Showing the changes to apps/cloud/src (5 of 161 files). Show all
Unified · Split
| @@ -17,7 +17,7 @@ · 16 unmodified lines | ||
| 17 | 17 | // acting member, and this plane deliberately serves the whole tenant. |
| 18 | 18 | // |
| 19 | 19 | // The executor is built by `makePlatformExecutor` — `{ tenant, subject: |
| 20 | −// undefined, platformView: true }` — so the reads are tenant-wide and read-only | |
| 20 | +// undefined, access: platformObserverAccess() }` — so the reads are tenant-wide and read-only | |
| 21 | 21 | // by storage policy, and no `subject` row is minted for the caller. |
| 22 | 22 | // |
| 23 | 23 | // Cross-tenant isolation is structural, not a check in this file: the tenant is |
| @@ -174,7 +174,7 @@ const resolveJwtPrincipal = (token: string, jwt: JwtBearerConfig) => · 173 unmodified lines | ||
| 174 | 174 | * `subject: null` + the read-only tenant reach rather than inventing a subject. |
| 175 | 175 | * |
| 176 | 176 | * The `/admin/*` mount turns this into an executor with `{ tenant: |
| 177 | − * organizationId, subject: undefined, platformView: true }`. | |
| 177 | + * organizationId, subject: undefined, access: platformObserverAccess() }`. | |
| 178 | 178 | */ |
| 179 | 179 | export interface PlatformAuth { |
| 180 | 180 | readonly kind: "platform"; |
| @@ -39,6 +39,7 @@ import { makeTestWorkOSVaultClient } from "@executor-js/plugin-workos-vault/test · 38 unmodified lines | ||
| 39 | 39 | import executorConfig from "../executor.config"; |
| 40 | 40 | import { DbService } from "./db/db"; |
| 41 | 41 | import { createDrizzleFumaDb } from "./db/fuma"; |
| 42 | +import { testAccess } from "@executor-js/product-access/testing"; | |
| 42 | 43 | |
| 43 | 44 | // --------------------------------------------------------------------------- |
| 44 | 45 | // Test-only plugin: exposes one in-memory tool that elicits once. Lets the |
| @@ -124,6 +125,7 @@ const buildScopedExecutor = ( · 79 unmodified lines | ||
| 124 | 125 | plugins, |
| 125 | 126 | httpClientLayer: FetchHttpClient.layer, |
| 126 | 127 | onElicitation: "accept-all", |
| 128 | + access: testAccess.member(), | |
| 127 | 129 | }); |
| 128 | 130 | }); |
| 129 | 131 | |
| @@ -26,6 +26,7 @@ import { · 25 unmodified lines | ||
| 26 | 26 | } from "@executor-js/host-mcp/tool-server"; |
| 27 | 27 | import { buildResumeApprovalUrl } from "@executor-js/host-mcp/browser-approval"; |
| 28 | 28 | import { artifactUrlFor } from "@executor-js/host-mcp/create-artifact"; |
| 29 | +import { requestBoundMemberAccess } from "@executor-js/product-access"; | |
| 29 | 30 | import { makeAssetsShellHtmlLoader } from "@executor-js/mcp-apps-shell/worker"; |
| 30 | 31 | import { smokeRenderArtifact } from "@executor-js/mcp-apps-shell/smoke-render"; |
| 31 | 32 | import { |
| @@ -349,7 +350,7 @@ export class McpSessionDOSqlite extends McpAgentSessionDOBase<Env, CloudSessionD · 317 unmodified lines | ||
| 349 | 350 | sessionMeta.organizationName, |
| 350 | 351 | { |
| 351 | 352 | mcpResource: sessionMeta.resource, |
| 352 | − orgWrites: "request", | |
| 353 | + access: requestBoundMemberAccess(), | |
| 353 | 354 | }, |
| 354 | 355 | ).pipe( |
| 355 | 356 | // The metered stack tracks each execution to Autumn. It requires |
| @@ -32,6 +32,7 @@ import { createExecutor } from "@executor-js/sdk"; · 31 unmodified lines | ||
| 32 | 32 | import { makeTestConfig } from "@executor-js/sdk/testing"; |
| 33 | 33 | |
| 34 | 34 | import { UrlRedactingSpanProcessor } from "./redact-span-urls"; |
| 35 | +import { testAccess } from "@executor-js/product-access/testing"; | |
| 35 | 36 | |
| 36 | 37 | // Synthetic placeholders — never a real authorization code or CSRF state. |
| 37 | 38 | const CODE = "synthetic-authorization-code-9f2c"; |
| @@ -55,7 +56,7 @@ describe("oauth callback telemetry", () => { · 17 unmodified lines | ||
| 55 | 56 | it.effect("exports no span attribute containing the authorization code or state", () => |
| 56 | 57 | Effect.gen(function* () { |
| 57 | 58 | const { exporter, provider, tracerLayer } = makeTracing(); |
| 58 | − const executor = yield* createExecutor(makeTestConfig({})); | |
| 59 | + const executor = yield* createExecutor(makeTestConfig({ access: testAccess.member() })); | |
| 59 | 60 | |
| 60 | 61 | const web = yield* Effect.acquireRelease( |
| 61 | 62 | Effect.sync(() => |