Showing the changes to apps (2 of 13 files). Show all
Unified · Split
| @@ -42,6 +42,7 @@ import { · 41 unmodified lines | ||
| 42 | 42 | PluginsProvider, |
| 43 | 43 | collectTables, |
| 44 | 44 | } from "@executor-js/api/server"; |
| 45 | +import { googleCatalogOAuthScopesForPreset } from "@executor-js/plugin-openapi/providers/google"; | |
| 45 | 46 | import { makeDynamicWorkerExecutor } from "@executor-js/runtime-dynamic-worker"; |
| 46 | 47 | import type { AnyPlugin, FirstPartyOAuthClientConfig } from "@executor-js/sdk"; |
| 47 | 48 | |
| @@ -88,6 +89,17 @@ export const CloudPluginsProvider: Layer.Layer<PluginsProvider> = Layer.succeed( · 40 unmodified lines | ||
| 88 | 89 | */ |
| 89 | 90 | export const CLOUD_MOUNT_PREFIX = "/api" as const; |
| 90 | 91 | |
| 92 | +// Initial Google launch boundary. Calendar + Sheets are sensitive scopes but | |
| 93 | +// not restricted Workspace scopes; Gmail and account-wide Drive remain absent | |
| 94 | +// until their separate verification/security work is complete. The same scope | |
| 95 | +// source builds the catalog auth templates, preventing config drift. | |
| 96 | +const GOOGLE_FIRST_PARTY_ALLOWED_SCOPES: readonly string[] = [ | |
| 97 | + ...new Set([ | |
| 98 | + ...googleCatalogOAuthScopesForPreset("google-calendar"), | |
| 99 | + ...googleCatalogOAuthScopesForPreset("google-sheets"), | |
| 100 | + ]), | |
| 101 | +]; | |
| 102 | + | |
| 91 | 103 | // Executor-owned provider apps, enabled per provider by setting BOTH env vars |
| 92 | 104 | // (id + secret). Each provider-side registration must list |
| 93 | 105 | // `${VITE_PUBLIC_SITE_URL}/api/oauth/callback` as its callback; the org slug |
| @@ -119,6 +131,7 @@ const cloudFirstPartyOAuthClients = (): readonly FirstPartyOAuthClientConfig[] = · 25 unmodified lines | ||
| 119 | 131 | tokenUrl: "https://oauth2.googleapis.com/token", |
| 120 | 132 | clientId: env.FIRST_PARTY_GOOGLE_CLIENT_ID, |
| 121 | 133 | clientSecret: env.FIRST_PARTY_GOOGLE_CLIENT_SECRET, |
| 134 | + allowedScopes: GOOGLE_FIRST_PARTY_ALLOWED_SCOPES, | |
| 122 | 135 | }, |
| 123 | 136 | ] |
| 124 | 137 | : []), |
| @@ -53,6 +53,26 @@ import LegalLayout from "../components/LegalLayout.astro"; · 52 unmodified lines | ||
| 53 | 53 | a call, run code, or execute a workflow. |
| 54 | 54 | </p> |
| 55 | 55 | |
| 56 | + <h3>Google Workspace API data</h3> | |
| 57 | + <p> | |
| 58 | + If you connect a Google Workspace service, Executor uses the permissions you grant to perform the actions you | |
| 59 | + request through that integration. Depending on the service and permissions you choose, this may include accessing | |
| 60 | + or modifying Google Calendar events, Google Sheets spreadsheets, or other Google Workspace content. Executor stores | |
| 61 | + OAuth credentials and connection metadata so the integration can continue working, and processes Google Workspace | |
| 62 | + content when carrying out your requested tool calls and returning their results to you or the agent you directed to | |
| 63 | + make the call. | |
| 64 | + </p> | |
| 65 | + <p> | |
| 66 | + We do not use Google Workspace API data for advertising or to train generalized artificial-intelligence or | |
| 67 | + machine-learning models. We disclose it only as needed to provide the user-requested integration, operate and secure | |
| 68 | + the Services, comply with law, or as otherwise described in this Policy with the user's consent. | |
| 69 | + </p> | |
| 70 | + <p> | |
| 71 | + Executor's use and transfer of information received from Google Workspace APIs adheres to the | |
| 72 | + <a href="https://developers.google.com/terms/api-services-user-data-policy">Google API Services User Data Policy</a>, | |
| 73 | + including its Limited Use requirements. | |
| 74 | + </p> | |
| 75 | + | |
| 56 | 76 | <h3>Website inputs and support communications</h3> |
| 57 | 77 | <p> |
| 58 | 78 | If you submit a URL to our website's API detection tool, contact us by email, or otherwise communicate with us, |