History

Launch built-in Google OAuth for Calendar and Sheets

Rhys Sullivan committed 2 months ago

Commit ac3bea51 parent 67ee8a013 files · +313 −10Browse files

Showing the changes to apps/cloud/src/engine/execution-stack.ts (1 of 13 files). Show all

Unified · Split

apps/cloud/src/engine/execution-stack.ts+13−0
@@ -42,6 +42,7 @@ import { · 41 unmodified lines
42 PluginsProvider,42 PluginsProvider,
43 collectTables,43 collectTables,
44} from "@executor-js/api/server";44} from "@executor-js/api/server";
45import { googleCatalogOAuthScopesForPreset } from "@executor-js/plugin-openapi/providers/google";
45import { makeDynamicWorkerExecutor } from "@executor-js/runtime-dynamic-worker";46import { makeDynamicWorkerExecutor } from "@executor-js/runtime-dynamic-worker";
46import type { AnyPlugin, FirstPartyOAuthClientConfig } from "@executor-js/sdk";47import type { AnyPlugin, FirstPartyOAuthClientConfig } from "@executor-js/sdk";
47 48
@@ -88,6 +89,17 @@ export const CloudPluginsProvider: Layer.Layer<PluginsProvider> = Layer.succeed( · 40 unmodified lines
88 */89 */
89export const CLOUD_MOUNT_PREFIX = "/api" as const;90export const CLOUD_MOUNT_PREFIX = "/api" as const;
90 91
92// Initial Google launch boundary. Calendar + Sheets are sensitive scopes but
93// not restricted Workspace scopes; Gmail and account-wide Drive remain absent
94// until their separate verification/security work is complete. The same scope
95// source builds the catalog auth templates, preventing config drift.
96const GOOGLE_FIRST_PARTY_ALLOWED_SCOPES: readonly string[] = [
97 ...new Set([
98 ...googleCatalogOAuthScopesForPreset("google-calendar"),
99 ...googleCatalogOAuthScopesForPreset("google-sheets"),
100 ]),
101];
102
91// Executor-owned provider apps, enabled per provider by setting BOTH env vars103// Executor-owned provider apps, enabled per provider by setting BOTH env vars
92// (id + secret). Each provider-side registration must list104// (id + secret). Each provider-side registration must list
93// `${VITE_PUBLIC_SITE_URL}/api/oauth/callback` as its callback; the org slug105// `${VITE_PUBLIC_SITE_URL}/api/oauth/callback` as its callback; the org slug
@@ -119,6 +131,7 @@ const cloudFirstPartyOAuthClients = (): readonly FirstPartyOAuthClientConfig[] = · 25 unmodified lines
119 tokenUrl: "https://oauth2.googleapis.com/token",131 tokenUrl: "https://oauth2.googleapis.com/token",
120 clientId: env.FIRST_PARTY_GOOGLE_CLIENT_ID,132 clientId: env.FIRST_PARTY_GOOGLE_CLIENT_ID,
121 clientSecret: env.FIRST_PARTY_GOOGLE_CLIENT_SECRET,133 clientSecret: env.FIRST_PARTY_GOOGLE_CLIENT_SECRET,
134 allowedScopes: GOOGLE_FIRST_PARTY_ALLOWED_SCOPES,
122 },135 },
123 ]136 ]
124 : []),137 : []),