolsInternal = internalAction({ · 3 unmodified lines
192	193
193	194	export const listToolsWithWarningsInternal = internalAction({
194	195	args: {
195		− workspaceId: v.id("workspaces"),
196		− accountId: v.optional(v.id("accounts")),
	196	+ workspaceId: vv.id("workspaces"),
	197	+ accountId: v.optional(vv.id("accounts")),
197	198	clientId: v.optional(v.string()),
198	199	},
199	200	handler: async (
@@ -215,8 +216,8 @@ export const listToolsWithWarningsInternal = internalAction({ · 15 unmodified lines
215	216
216	217	export const rebuildToolInventoryInternal = internalAction({
217	218	args: {
218		− workspaceId: v.id("workspaces"),
219		− accountId: v.optional(v.id("accounts")),
	219	+ workspaceId: vv.id("workspaces"),
	220	+ accountId: v.optional(vv.id("accounts")),
220	221	clientId: v.optional(v.string()),
221	222	},
222	223	handler: async (ctx, args): Promise<{ rebuilt: boolean }> => {
@@ -230,8 +231,8 @@ export const rebuildToolInventoryInternal = internalAction({ · 7 unmodified lines
230	231	export const previewOpenApiSourceUpgrade = customAction({
231	232	method: "POST",
232	233	args: {
233		− workspaceId: v.id("workspaces"),
234		− accountId: v.optional(v.id("accounts")),
	234	+ workspaceId: vv.id("workspaces"),
	235	+ accountId: v.optional(vv.id("accounts")),
235	236	sessionId: v.optional(v.string()),
236	237	sourceId: v.string(),
237	238	name: v.string(),
@@ -263,8 +264,8 @@ export const previewOpenApiSourceUpgrade = customAction({ · 25 unmodified lines
263	264	export const storageListDirectory = customAction({
264	265	method: "POST",
265	266	args: {
266		− workspaceId: v.id("workspaces"),
267		− accountId: v.optional(v.id("accounts")),
	267	+ workspaceId: vv.id("workspaces"),
	268	+ accountId: v.optional(vv.id("accounts")),
268	269	sessionId: v.optional(v.string()),
269	270	instanceId: v.string(),
270	271	path: v.optional(v.string()),
@@ -291,8 +292,8 @@ export const storageListDirectory = customAction({ · 20 unmodified lines
291	292	export const storageReadFile = customAction({
292	293	method: "POST",
293	294	args: {
294		− workspaceId: v.id("workspaces"),
295		− accountId: v.optional(v.id("accounts")),
	295	+ workspaceId: vv.id("workspaces"),
	296	+ accountId: v.optional(vv.id("accounts")),
296	297	sessionId: v.optional(v.string()),
297	298	instanceId: v.string(),
298	299	path: v.string(),
@@ -322,8 +323,8 @@ export const storageReadFile = customAction({ · 23 unmodified lines
322	323	export const storageListKv = customAction({
323	324	method: "POST",
324	325	args: {
325		− workspaceId: v.id("workspaces"),
326		− accountId: v.optional(v.id("accounts")),
	326	+ workspaceId: vv.id("workspaces"),
	327	+ accountId: v.optional(vv.id("accounts")),
327	328	sessionId: v.optional(v.string()),
328	329	instanceId: v.string(),
329	330	prefix: v.optional(v.string()),
@@ -353,8 +354,8 @@ export const storageListKv = customAction({ · 23 unmodified lines
353	354	export const storageQuerySql = customAction({
354	355	method: "POST",
355	356	args: {
356		− workspaceId: v.id("workspaces"),
357		− accountId: v.optional(v.id("accounts")),
	357	+ workspaceId: vv.id("workspaces"),
	358	+ accountId: v.optional(vv.id("accounts")),
358	359	sessionId: v.optional(v.string()),
359	360	instanceId: v.string(),
360	361	sql: v.string(),

executor/packages/database/convex/invites.ts+9−8

@@ -14,6 +14,7 @@ import { · 13 unmodified lines
14	14	} from "../src/invites/workos";
15	15	import { normalizePersonalOrganizationName } from "../src/invites/normalize";
16	16	import { safeRunAfter } from "../src/lib/scheduler";
	17	+import { vv } from "./typedV";
17	18
18	19	const organizationRoleValidator = v.union(
19	20	v.literal("owner"),
@@ -124,7 +125,7 @@ export const create = organizationMutation({ · 104 unmodified lines
124	125
125	126	export const deliverWorkosInvite = internalAction({
126	127	args: {
127		− inviteId: v.id("invites"),
	128	+ inviteId: vv.id("invites"),
128	129	inviterWorkosUserId: v.string(),
129	130	expiresInDays: v.optional(v.number()),
130	131	roleSlug: v.optional(v.string()),
@@ -192,7 +193,7 @@ export const revoke = organizationMutation({ · 61 unmodified lines
192	193	method: "POST",
193	194	requireAdmin: true,
194	195	args: {
195		− inviteId: v.id("invites"),
	196	+ inviteId: vv.id("invites"),
196	197	},
197	198	handler: async (ctx, args) => {
198	199	const invite = await ctx.db.get(args.inviteId);
@@ -222,7 +223,7 @@ export const revoke = organizationMutation({ · 23 unmodified lines
222	223
223	224	export const revokeWorkosInvite = internalAction({
224	225	args: {
225		− inviteId: v.id("invites"),
	226	+ inviteId: vv.id("invites"),
226	227	providerInviteId: v.string(),
227	228	},
228	229	handler: async (ctx, args) => {
@@ -239,7 +240,7 @@ export const revokeWorkosInvite = internalAction({ · 10 unmodified lines
239	240
240	241	export const getInviteDeliveryContext = internalQuery({
241	242	args: {
242		− inviteId: v.id("invites"),
	243	+ inviteId: vv.id("invites"),
243	244	},
244	245	handler: async (ctx, args) => {
245	246	const invite = await ctx.db.get(args.inviteId);
@@ -264,7 +265,7 @@ export const getInviteDeliveryContext = internalQuery({ · 18 unmodified lines
264	265
265	266	export const linkOrganizationToWorkos = internalMutation({
266	267	args: {
267		− organizationId: v.id("organizations"),
	268	+ organizationId: vv.id("organizations"),
268	269	workosOrgId: v.string(),
269	270	},
270	271	handler: async (ctx, args) => {
@@ -277,7 +278,7 @@ export const linkOrganizationToWorkos = internalMutation({ · 6 unmodified lines
277	278
278	279	export const getInviteById = internalQuery({
279	280	args: {
280		− inviteId: v.id("invites"),
	281	+ inviteId: vv.id("invites"),
281	282	},
282	283	handler: async (ctx, args) => {
283	284	return await ctx.db.get(args.inviteId);
@@ -286,7 +287,7 @@ export const getInviteById = internalQuery({ · 2 unmodified lines
286	287
287	288	export const markInviteDelivered = internalMutation({
288	289	args: {
289		− inviteId: v.id("invites"),
	290	+ inviteId: vv.id("invites"),
290	291	providerInviteId: v.string(),
291	292	},
292	293	handler: async (ctx, args) => {
@@ -304,7 +305,7 @@ export const markInviteDelivered = internalMutation({ · 11 unmodified lines
304	305
305	306	export const markInviteDeliveryFailed = internalMutation({
306	307	args: {
307		− inviteId: v.id("invites"),
	308	+ inviteId: vv.id("invites"),
308	309	errorMessage: v.string(),
309	310	},
310	311	handler: async (ctx, args) => {

executor/packages/database/convex/organizationMembers.ts+4−3

@@ -4,6 +4,7 @@ import { getOrganizationMembership } from "../../core/src/identity"; · 3 unmodified lines
4	4	import { organizationMutation, organizationQuery } from "../../core/src/function-builders";
5	5	import { upsertOrganizationMembership } from "../src/auth/memberships";
6	6	import { safeRunAfter } from "../src/lib/scheduler";
	7	+import { vv } from "./typedV";
7	8
8	9	const organizationRoleValidator = v.union(
9	10	v.literal("owner"),
@@ -46,7 +47,7 @@ export const list = organizationQuery({ · 36 unmodified lines
46	47	export const updateRole = organizationMutation({
47	48	method: "POST",
48	49	args: {
49		− accountId: v.id("accounts"),
	50	+ accountId: vv.id("accounts"),
50	51	role: organizationRoleValidator,
51	52	},
52	53	requireAdmin: true,
@@ -84,7 +85,7 @@ export const updateRole = organizationMutation({ · 31 unmodified lines
84	85	export const updateBillable = organizationMutation({
85	86	method: "POST",
86	87	args: {
87		− accountId: v.id("accounts"),
	88	+ accountId: vv.id("accounts"),
88	89	billable: v.boolean(),
89	90	},
90	91	requireBillingAdmin: true,
@@ -114,7 +115,7 @@ export const updateBillable = organizationMutation({ · 23 unmodified lines
114	115	export const remove = organizationMutation({
115	116	method: "POST",
116	117	args: {
117		− accountId: v.id("accounts"),
	118	+ accountId: vv.id("accounts"),
118	119	},
119	120	requireAdmin: true,
120	121	handler: async (ctx, args) => {

executor/packages/database/convex/organizations.ts+3−2

@@ -7,6 +7,7 @@ import { · 6 unmodified lines
7	7	listOrganizationsMineHandler,
8	8	resolveWorkosOrganizationIdHandler,
9	9	} from "../src/organizations/handlers";
	10	+import { vv } from "./typedV";
10	11
11	12	export const create = authedMutation({
12	13	method: "POST",
@@ -37,7 +38,7 @@ export const getNavigationState = optionalAccountQuery({ · 24 unmodified lines
37	38	export const getOrganizationAccess = optionalAccountQuery({
38	39	method: "GET",
39	40	args: {
40		− organizationId: v.id("organizations"),
	41	+ organizationId: vv.id("organizations"),
41	42	},
42	43	handler: async (ctx, args) => {
43	44	return await getOrganizationAccessHandler(ctx, args);
@@ -47,7 +48,7 @@ export const getOrganizationAccess = optionalAccountQuery({ · 3 unmodified lines
47	48	export const resolveWorkosOrganizationId = optionalAccountQuery({
48	49	method: "GET",
49	50	args: {
50		− organizationId: v.id("organizations"),
	51	+ organizationId: vv.id("organizations"),
51	52	},
52	53	handler: async (ctx, args) => {
53	54	return await resolveWorkosOrganizationIdHandler(ctx, args);

executor/packages/database/convex/runtimeCallbacks.ts+2−1

@@ -8,6 +8,7 @@ import { · 7 unmodified lines
8	8	handleToolCallHandler,
9	9	} from "../src/runtime-callbacks/handlers";
10	10	import { jsonObjectValidator } from "../src/database/validators";
	11	+import { vv } from "./typedV";
11	12
12	13	export const handleToolCall = customAction({
13	14	method: "POST",
@@ -55,7 +56,7 @@ export const getTaskWatchStatus = customQuery({ · 41 unmodified lines
55	56	args: {
56	57	internalSecret: v.string(),
57	58	runId: v.string(),
58		− workspaceId: v.id("workspaces"),
	59	+ workspaceId: vv.id("workspaces"),
59	60	},
60	61	handler: async (ctx, args) => {
61	62	return await getTaskWatchStatusHandler(ctx, internal, args);

executor/packages/database/convex/toolRegistry.ts+21−20

@@ -1,10 +1,11 @@
1	1	import { v } from "convex/values";
2	2	import { internal } from "./_generated/api";
3	3	import { internalAction, internalMutation, internalQuery } from "./_generated/server";
	4	+import { vv } from "./typedV";
4	5
5	6	export const getState = internalQuery({
6	7	args: {
7		− workspaceId: v.id("workspaces"),
	8	+ workspaceId: vv.id("workspaces"),
8	9	},
9	10	handler: async (ctx, args) => {
10	11	const entry = await ctx.db
@@ -40,7 +41,7 @@ export const getState = internalQuery({ · 29 unmodified lines
40	41
41	42	export const beginBuild = internalMutation({
42	43	args: {
43		− workspaceId: v.id("workspaces"),
	44	+ workspaceId: vv.id("workspaces"),
44	45	signature: v.string(),
45	46	buildId: v.string(),
46	47	},
@@ -88,7 +89,7 @@ export const beginBuild = internalMutation({ · 41 unmodified lines
88	89
89	90	export const putToolsBatch = internalMutation({
90	91	args: {
91		− workspaceId: v.id("workspaces"),
	92	+ workspaceId: vv.id("workspaces"),
92	93	buildId: v.string(),
93	94	tools: v.array(
94	95	v.object({
@@ -152,7 +153,7 @@ export const putToolsBatch = internalMutation({ · 57 unmodified lines
152	153
153	154	export const putNamespacesBatch = internalMutation({
154	155	args: {
155		− workspaceId: v.id("workspaces"),
	156	+ workspaceId: vv.id("workspaces"),
156	157	buildId: v.string(),
157	158	namespaces: v.array(
158	159	v.object({
@@ -179,7 +180,7 @@ export const putNamespacesBatch = internalMutation({ · 20 unmodified lines
179	180
180	181	export const finishBuild = internalMutation({
181	182	args: {
182		− workspaceId: v.id("workspaces"),
	183	+ workspaceId: vv.id("workspaces"),
183	184	buildId: v.string(),
184	185	signature: v.string(),
185	186	},
@@ -235,7 +236,7 @@ export const finishBuild = internalMutation({ · 49 unmodified lines
235	236
236	237	export const updateBuildMetadata = internalMutation({
237	238	args: {
238		− workspaceId: v.id("workspaces"),
	239	+ workspaceId: vv.id("workspaces"),
239	240	buildId: v.string(),
240	241	typesStorageId: v.optional(v.id("_storage")),
241	242	warnings: v.array(v.string()),
@@ -303,7 +304,7 @@ export const updateBuildMetadata = internalMutation({ · 61 unmodified lines
303	304
304	305	export const failBuild = internalMutation({
305	306	args: {
306		− workspaceId: v.id("workspaces"),
	307	+ workspaceId: vv.id("workspaces"),
307	308	buildId: v.string(),
308	309	error: v.optional(v.string()),
309	310	},
@@ -335,7 +336,7 @@ const PRUNE_NAMESPACE_SCAN_PAGE_SIZE = 250; · 25 unmodified lines
335	336
336	337	export const scanNamespaceBuildsForPrune = internalQuery({
337	338	args: {
338		− workspaceId: v.id("workspaces"),
	339	+ workspaceId: vv.id("workspaces"),
339	340	cursor: v.optional(v.string()),
340	341	},
341	342	handler: async (ctx, args) => {
@@ -356,7 +357,7 @@ export const scanNamespaceBuildsForPrune = internalQuery({ · 14 unmodified lines
356	357
357	358	export const deleteToolRegistryToolsPage = internalMutation({
358	359	args: {
359		− workspaceId: v.id("workspaces"),
	360	+ workspaceId: vv.id("workspaces"),
360	361	buildId: v.string(),
361	362	cursor: v.optional(v.string()),
362	363	},
@@ -376,7 +377,7 @@ export const deleteToolRegistryToolsPage = internalMutation({ · 13 unmodified lines
376	377
377	378	export const deleteToolRegistryPayloadsPage = internalMutation({
378	379	args: {
379		− workspaceId: v.id("workspaces"),
	380	+ workspaceId: vv.id("workspaces"),
380	381	buildId: v.string(),
381	382	cursor: v.optional(v.string()),
382	383	},
@@ -396,7 +397,7 @@ export const deleteToolRegistryPayloadsPage = internalMutation({ · 13 unmodified lines
396	397
397	398	export const deleteToolRegistryNamespacesPage = internalMutation({
398	399	args: {
399		− workspaceId: v.id("workspaces"),
	400	+ workspaceId: vv.id("workspaces"),
400	401	buildId: v.string(),
401	402	cursor: v.optional(v.string()),
402	403	},
@@ -416,7 +417,7 @@ export const deleteToolRegistryNamespacesPage = internalMutation({ · 13 unmodified lines
416	417
417	418	export const pruneBuilds = internalAction({
418	419	args: {
419		− workspaceId: v.id("workspaces"),
	420	+ workspaceId: vv.id("workspaces"),
420	421	maxRetainedBuilds: v.optional(v.number()),
421	422	},
422	423	handler: async (ctx, args) => {
@@ -528,7 +529,7 @@ export const pruneBuilds = internalAction({ · 105 unmodified lines
528	529
529	530	export const getToolByPath = internalQuery({
530	531	args: {
531		− workspaceId: v.id("workspaces"),
	532	+ workspaceId: vv.id("workspaces"),
532	533	buildId: v.string(),
533	534	path: v.string(),
534	535	},
@@ -569,7 +570,7 @@ export const getToolByPath = internalQuery({ · 34 unmodified lines
569	570
570	571	export const getSerializedToolsByPaths = internalQuery({
571	572	args: {
572		− workspaceId: v.id("workspaces"),
	573	+ workspaceId: vv.id("workspaces"),
573	574	buildId: v.string(),
574	575	paths: v.array(v.string()),
575	576	},
@@ -601,7 +602,7 @@ export const getSerializedToolsByPaths = internalQuery({ · 25 unmodified lines
601	602
602	603	export const listToolsByNamespace = internalQuery({
603	604	args: {
604		− workspaceId: v.id("workspaces"),
	605	+ workspaceId: vv.id("workspaces"),
605	606	buildId: v.string(),
606	607	namespace: v.string(),
607	608	limit: v.number(),
@@ -636,7 +637,7 @@ export const listToolsByNamespace = internalQuery({ · 28 unmodified lines
636	637
637	638	export const listToolsPage = internalQuery({
638	639	args: {
639		− workspaceId: v.id("workspaces"),
	640	+ workspaceId: vv.id("workspaces"),
640	641	buildId: v.string(),
641	642	cursor: v.optional(v.string()),
642	643	limit: v.number(),
@@ -674,7 +675,7 @@ export const listToolsPage = internalQuery({ · 31 unmodified lines
674	675
675	676	export const listToolsBySourcePage = internalQuery({
676	677	args: {
677		− workspaceId: v.id("workspaces"),
	678	+ workspaceId: vv.id("workspaces"),
678	679	buildId: v.string(),
679	680	source: v.string(),
680	681	cursor: v.optional(v.string()),
@@ -737,7 +738,7 @@ export const listToolsBySourcePage = internalQuery({ · 56 unmodified lines
737	738
738	739	export const getToolsByNormalizedPath = internalQuery({
739	740	args: {
740		− workspaceId: v.id("workspaces"),
	741	+ workspaceId: vv.id("workspaces"),
741	742	buildId: v.string(),
742	743	normalizedPath: v.string(),
743	744	limit: v.number(),
@@ -781,7 +782,7 @@ export const getToolsByNormalizedPath = internalQuery({ · 37 unmodified lines
781	782
782	783	export const searchTools = internalQuery({
783	784	args: {
784		− workspaceId: v.id("workspaces"),
	785	+ workspaceId: vv.id("workspaces"),
785	786	buildId: v.string(),
786	787	query: v.string(),
787	788	limit: v.number(),
@@ -818,7 +819,7 @@ export const searchTools = internalQuery({ · 30 unmodified lines
818	819
819	820	export const listNamespaces = internalQuery({
820	821	args: {
821		− workspaceId: v.id("workspaces"),
	822	+ workspaceId: vv.id("workspaces"),
822	823	buildId: v.string(),
823	824	limit: v.number(),
824	825	},

executor/packages/database/convex/typedV.ts+4−0

@@ -0,0 +1,4 @@
	1	+import { typedV } from "convex-helpers/validators";
	2	+import schema from "./schema";
	3	+
	4	+export const vv = typedV(schema);

executor/packages/database/convex/workspace.ts+10−8

@@ -3,6 +3,7 @@ import { internal } from "./_generated/api"; · 2 unmodified lines
3	3	import { customMutation, workspaceMutation, workspaceQuery } from "../../core/src/function-builders";
4	4	import { getOrganizationMembership, isAdminRole } from "../../core/src/identity";
5	5	import {
	6	+ argumentConditionValidator,
6	7	credentialProviderValidator,
7	8	credentialScopeTypeValidator,
8	9	jsonObjectValidator,
@@ -17,6 +18,7 @@ import { · 8 unmodified lines
17	18	toolSourceScopeTypeValidator,
18	19	toolSourceTypeValidator,
19	20	} from "../src/database/validators";
	21	+import { vv } from "./typedV";
20	22	import { safeRunAfter } from "../src/lib/scheduler";
21	23	import {
22	24	getWorkspaceInventoryProgressForContext,
@@ -111,6 +113,8 @@ export const listTasks = workspaceQuery({ · 88 unmodified lines
111	113	method: "GET",
112	114	args: {},
113	115	handler: async (ctx) => {
	116	+ // TODO(security): Revisit member-level visibility for task code/output
	117	+ // and provide redacted views by default outside admin contexts.
114	118	return await ctx.runQuery(internal.database.listTasks, {
115	119	workspaceId: ctx.workspaceId,
116	120	});
@@ -121,6 +125,8 @@ export const listPendingApprovals = workspaceQuery({ · 4 unmodified lines
121	125	method: "GET",
122	126	args: {},
123	127	handler: async (ctx) => {
	128	+ // TODO(security): Revisit member-level visibility for approval inputs,
	129	+ // which can include sensitive request payloads.
124	130	return await ctx.runQuery(internal.database.listPendingApprovals, {
125	131	workspaceId: ctx.workspaceId,
126	132	});
@@ -192,11 +198,7 @@ export const upsertToolPolicyRule = workspaceMutation({ · 65 unmodified lines
192	198	matchType: v.optional(policyMatchTypeValidator),
193	199	effect: v.optional(policyEffectValidator),
194	200	approvalMode: v.optional(policyApprovalModeValidator),
195		− argumentConditions: v.optional(v.array(v.object({
196		− key: v.string(),
197		− operator: v.union(v.literal("equals"), v.literal("contains"), v.literal("starts_with"), v.literal("not_equals")),
198		− value: v.string(),
199		− }))),
	201	+ argumentConditions: v.optional(v.array(argumentConditionValidator)),
200	202	priority: v.optional(v.number()),
201	203	},
202	204	handler: async (ctx, args) => {
@@ -244,7 +246,7 @@ export const upsertToolPolicyAssignment = workspaceMutation({ · 41 unmodified lines
244	246	id: v.optional(v.string()),
245	247	roleId: v.string(),
246	248	scopeType: v.optional(policyScopeTypeValidator),
247		− targetAccountId: v.optional(v.id("accounts")),
	249	+ targetAccountId: v.optional(vv.id("accounts")),
248	250	clientId: v.optional(v.string()),
249	251	status: v.optional(toolRoleBindingStatusValidator),
250	252	expiresAt: v.optional(v.number()),
@@ -292,7 +294,7 @@ export const upsertCredential = workspaceMutation({ · 41 unmodified lines
292	294	id: v.optional(v.string()),
293	295	scopeType: v.optional(credentialScopeTypeValidator),
294	296	sourceKey: v.string(),
295		− accountId: v.optional(v.id("accounts")),
	297	+ accountId: v.optional(vv.id("accounts")),
296	298	provider: v.optional(credentialProviderValidator),
297	299	secretJson: jsonObjectValidator,
298	300	overridesJson: v.optional(jsonObjectValidator),
@@ -342,7 +344,7 @@ export const resolveCredential = workspaceQuery({ · 43 unmodified lines
342	344	args: {
343	345	sourceKey: v.string(),
344	346	scopeType: credentialScopeTypeValidator,
345		− accountId: v.optional(v.id("accounts")),
	347	+ accountId: v.optional(vv.id("accounts")),
346	348	},
347	349	handler: async (ctx, args) => {
348	350	return await ctx.runQuery(internal.database.resolveCredential, {

executor/packages/database/convex/workspaceAuthInternal.ts+6−5

@@ -6,10 +6,11 @@ import { · 5 unmodified lines
6	6	resolveWorkosAccountBySubject,
7	7	} from "../../core/src/identity";
8	8	import type { Id } from "./_generated/dataModel.d.ts";
	9	+import { vv } from "./typedV";
9	10
10	11	export const getWorkspaceAccessForRequest = internalQuery({
11	12	args: {
12		− workspaceId: v.id("workspaces"),
	13	+ workspaceId: vv.id("workspaces"),
13	14	sessionId: v.optional(v.string()),
14	15	},
15	16	handler: async (ctx, args) => {
@@ -32,7 +33,7 @@ export const getWorkspaceAccessForRequest = internalQuery({ · 16 unmodified lines
32	33
33	34	export const getWorkspaceAccessForWorkosSubject = internalQuery({
34	35	args: {
35		− workspaceId: v.id("workspaces"),
	36	+ workspaceId: vv.id("workspaces"),
36	37	subject: v.string(),
37	38	},
38	39	handler: async (ctx, args) => {
@@ -55,7 +56,7 @@ export const getWorkspaceAccessForWorkosSubject = internalQuery({ · 16 unmodified lines
55	56
56	57	export const getWorkspaceAccessForAnonymousSubject = internalQuery({
57	58	args: {
58		− workspaceId: v.id("workspaces"),
	59	+ workspaceId: vv.id("workspaces"),
59	60	accountId: v.string(),
60	61	},
61	62	handler: async (ctx, args) => {
@@ -83,8 +84,8 @@ export const getWorkspaceAccessForAnonymousSubject = internalQuery({ · 21 unmodified lines
83	84
84	85	export const getWorkspaceAccessForAccount = internalQuery({
85	86	args: {
86		− workspaceId: v.id("workspaces"),
87		− accountId: v.id("accounts"),
	87	+ workspaceId: vv.id("workspaces"),
	88	+ accountId: vv.id("accounts"),
88	89	},
89	90	handler: async (ctx, args) => {
90	91	const account = await ctx.db.get(args.accountId);

executor/packages/database/convex/workspaces.ts+3−2

@@ -5,12 +5,13 @@ import { · 4 unmodified lines
5	5	generateWorkspaceIconUploadUrlHandler,
6	6	listWorkspacesHandler,
7	7	} from "../src/workspaces/handlers";
	8	+import { vv } from "./typedV";
8	9
9	10	export const create = authedMutation({
10	11	method: "POST",
11	12	args: {
12	13	name: v.string(),
13		− organizationId: v.optional(v.id("organizations")),
	14	+ organizationId: v.optional(vv.id("organizations")),
14	15	iconStorageId: v.optional(v.id("_storage")),
15	16	},
16	17	handler: async (ctx, args) => {
@@ -21,7 +22,7 @@ export const create = authedMutation({ · 4 unmodified lines
21	22	export const list = optionalAccountQuery({
22	23	method: "GET",
23	24	args: {
24		− organizationId: v.optional(v.id("organizations")),
	25	+ organizationId: v.optional(vv.id("organizations")),
25	26	},
26	27	handler: async (ctx, args) => {
27	28	return await listWorkspacesHandler(ctx, args);