Move product access rules out of the SDK

Rhys Sullivan committed 1 month ago

Commit c676e561 parent a72e51d161 files · +3935 −867Browse files

Showing the changes to apps/cloud/src (5 of 161 files). Show all

Unified · Split

5 files

@@ -17,7 +17,7 @@ · 16 unmodified lines
17	// acting member, and this plane deliberately serves the whole tenant.	17	// acting member, and this plane deliberately serves the whole tenant.
18	//	18	//
19	// The executor is built by `makePlatformExecutor` — `{ tenant, subject:	19	// The executor is built by `makePlatformExecutor` — `{ tenant, subject:
20	// undefined, platformView: true }` — so the reads are tenant-wide and read-only	20	// undefined, access: platformObserverAccess() }` — so the reads are tenant-wide and read-only
21	// by storage policy, and no `subject` row is minted for the caller.	21	// by storage policy, and no `subject` row is minted for the caller.
22	//	22	//
23	// Cross-tenant isolation is structural, not a check in this file: the tenant is	23	// Cross-tenant isolation is structural, not a check in this file: the tenant is

@@ -174,7 +174,7 @@ const resolveJwtPrincipal = (token: string, jwt: JwtBearerConfig) => · 173 unmodified lines
174	* `subject: null` + the read-only tenant reach rather than inventing a subject.	174	* `subject: null` + the read-only tenant reach rather than inventing a subject.
175	*	175	*
176	* The `/admin/*` mount turns this into an executor with `{ tenant:	176	* The `/admin/*` mount turns this into an executor with `{ tenant:
177	* organizationId, subject: undefined, platformView: true }`.	177	* organizationId, subject: undefined, access: platformObserverAccess() }`.
178	*/	178	*/
179	export interface PlatformAuth {	179	export interface PlatformAuth {
180	readonly kind: "platform";	180	readonly kind: "platform";

 import executorConfig from "../executor.config";
 import { DbService } from "./db/db";
 import { createDrizzleFumaDb } from "./db/fuma";
+import { testAccess } from "@executor-js/product-access/testing";
 // ---------------------------------------------------------------------------
 // Test-only plugin: exposes one in-memory tool that elicits once. Lets the
       plugins,
       httpClientLayer: FetchHttpClient.layer,
       onElicitation: "accept-all",
+      access: testAccess.member(),
     });
   });

 } from "@executor-js/host-mcp/tool-server";
 import { buildResumeApprovalUrl } from "@executor-js/host-mcp/browser-approval";
 import { artifactUrlFor } from "@executor-js/host-mcp/create-artifact";
+import { requestBoundMemberAccess } from "@executor-js/product-access";
 import { makeAssetsShellHtmlLoader } from "@executor-js/mcp-apps-shell/worker";
 import { smokeRenderArtifact } from "@executor-js/mcp-apps-shell/smoke-render";
 import {
         sessionMeta.organizationName,
         {
           mcpResource: sessionMeta.resource,
-          orgWrites: "request",
+          access: requestBoundMemberAccess(),
         },
       ).pipe(
         // The metered stack tracks each execution to Autumn. It requires

 import { makeTestConfig } from "@executor-js/sdk/testing";
 import { UrlRedactingSpanProcessor } from "./redact-span-urls";
+import { testAccess } from "@executor-js/product-access/testing";
 // Synthetic placeholders — never a real authorization code or CSRF state.
 const CODE = "synthetic-authorization-code-9f2c";
   it.effect("exports no span attribute containing the authorization code or state", () =>
     Effect.gen(function* () {
       const { exporter, provider, tracerLayer } = makeTracing();
-      const executor = yield* createExecutor(makeTestConfig({}));
+      const executor = yield* createExecutor(makeTestConfig({ access: testAccess.member() }));
       const web = yield* Effect.acquireRelease(
         Effect.sync(() =>