Showing the changes to apps/cloud/src/engine/execution-stack.ts (1 of 13 files). Show all
Unified · Split
| @@ -42,6 +42,7 @@ import { · 41 unmodified lines | ||
| 42 | 42 | PluginsProvider, |
| 43 | 43 | collectTables, |
| 44 | 44 | } from "@executor-js/api/server"; |
| 45 | +import { googleCatalogOAuthScopesForPreset } from "@executor-js/plugin-openapi/providers/google"; | |
| 45 | 46 | import { makeDynamicWorkerExecutor } from "@executor-js/runtime-dynamic-worker"; |
| 46 | 47 | import type { AnyPlugin, FirstPartyOAuthClientConfig } from "@executor-js/sdk"; |
| 47 | 48 | |
| @@ -88,6 +89,17 @@ export const CloudPluginsProvider: Layer.Layer<PluginsProvider> = Layer.succeed( · 40 unmodified lines | ||
| 88 | 89 | */ |
| 89 | 90 | export const CLOUD_MOUNT_PREFIX = "/api" as const; |
| 90 | 91 | |
| 92 | +// Initial Google launch boundary. Calendar + Sheets are sensitive scopes but | |
| 93 | +// not restricted Workspace scopes; Gmail and account-wide Drive remain absent | |
| 94 | +// until their separate verification/security work is complete. The same scope | |
| 95 | +// source builds the catalog auth templates, preventing config drift. | |
| 96 | +const GOOGLE_FIRST_PARTY_ALLOWED_SCOPES: readonly string[] = [ | |
| 97 | + ...new Set([ | |
| 98 | + ...googleCatalogOAuthScopesForPreset("google-calendar"), | |
| 99 | + ...googleCatalogOAuthScopesForPreset("google-sheets"), | |
| 100 | + ]), | |
| 101 | +]; | |
| 102 | + | |
| 91 | 103 | // Executor-owned provider apps, enabled per provider by setting BOTH env vars |
| 92 | 104 | // (id + secret). Each provider-side registration must list |
| 93 | 105 | // `${VITE_PUBLIC_SITE_URL}/api/oauth/callback` as its callback; the org slug |
| @@ -119,6 +131,7 @@ const cloudFirstPartyOAuthClients = (): readonly FirstPartyOAuthClientConfig[] = · 25 unmodified lines | ||
| 119 | 131 | tokenUrl: "https://oauth2.googleapis.com/token", |
| 120 | 132 | clientId: env.FIRST_PARTY_GOOGLE_CLIENT_ID, |
| 121 | 133 | clientSecret: env.FIRST_PARTY_GOOGLE_CLIENT_SECRET, |
| 134 | + allowedScopes: GOOGLE_FIRST_PARTY_ALLOWED_SCOPES, | |
| 122 | 135 | }, |
| 123 | 136 | ] |
| 124 | 137 | : []), |