Showing the changes to apps (2 of 13 files). Show all
Unified · Split
| @@ -42,6 +42,7 @@ import { · 41 unmodified lines | |||
| 42 | PluginsProvider, | 42 | PluginsProvider, |
| 43 | collectTables, | 43 | collectTables, |
| 44 | } from "@executor-js/api/server"; | 44 | } from "@executor-js/api/server"; |
| 45 | import { googleCatalogOAuthScopesForPreset } from "@executor-js/plugin-openapi/providers/google"; | ||
| 45 | import { makeDynamicWorkerExecutor } from "@executor-js/runtime-dynamic-worker"; | 46 | import { makeDynamicWorkerExecutor } from "@executor-js/runtime-dynamic-worker"; |
| 46 | import type { AnyPlugin, FirstPartyOAuthClientConfig } from "@executor-js/sdk"; | 47 | import type { AnyPlugin, FirstPartyOAuthClientConfig } from "@executor-js/sdk"; |
| 47 | 48 | ||
| @@ -88,6 +89,17 @@ export const CloudPluginsProvider: Layer.Layer<PluginsProvider> = Layer.succeed( · 40 unmodified lines | |||
| 88 | */ | 89 | */ |
| 89 | export const CLOUD_MOUNT_PREFIX = "/api" as const; | 90 | export const CLOUD_MOUNT_PREFIX = "/api" as const; |
| 90 | 91 | ||
| 92 | // Initial Google launch boundary. Calendar + Sheets are sensitive scopes but | ||
| 93 | // not restricted Workspace scopes; Gmail and account-wide Drive remain absent | ||
| 94 | // until their separate verification/security work is complete. The same scope | ||
| 95 | // source builds the catalog auth templates, preventing config drift. | ||
| 96 | const GOOGLE_FIRST_PARTY_ALLOWED_SCOPES: readonly string[] = [ | ||
| 97 | ...new Set([ | ||
| 98 | ...googleCatalogOAuthScopesForPreset("google-calendar"), | ||
| 99 | ...googleCatalogOAuthScopesForPreset("google-sheets"), | ||
| 100 | ]), | ||
| 101 | ]; | ||
| 102 | |||
| 91 | // Executor-owned provider apps, enabled per provider by setting BOTH env vars | 103 | // Executor-owned provider apps, enabled per provider by setting BOTH env vars |
| 92 | // (id + secret). Each provider-side registration must list | 104 | // (id + secret). Each provider-side registration must list |
| 93 | // `${VITE_PUBLIC_SITE_URL}/api/oauth/callback` as its callback; the org slug | 105 | // `${VITE_PUBLIC_SITE_URL}/api/oauth/callback` as its callback; the org slug |
| @@ -119,6 +131,7 @@ const cloudFirstPartyOAuthClients = (): readonly FirstPartyOAuthClientConfig[] = · 25 unmodified lines | |||
| 119 | tokenUrl: "https://oauth2.googleapis.com/token", | 131 | tokenUrl: "https://oauth2.googleapis.com/token", |
| 120 | clientId: env.FIRST_PARTY_GOOGLE_CLIENT_ID, | 132 | clientId: env.FIRST_PARTY_GOOGLE_CLIENT_ID, |
| 121 | clientSecret: env.FIRST_PARTY_GOOGLE_CLIENT_SECRET, | 133 | clientSecret: env.FIRST_PARTY_GOOGLE_CLIENT_SECRET, |
| 134 | allowedScopes: GOOGLE_FIRST_PARTY_ALLOWED_SCOPES, | ||
| 122 | }, | 135 | }, |
| 123 | ] | 136 | ] |
| 124 | : []), | 137 | : []), |
| @@ -53,6 +53,26 @@ import LegalLayout from "../components/LegalLayout.astro"; · 52 unmodified lines | |||
| 53 | a call, run code, or execute a workflow. | 53 | a call, run code, or execute a workflow. |
| 54 | </p> | 54 | </p> |
| 55 | 55 | ||
| 56 | <h3>Google Workspace API data</h3> | ||
| 57 | <p> | ||
| 58 | If you connect a Google Workspace service, Executor uses the permissions you grant to perform the actions you | ||
| 59 | request through that integration. Depending on the service and permissions you choose, this may include accessing | ||
| 60 | or modifying Google Calendar events, Google Sheets spreadsheets, or other Google Workspace content. Executor stores | ||
| 61 | OAuth credentials and connection metadata so the integration can continue working, and processes Google Workspace | ||
| 62 | content when carrying out your requested tool calls and returning their results to you or the agent you directed to | ||
| 63 | make the call. | ||
| 64 | </p> | ||
| 65 | <p> | ||
| 66 | We do not use Google Workspace API data for advertising or to train generalized artificial-intelligence or | ||
| 67 | machine-learning models. We disclose it only as needed to provide the user-requested integration, operate and secure | ||
| 68 | the Services, comply with law, or as otherwise described in this Policy with the user's consent. | ||
| 69 | </p> | ||
| 70 | <p> | ||
| 71 | Executor's use and transfer of information received from Google Workspace APIs adheres to the | ||
| 72 | <a href="https://developers.google.com/terms/api-services-user-data-policy">Google API Services User Data Policy</a>, | ||
| 73 | including its Limited Use requirements. | ||
| 74 | </p> | ||
| 75 | |||
| 56 | <h3>Website inputs and support communications</h3> | 76 | <h3>Website inputs and support communications</h3> |
| 57 | <p> | 77 | <p> |
| 58 | If you submit a URL to our website's API detection tool, contact us by email, or otherwise communicate with us, | 78 | If you submit a URL to our website's API detection tool, contact us by email, or otherwise communicate with us, |