mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-06 10:48:12 +02:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - The Apps subsystem connects company tools through governed provider connections. > - A company can need more than one account for the same provider. > - The current database constraint and Apps flow assume one named connection per company. > - New quarantined actions also need an explicit review decision before activation. > - This pull request supports multiple provider connections and complete action review decisions. > - The benefit is safer access control and a clear multi-account Apps workflow. ## Linked Issues or Issue Description Refs: #11040 **Subsystem affected** Cross-cutting. This change affects the Apps UI, the tool access API, the shared request contract, and the database schema. **Problem or motivation** The connection name constraint prevents a company from keeping more than one connection for a provider. The Apps UI also reuses an existing OAuth connection when a user asks to connect another account. Action review can enable selected entries without recording a decision for every quarantined action. **Proposed solution** Remove the company and connection name uniqueness constraint. Let users open, count, edit, and create multiple provider connections. Require the finish request to cover every quarantined action exactly once before the server activates reviewed entries. **Alternatives considered** The UI could generate unique internal names and keep the database constraint. This would preserve a one-connection assumption in the data model and would make display names part of identity. The server could also infer review decisions from enabled actions. This would not distinguish a reviewed disabled action from an action that the user did not review. **Roadmap alignment** This change extends the completed MCP Tool Gateway and Apps milestone. It also supports the Connected Apps roadmap item. It follows the navigation and connection management work in #11040. ## What Changed - Remove the company-scoped connection name uniqueness index with an ordered and idempotent migration. - Add a reviewed action list to the finish-app contract and reject incomplete or duplicate review decisions. - Activate reviewed entries and keep unreviewed quarantined entries blocked. - Enable a completed connection and preserve the company and connection scope in all updates. - Show provider connection counts and open the provider setup page from Browse. - Let users edit existing connections or connect another account without reusing an active OAuth connection. - Update focused server and UI coverage for multiple connections and action review. ## Verification - Ran the focused Apps UI suite. All 116 tests passed in 11 files. - Ran the focused server and CLI suite. All 276 tests passed in 3 files. - Ran `pnpm --filter @paperclipai/db check:migrations`. The migration safety check passed. - Ran `pnpm -r typecheck`. All projects passed. - Ran `pnpm build`. All projects built successfully. - Ran `pnpm test:run`. It passed 3,735 tests and skipped 4 tests. One worktree-safety assertion failed because the execution workspace reloads its worktree marker. The same test passed with an isolated non-worktree marker. - Ran `pnpm check:token-gates`. It reports 12 existing violations in the unchanged `PaperclipOrbit3D.tsx` file from the target branch. - Started the six affected Playwright specifications. Chromium could not start because the host does not provide `libatk-1.0.so.0`. The GitHub e2e jobs will verify these specifications. - GitHub Actions passed every final-head CI gate, including all three e2e shards and the aggregate `e2e` and `verify` jobs. - Greptile reviewed final commit `9af9200426` at 5/5 with zero review threads. ## Risks - Removing the name uniqueness index permits duplicate display names. Stable connection IDs and UIDs remain unique within a company. - The finish-app endpoint accepts the new review field as optional for backward compatibility. When clients send it, the server requires a complete decision for all quarantined actions. - Multiple OAuth connections depend on the explicit new-connection route flag. Focused tests cover active and draft connection reuse. - The migration is ordered after migration 0210. Its `DROP INDEX IF EXISTS` statement is safe to repeat. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used OpenAI Codex with the `gpt-5.6-sol` model assisted this change. The agent used repository tools, code execution, test execution, and agentic reasoning. The Codex runtime manages the context window. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
315 lines
11 KiB
TypeScript
315 lines
11 KiB
TypeScript
import { useState } from "react";
|
|
import type { ToolCatalogEntry, ToolConnection } from "@paperclipai/shared";
|
|
import { Button } from "@/components/ui/button";
|
|
import { Input } from "@/components/ui/input";
|
|
import { ToggleSwitch } from "@/components/ui/toggle-switch";
|
|
import { appDefinitionSlug } from "../app-definition-display";
|
|
import type { AppDetailSectionProps } from "./types";
|
|
import { googleSheetsConfigWithAllowlist, parseGoogleSheetIds } from "../google-sheets";
|
|
|
|
export function SetupPanel({
|
|
connection,
|
|
galleryEntry,
|
|
onToggleApp,
|
|
appToggleDisabled,
|
|
onUpdateConfig,
|
|
configUpdateDisabled,
|
|
onStartOAuth,
|
|
oauthStartDisabled,
|
|
}: Pick<
|
|
AppDetailSectionProps,
|
|
"connection" | "galleryEntry"
|
|
> & {
|
|
onToggleApp: () => void;
|
|
appToggleDisabled: boolean;
|
|
onUpdateConfig: (config: Record<string, unknown>) => void;
|
|
configUpdateDisabled: boolean;
|
|
onStartOAuth: () => void;
|
|
oauthStartDisabled: boolean;
|
|
}) {
|
|
const description = galleryEntry?.description ?? null;
|
|
const oauth = connection.config?.oauth;
|
|
const hasOAuthSignIn = Boolean(oauth && typeof oauth === "object" && !Array.isArray(oauth));
|
|
const isSmokeLabFixture = connection.config?.smokeLabFixture === "oauth-http";
|
|
return (
|
|
<div className="space-y-6">
|
|
{description && (
|
|
<p className="max-w-2xl text-sm leading-6 text-muted-foreground">{description}</p>
|
|
)}
|
|
{appDefinitionSlug(galleryEntry) === "google-sheets" && (
|
|
<GoogleSheetsAllowlistSection
|
|
connection={connection}
|
|
disabled={configUpdateDisabled}
|
|
onUpdateConfig={onUpdateConfig}
|
|
/>
|
|
)}
|
|
{hasOAuthSignIn && (
|
|
<OAuthConnectionSection
|
|
connected={Boolean((oauth as Record<string, unknown>).connectedAt)}
|
|
providerName={appDefinitionSlug(galleryEntry) === "notion" ? "Notion" : isSmokeLabFixture ? "Smoke OAuth" : "OAuth"}
|
|
disabled={oauthStartDisabled}
|
|
onStart={onStartOAuth}
|
|
/>
|
|
)}
|
|
<AppLifecycleSection connection={connection} disabled={appToggleDisabled} onToggle={onToggleApp} />
|
|
</div>
|
|
);
|
|
}
|
|
|
|
function OAuthConnectionSection({
|
|
connected,
|
|
providerName,
|
|
disabled,
|
|
onStart,
|
|
}: {
|
|
connected: boolean;
|
|
providerName: string;
|
|
disabled: boolean;
|
|
onStart: () => void;
|
|
}) {
|
|
return (
|
|
<section className="rounded-xl border border-border bg-card px-5 py-4">
|
|
<div className="flex flex-wrap items-center justify-between gap-4">
|
|
<div>
|
|
<h2 className="text-sm font-bold text-foreground">
|
|
{connected ? `${providerName} connected` : `Connect with ${providerName}`}
|
|
</h2>
|
|
<p className="mt-0.5 text-sm text-muted-foreground">
|
|
{connected
|
|
? "Your workspace authorization is active. Reconnect any time to replace it."
|
|
: "Open the provider's consent page to finish connecting this app."}
|
|
</p>
|
|
</div>
|
|
<Button type="button" disabled={disabled} onClick={onStart}>
|
|
{connected ? "Reconnect" : `Connect with ${providerName}`}
|
|
</Button>
|
|
</div>
|
|
</section>
|
|
);
|
|
}
|
|
|
|
function currentSpreadsheetIds(connection: ToolConnection): string[] {
|
|
const raw = connection.config?.allowedSpreadsheetIds;
|
|
return Array.isArray(raw) ? raw.map((value) => String(value).trim()).filter(Boolean) : [];
|
|
}
|
|
|
|
function googleSheetsUrlForId(id: string): string {
|
|
return `https://docs.google.com/spreadsheets/d/${encodeURIComponent(id)}/edit`;
|
|
}
|
|
|
|
function GoogleSheetsAllowlistSection({
|
|
connection,
|
|
disabled,
|
|
onUpdateConfig,
|
|
}: {
|
|
connection: ToolConnection;
|
|
disabled: boolean;
|
|
onUpdateConfig: (config: Record<string, unknown>) => void;
|
|
}) {
|
|
const [draft, setDraft] = useState("");
|
|
const [error, setError] = useState<string | null>(null);
|
|
const ids = currentSpreadsheetIds(connection);
|
|
const saveIds = (nextIds: string[]) =>
|
|
onUpdateConfig(googleSheetsConfigWithAllowlist(connection.config, nextIds));
|
|
|
|
return (
|
|
<section className="rounded-xl border border-border bg-card px-5 py-4">
|
|
<div>
|
|
<h2 className="text-sm font-bold text-foreground">Sheets agents can use</h2>
|
|
<p className="mt-0.5 text-sm text-muted-foreground">
|
|
Agents can only use the sheets listed here.
|
|
</p>
|
|
</div>
|
|
|
|
<div className="mt-4 space-y-2">
|
|
{ids.length === 0 ? (
|
|
<div className="text-sm text-muted-foreground">No sheets are connected yet.</div>
|
|
) : (
|
|
ids.map((id) => {
|
|
const sheetUrl = googleSheetsUrlForId(id);
|
|
return (
|
|
<div key={id} className="flex items-center gap-3 border-t border-border py-2 first:border-t-0">
|
|
<a
|
|
href={sheetUrl}
|
|
target="_blank"
|
|
rel="noreferrer"
|
|
className="min-w-0 flex-1 text-sm font-medium text-foreground underline-offset-2 hover:underline"
|
|
>
|
|
<span className="block truncate">Open sheet</span>
|
|
<span className="block truncate font-mono text-xs font-normal text-muted-foreground">
|
|
{sheetUrl}
|
|
</span>
|
|
<span className="block truncate font-mono text-(length:--text-micro) font-normal text-muted-foreground/80">
|
|
ID: {id}
|
|
</span>
|
|
</a>
|
|
<Button
|
|
type="button"
|
|
size="sm"
|
|
variant="outline"
|
|
disabled={disabled || ids.length <= 1}
|
|
title={ids.length <= 1 ? "Add another sheet before removing this one." : undefined}
|
|
onClick={() => saveIds(ids.filter((current) => current !== id))}
|
|
>
|
|
Remove
|
|
</Button>
|
|
</div>
|
|
);
|
|
})
|
|
)}
|
|
</div>
|
|
|
|
<div className="mt-4 flex flex-col gap-2 sm:flex-row">
|
|
<Input
|
|
value={draft}
|
|
onChange={(event) => {
|
|
setDraft(event.target.value);
|
|
setError(null);
|
|
}}
|
|
placeholder="https://docs.google.com/spreadsheets/d/..."
|
|
className="h-10"
|
|
/>
|
|
<Button
|
|
type="button"
|
|
variant="outline"
|
|
disabled={disabled}
|
|
onClick={() => {
|
|
const parsed = parseGoogleSheetIds(draft);
|
|
if (parsed.ids.length === 0) {
|
|
setError("Paste a Google Sheets link.");
|
|
return;
|
|
}
|
|
if (parsed.invalidCount > 0) {
|
|
setError("That doesn't look like a Google Sheets link.");
|
|
return;
|
|
}
|
|
saveIds(Array.from(new Set([...ids, ...parsed.ids])));
|
|
setDraft("");
|
|
}}
|
|
>
|
|
Add sheet
|
|
</Button>
|
|
</div>
|
|
{error && <div className="mt-2 text-xs text-destructive">{error}</div>}
|
|
</section>
|
|
);
|
|
}
|
|
|
|
export function AppLifecycleSection({
|
|
connection,
|
|
disabled,
|
|
onToggle,
|
|
}: {
|
|
connection: ToolConnection;
|
|
disabled: boolean;
|
|
onToggle: () => void;
|
|
}) {
|
|
const enabled = connection.enabled !== false && connection.status !== "disabled";
|
|
return (
|
|
<section className="rounded-xl border border-border bg-card px-5 py-4">
|
|
<div className="flex items-center justify-between gap-4">
|
|
<div>
|
|
<h2 className="text-sm font-bold text-foreground">
|
|
{enabled ? "Agents can use this app" : "This app is paused"}
|
|
</h2>
|
|
<p className="mt-0.5 text-sm text-muted-foreground">
|
|
{enabled
|
|
? "Pause it to stop every agent from using its actions."
|
|
: "Resume it when agents should be able to use its actions again."}
|
|
</p>
|
|
</div>
|
|
<ToggleSwitch
|
|
aria-label={enabled ? "Pause this app" : "Resume this app"}
|
|
checked={enabled}
|
|
disabled={disabled}
|
|
onCheckedChange={onToggle}
|
|
size="lg"
|
|
/>
|
|
</div>
|
|
</section>
|
|
);
|
|
}
|
|
|
|
export function QuarantinedActionsReview({
|
|
entries,
|
|
disabled,
|
|
onSubmit,
|
|
}: {
|
|
entries: ToolCatalogEntry[];
|
|
disabled: boolean;
|
|
onSubmit: (enabledIds: string[]) => void;
|
|
}) {
|
|
const [enabledIds, setEnabledIds] = useState<Set<string>>(new Set());
|
|
const count = entries.length;
|
|
const selectedIds = entries.filter((entry) => enabledIds.has(entry.id)).map((entry) => entry.id);
|
|
return (
|
|
<section className="overflow-hidden rounded-xl border border-amber-500/40 bg-amber-500/[0.08]">
|
|
<div className="flex flex-wrap items-start justify-between gap-3 px-4 py-3">
|
|
<div>
|
|
<div className="text-sm font-semibold text-amber-800 dark:text-amber-200">
|
|
Review {count} new {count === 1 ? "action" : "actions"}
|
|
</div>
|
|
<p className="mt-1 text-xs text-amber-700 dark:text-amber-300">
|
|
Turn on the actions agents may use. Anything left off stays blocked when you save.
|
|
</p>
|
|
</div>
|
|
<div className="flex items-center gap-2">
|
|
<button
|
|
type="button"
|
|
className="text-xs font-medium text-amber-800 hover:text-amber-950 dark:text-amber-200 dark:hover:text-amber-50"
|
|
disabled={disabled}
|
|
onClick={() => setEnabledIds(new Set(entries.map((entry) => entry.id)))}
|
|
>
|
|
Turn all on
|
|
</button>
|
|
<button
|
|
type="button"
|
|
className="text-xs font-medium text-amber-800 hover:text-amber-950 dark:text-amber-200 dark:hover:text-amber-50"
|
|
disabled={disabled}
|
|
onClick={() => setEnabledIds(new Set())}
|
|
>
|
|
Turn all off
|
|
</button>
|
|
</div>
|
|
</div>
|
|
<div className="divide-y divide-amber-500/25 border-y border-amber-500/25 bg-background">
|
|
{entries.map((entry) => {
|
|
const enabled = enabledIds.has(entry.id);
|
|
const label = entry.title ?? entry.toolName;
|
|
return (
|
|
<div key={entry.id} className="flex items-center gap-3 px-4 py-3">
|
|
<div className="min-w-0 flex-1">
|
|
<div className="text-sm font-medium text-foreground">{label}</div>
|
|
{entry.description && (
|
|
<div className="truncate text-xs text-muted-foreground">{entry.description}</div>
|
|
)}
|
|
</div>
|
|
<ToggleSwitch
|
|
aria-label={`${label} allowed`}
|
|
checked={enabled}
|
|
disabled={disabled}
|
|
onCheckedChange={(next) => {
|
|
setEnabledIds((current) => {
|
|
const updated = new Set(current);
|
|
if (next) updated.add(entry.id);
|
|
else updated.delete(entry.id);
|
|
return updated;
|
|
});
|
|
}}
|
|
/>
|
|
</div>
|
|
);
|
|
})}
|
|
</div>
|
|
<div className="flex items-center justify-between gap-3 px-4 py-3">
|
|
<span className="text-xs text-amber-700 dark:text-amber-300">
|
|
{selectedIds.length} of {count} will be on
|
|
</span>
|
|
<Button size="sm" disabled={disabled} onClick={() => onSubmit(selectedIds)}>
|
|
{disabled ? "Saving…" : "Save choices"}
|
|
</Button>
|
|
</div>
|
|
</section>
|
|
);
|
|
}
|