mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-09 07:10:34 +01:00
## Thinking Path > - Paperclip lets people manage agent work through the board. > - The board reads task, agent, settings, plugin, and run data from the server. > - A deploy can interrupt those reads after content is already visible. > - Local error branches can replace that content with an error or show raw codes. > - This pull request moves the remaining reads to the shared recovery behavior. > - The query-error guard prevents new local error patterns from returning. ## Linked Issues or Issue Description **What happened?** Loaded lists, settings, task panels, and manual reads could clear their content or show errors during a server restart. Some reads also disabled the shared retry policy. **Expected behavior** Keep loaded content during a temporary failure. Show the shared connection banner. Retry reads after recovery. Replace content after a real access denial or missing resource, with readable copy. **Steps to reproduce** Open a task, settings page, or run log. Return 503 with `tenant_app_unavailable` from the API. Restore the API and check that content refreshes. Repeat with 403 and 404 to check the failure state. Related merged work: Refs #15754, Refs #15772, Refs #17960. This change covers remaining reads and enforcement. Browser persistence and the outage browser suite follow separately. ## What Changed - Repair an existing PostgreSQL deadline fixture at UTC boundaries. A daily cap defers a heartbeat until both its original interval and the next UTC day allow it. Keep the counted run in its seeded day and cover noon, just before midnight and the first second after midnight with explicit clocks and real PostgreSQL. Production scheduling is unchanged. - Integrate the saved list, settings, shell, task, and manual-read recovery changes against current master. Preserve the current task, Inbox, and run-log structure. - Add `useResilientFetch` for component-local reads. Preserve loaded data, cancel stale requests, and retry through the shared connectivity policy. Keep browser and pairing capabilities in memory. - Retain run log chunks across stream changes and catch up after recovery without duplicate chunks or stalled requests. - Keep genuine authorization and missing-resource failures visible. Translate known single-word codes such as `forbidden`. Show known skills and disconnected-app failures before sibling loading states. Keep Retry bound to its failed request. - Make the query-error guard enforce by default and run it in the CI policy job. Document the narrow exceptions and the read recovery contract. - Invalidate pending OAuth discovery when the operator leaves setup or its context changes. Keep reserved-popup cleanup bound to the current attempt. ## Verification - Current read head `09d1db29dea` is merge-ready: all 59 check runs are completed (54 successful, three skipped, two neutral), the legacy Snyk status is successful, and both required `ci / verify` and `ci / e2e` gates pass. Greptile Apex reviewed this exact head at 5/5 with no unresolved threads; the branch has no merge conflicts. The current CI run is `41748339602`. - Current read head `09d1db29dea` includes master `683fa4725e9`. The latest change touches only the existing server deadline test fixture. Application source remains the previously verified `86376fa751e` revision: all 60 affected skills/disconnected-app tests and both application UI typechecks passed, along with token gates and the enforcing query-error guard. Those UI suites were not repeated for this test-only repair. - The fixture repair passes all seven deadline integration cases and the complete server typecheck, including the server test layer. The old assertion deterministically fails at 23:59:06.888 UTC; its one-second-old run also fails the first-second-of-day probe. The corrected fixture passes noon and both midnight probes. The permanent three-case coverage uses seeded 2099 clocks. - Twelve new regressions fail against the previous implementation. Both skills variants and disconnected-app pages show either request's 403 or 429 while the sibling pauses or remains fetching. Permission failures stay visible. Retry stays usable for its failed request and recovers independently. An initial test-fixture query-key typo was corrected before the passing run. The finding is replied to and resolved. Greptile reviewed prior application revision `86376fa751e` at 5/5 with no new actionable findings or unresolved threads. The current test-only head has now received its own Apex 5/5 review with no unresolved threads, and its CI is successful as recorded above. - The preceding OAuth fix passed all 237 setup tests on both application branches. Its ten regressions prove that Back, Cancel, unmount, or context changes retire initial discovery without creating a connection, caching old identities, navigating an abandoned popup, or closing a newer attempt. - Earlier master integration `e992f770339` passed all 309 tests across eight affected Slack, recovery, retry, submission and task files, plus UI typecheck, token gates, enforcing query-error scan and seven guard tests. The integration preserves Slack workspace reconnect and shared recovery, readable execution errors, source-inspection company scoping, and current submission behavior. Newly inherited retained-file recovery controls keep cached data through transient failures and hide it after definitive denial. - The preceding cache head `97c0bc3966f` passed 1,038 focused cache/write/editor/account/task/API tests. All 22 built-UI outage/write/loading cases passed in 4.7 minutes on exact browser head `b7deaaee5da`, with strict checking of all three specs. The latest skills/app rendering fix is covered by its affected component suites; those broader cases were not repeated for this separate read path. - Historical broader UI, CLI and build results and unresolved aggregate server/DB/adapter failures remain in the PR discussion. Interrupted CI runs were audited and recorded separately; they are not counted as passes. Controlled local outages do not prove hosted authentication or a real Cloud restart/deploy. Real hosted acceptance remains required after merge and deployment. Commands for the latest fix: ```sh pnpm --filter @paperclipai/ui exec vitest run src/pages/CompanySkills.test.tsx src/pages/apps/AppNotConnected.test.tsx pnpm --filter @paperclipai/ui typecheck pnpm check:token-gates node scripts/check-query-error-rendering.mjs --enforce --summary ``` ## Risks This migration touches many read surfaces. The main risks are initial loading, request cancellation, retained authorization state, and run-log paging. The tests cover those states. There are no server, schema, dependency, or API contract changes. The follow-up browser suite and hosted deploy acceptance are required before release acceptance. Recovered commits retain their original authors. If squash-merging, preserve `Co-Authored-By: Bender (Fable) <bender@agents.paperclip.ing>` and the Paperclip trailer. ## Model Used OpenAI `gpt-6.1-sol` through Codex, with xhigh reasoning effort, tool use, and code execution. The context window size is not exposed. Saved source commits keep their original authorship. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have described the issue in-PR following the bug report template - [x] I have not referenced internal/instance-local Paperclip issues or links - [x] My branch name describes the change and contains no internal ticket id - [x] The affected local tests pass; broader limitations are recorded above - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: devinfoley <139239+devinfoley@users.noreply.github.com> Co-authored-by: Paperclip <noreply@paperclip.ing> Co-authored-by: Bender (Fable) <bender@agents.paperclip.ing> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
734 lines
29 KiB
TypeScript
734 lines
29 KiB
TypeScript
import { useEffect, useMemo, useState } from "react";
|
|
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
|
|
import {
|
|
HUMAN_COMPANY_MEMBERSHIP_ROLE_LABELS,
|
|
hidesCompanyPage,
|
|
type Agent,
|
|
} from "@paperclipai/shared";
|
|
import { Shield, ShieldCheck, Trash2, UserPlus } from "lucide-react";
|
|
import { accessApi, type CompanyMember } from "@/api/access";
|
|
import { agentsApi } from "@/api/agents";
|
|
import { cloudApi } from "@/api/cloud";
|
|
import { issuesApi } from "@/api/issues";
|
|
import { QueryErrorState, useQueryView } from "@/components/QueryView";
|
|
import { Button } from "@/components/ui/button";
|
|
import {
|
|
Dialog,
|
|
DialogContent,
|
|
DialogDescription,
|
|
DialogFooter,
|
|
DialogHeader,
|
|
DialogTitle,
|
|
} from "@/components/ui/dialog";
|
|
import { Badge } from "@/components/ui/badge";
|
|
import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
|
|
import { useBreadcrumbs } from "@/context/BreadcrumbContext";
|
|
import { useCompany } from "@/context/CompanyContext";
|
|
import { useToast } from "@/context/ToastContext";
|
|
import { Link, Navigate, useSearchParams } from "@/lib/router";
|
|
import { queryKeys } from "@/lib/queryKeys";
|
|
import { cloudStackInviteUrl } from "@/lib/cloudLinks";
|
|
import { usePluginSlots } from "@/plugins/slots";
|
|
import { Tabs, TabsContent } from "@/components/ui/tabs";
|
|
import { PageTabBar } from "@/components/PageTabBar";
|
|
import { useHiddenSettings } from "@/hooks/useHiddenSettings";
|
|
import { useCloudInstance } from "@/hooks/useCloudInstance";
|
|
import { InvitesSection } from "@/components/access/InvitesSection";
|
|
import { describeError } from "@/api/errors";
|
|
|
|
const reassignmentIssueStatuses = "backlog,todo,in_progress,in_review,blocked,failed,timed_out";
|
|
type EditableMemberStatus = "pending" | "active" | "suspended";
|
|
|
|
export function CompanyAccess() {
|
|
const { selectedCompany, selectedCompanyId } = useCompany();
|
|
const { setBreadcrumbs } = useBreadcrumbs();
|
|
const { pushToast } = useToast();
|
|
const queryClient = useQueryClient();
|
|
const [searchParams, setSearchParams] = useSearchParams();
|
|
const cloud = useCloudInstance();
|
|
const cloudStacksQuery = useQuery({
|
|
queryKey: queryKeys.cloud.stacks,
|
|
queryFn: () => cloudApi.listStacks(),
|
|
enabled: Boolean(cloud && selectedCompanyId),
|
|
staleTime: 30_000,
|
|
});
|
|
const cloudStacksView = useQueryView(cloudStacksQuery);
|
|
const currentStack = cloudStacksQuery.data?.stacks.find((stack) => stack.isCurrent);
|
|
// Company roles can differ from Cloud roles. Only the current stack's
|
|
// owner/admin may invite, even if another portfolio entry grants ownership.
|
|
const cloudInviteUrl = cloud && cloudStacksView.kind !== "error" &&
|
|
(currentStack?.role === "owner" || currentStack?.role === "admin")
|
|
? cloudStackInviteUrl(cloud.cloudBaseUrl, currentStack.stackSlug)
|
|
: null;
|
|
// Invites render as a tab of this page; `company.invites` hides just that
|
|
// tab while `company.members` (the route gate) hides the whole page.
|
|
const { hidden: hiddenSettings } = useHiddenSettings();
|
|
const hideInvitesTab = hidesCompanyPage(hiddenSettings, "company.invites");
|
|
const requestedTab = searchParams.get("tab") === "invites" ? "invites" : "members";
|
|
const activeTab = hideInvitesTab ? "members" : requestedTab;
|
|
const handleTabChange = (value: string) => {
|
|
setSearchParams(
|
|
(prev) => {
|
|
const next = new URLSearchParams(prev);
|
|
if (value === "invites") {
|
|
next.set("tab", "invites");
|
|
} else {
|
|
next.delete("tab");
|
|
}
|
|
return next;
|
|
},
|
|
{ replace: true },
|
|
);
|
|
};
|
|
const [editingMemberId, setEditingMemberId] = useState<string | null>(null);
|
|
const [removingMemberId, setRemovingMemberId] = useState<string | null>(null);
|
|
const [reassignmentTarget, setReassignmentTarget] = useState<string>("__unassigned");
|
|
const [draftRole, setDraftRole] = useState<CompanyMember["membershipRole"]>(null);
|
|
const [draftStatus, setDraftStatus] = useState<EditableMemberStatus>("active");
|
|
|
|
useEffect(() => {
|
|
setBreadcrumbs([
|
|
{ label: selectedCompany?.name ?? "Organization", href: "/dashboard" },
|
|
{ label: "Settings", href: "/company/settings" },
|
|
{ label: "Members" },
|
|
]);
|
|
}, [selectedCompany?.name, setBreadcrumbs]);
|
|
|
|
const membersQuery = useQuery({
|
|
queryKey: queryKeys.access.companyMembers(selectedCompanyId ?? ""),
|
|
queryFn: () => accessApi.listMembers(selectedCompanyId!),
|
|
enabled: !!selectedCompanyId,
|
|
});
|
|
const membersView = useQueryView(membersQuery);
|
|
|
|
const agentsQuery = useQuery({
|
|
queryKey: queryKeys.agents.list(selectedCompanyId ?? ""),
|
|
queryFn: () => agentsApi.list(selectedCompanyId!),
|
|
enabled: !!selectedCompanyId,
|
|
});
|
|
|
|
const joinRequestsQuery = useQuery({
|
|
queryKey: queryKeys.access.joinRequests(selectedCompanyId ?? "", "pending_approval"),
|
|
queryFn: () => accessApi.listJoinRequests(selectedCompanyId!, "pending_approval"),
|
|
enabled: !!selectedCompanyId && !!membersQuery.data?.access.canApproveJoinRequests,
|
|
});
|
|
|
|
const refreshAccessData = async () => {
|
|
if (!selectedCompanyId) return;
|
|
await queryClient.invalidateQueries({ queryKey: queryKeys.access.companyMembers(selectedCompanyId) });
|
|
await queryClient.invalidateQueries({ queryKey: queryKeys.access.companyUserDirectory(selectedCompanyId) });
|
|
await queryClient.invalidateQueries({ queryKey: queryKeys.access.joinRequests(selectedCompanyId, "pending_approval") });
|
|
};
|
|
|
|
const updateMemberMutation = useMutation({
|
|
mutationFn: async (input: { memberId: string; membershipRole: CompanyMember["membershipRole"]; status: EditableMemberStatus }) => {
|
|
return accessApi.updateMember(selectedCompanyId!, input.memberId, {
|
|
membershipRole: input.membershipRole,
|
|
status: input.status,
|
|
});
|
|
},
|
|
onSuccess: async () => {
|
|
setEditingMemberId(null);
|
|
await refreshAccessData();
|
|
pushToast({
|
|
title: "Member updated",
|
|
tone: "success",
|
|
});
|
|
},
|
|
onError: (error) => {
|
|
pushToast({
|
|
title: "Failed to update member",
|
|
body: describeError(error).body,
|
|
tone: "error",
|
|
});
|
|
},
|
|
});
|
|
|
|
const approveJoinRequestMutation = useMutation({
|
|
mutationFn: (requestId: string) => accessApi.approveJoinRequest(selectedCompanyId!, requestId),
|
|
onSuccess: async () => {
|
|
await refreshAccessData();
|
|
pushToast({
|
|
title: "Join request approved",
|
|
tone: "success",
|
|
});
|
|
},
|
|
onError: (error) => {
|
|
pushToast({
|
|
title: "Failed to approve join request",
|
|
body: describeError(error).body,
|
|
tone: "error",
|
|
});
|
|
},
|
|
});
|
|
|
|
const rejectJoinRequestMutation = useMutation({
|
|
mutationFn: (requestId: string) => accessApi.rejectJoinRequest(selectedCompanyId!, requestId),
|
|
onSuccess: async () => {
|
|
await refreshAccessData();
|
|
pushToast({
|
|
title: "Join request rejected",
|
|
tone: "success",
|
|
});
|
|
},
|
|
onError: (error) => {
|
|
pushToast({
|
|
title: "Failed to reject join request",
|
|
body: describeError(error).body,
|
|
tone: "error",
|
|
});
|
|
},
|
|
});
|
|
|
|
const editingMember = useMemo(
|
|
() => membersQuery.data?.members.find((member) => member.id === editingMemberId) ?? null,
|
|
[editingMemberId, membersQuery.data?.members],
|
|
);
|
|
const removingMember = useMemo(
|
|
() => membersQuery.data?.members.find((member) => member.id === removingMemberId) ?? null,
|
|
[removingMemberId, membersQuery.data?.members],
|
|
);
|
|
|
|
const assignedIssuesQuery = useQuery({
|
|
queryKey: ["access", "member-assigned-issues", selectedCompanyId ?? "", removingMember?.principalId ?? ""],
|
|
queryFn: () =>
|
|
issuesApi.list(selectedCompanyId!, {
|
|
assigneeUserId: removingMember!.principalId,
|
|
status: reassignmentIssueStatuses,
|
|
}),
|
|
enabled: !!selectedCompanyId && !!removingMember,
|
|
});
|
|
|
|
const archiveMemberMutation = useMutation({
|
|
mutationFn: async (input: { memberId: string; target: string }) => {
|
|
const reassignment =
|
|
input.target.startsWith("agent:")
|
|
? { assigneeAgentId: input.target.slice("agent:".length), assigneeUserId: null }
|
|
: input.target.startsWith("user:")
|
|
? { assigneeAgentId: null, assigneeUserId: input.target.slice("user:".length) }
|
|
: null;
|
|
return accessApi.archiveMember(selectedCompanyId!, input.memberId, { reassignment });
|
|
},
|
|
onSuccess: async (result) => {
|
|
setRemovingMemberId(null);
|
|
setReassignmentTarget("__unassigned");
|
|
await refreshAccessData();
|
|
if (selectedCompanyId) {
|
|
await queryClient.invalidateQueries({ queryKey: queryKeys.issues.list(selectedCompanyId) });
|
|
await queryClient.invalidateQueries({ queryKey: queryKeys.issues.listAssignedToMe(selectedCompanyId) });
|
|
await queryClient.invalidateQueries({ queryKey: queryKeys.issues.listTouchedByMe(selectedCompanyId) });
|
|
}
|
|
pushToast({
|
|
title: "Member removed",
|
|
body:
|
|
result.reassignedIssueCount > 0
|
|
? `${result.reassignedIssueCount} assigned task${result.reassignedIssueCount === 1 ? "" : "s"} cleaned up.`
|
|
: undefined,
|
|
tone: "success",
|
|
});
|
|
},
|
|
onError: (error) => {
|
|
pushToast({
|
|
title: "Failed to remove member",
|
|
body: describeError(error).body,
|
|
tone: "error",
|
|
});
|
|
},
|
|
});
|
|
|
|
useEffect(() => {
|
|
if (!editingMember) return;
|
|
setDraftRole(editingMember.membershipRole);
|
|
setDraftStatus(isEditableMemberStatus(editingMember.status) ? editingMember.status : "suspended");
|
|
}, [editingMember]);
|
|
|
|
useEffect(() => {
|
|
if (!removingMember) return;
|
|
setReassignmentTarget("__unassigned");
|
|
}, [removingMember]);
|
|
|
|
if (!selectedCompanyId) {
|
|
return <div className="text-sm text-muted-foreground">Select an organization to manage access.</div>;
|
|
}
|
|
|
|
if (membersQuery.isLoading || membersView.kind === "reconnecting") {
|
|
return <div className="text-sm text-muted-foreground">Loading organization access…</div>;
|
|
}
|
|
|
|
if (membersView.kind === "error") {
|
|
if (membersView.errorKind === "forbidden") {
|
|
return <div className="text-sm text-destructive">You do not have permission to manage organization members.</div>;
|
|
}
|
|
return (
|
|
<QueryErrorState
|
|
size="page"
|
|
error={membersQuery.error}
|
|
action="load organization members"
|
|
onRetry={membersView.retry}
|
|
retrying={membersView.isFetching}
|
|
/>
|
|
);
|
|
}
|
|
|
|
const members = membersQuery.data?.members ?? [];
|
|
const access = membersQuery.data?.access;
|
|
const pendingHumanJoinRequests =
|
|
joinRequestsQuery.data?.filter((request) => request.requestType === "human") ?? [];
|
|
const joinRequestActionPending =
|
|
approveJoinRequestMutation.isPending || rejectJoinRequestMutation.isPending;
|
|
const activeReassignmentUsers = members.filter(
|
|
(member) =>
|
|
member.status === "active" &&
|
|
member.principalType === "user" &&
|
|
member.id !== removingMemberId,
|
|
);
|
|
const activeReassignmentAgents = (agentsQuery.data ?? []).filter(isAssignableAgent);
|
|
const assignedIssues = assignedIssuesQuery.data ?? [];
|
|
|
|
return (
|
|
<div className="max-w-6xl space-y-8">
|
|
<div className="flex flex-wrap items-center justify-between gap-3">
|
|
<div className="flex items-center gap-2">
|
|
<ShieldCheck className="h-5 w-5 text-muted-foreground" />
|
|
<h1 className="text-lg font-semibold">Organization Members</h1>
|
|
</div>
|
|
{cloudInviteUrl && (
|
|
<Button asChild>
|
|
<a href={cloudInviteUrl}><UserPlus />Invite people</a>
|
|
</Button>
|
|
)}
|
|
</div>
|
|
|
|
<Tabs value={activeTab} onValueChange={handleTabChange} className="flex flex-col gap-4">
|
|
{!hideInvitesTab && (
|
|
<PageTabBar
|
|
items={[
|
|
{ value: "members", label: "Members" },
|
|
{ value: "invites", label: "Invites" },
|
|
]}
|
|
align="start"
|
|
value={activeTab}
|
|
onValueChange={handleTabChange}
|
|
/>
|
|
)}
|
|
<TabsContent value="members" className="space-y-8">
|
|
|
|
{access && !access.currentUserRole && (
|
|
<div className="rounded-xl bg-amber-500/10 px-4 py-3 text-sm text-amber-800 dark:text-amber-200">
|
|
This account can manage access here through instance-admin privileges, but it does not currently hold an active organization membership.
|
|
</div>
|
|
)}
|
|
|
|
<section className="space-y-4">
|
|
{access?.canApproveJoinRequests && pendingHumanJoinRequests.length > 0 ? (
|
|
<div className="space-y-3">
|
|
<div className="flex flex-wrap items-center justify-between gap-2">
|
|
<div>
|
|
<h3 className="text-sm font-semibold">Pending human joins</h3>
|
|
<p className="text-sm text-muted-foreground">
|
|
Review pending join requests before they become active organization members.
|
|
</p>
|
|
</div>
|
|
<Badge variant="outline">{pendingHumanJoinRequests.length} pending</Badge>
|
|
</div>
|
|
<div className="space-y-3">
|
|
{pendingHumanJoinRequests.map((request) => (
|
|
<PendingJoinRequestCard
|
|
key={request.id}
|
|
title={
|
|
request.requesterUser?.name ||
|
|
request.requestEmailSnapshot ||
|
|
request.requestingUserId ||
|
|
"Unknown human requester"
|
|
}
|
|
subtitle={
|
|
request.requesterUser?.email ||
|
|
request.requestEmailSnapshot ||
|
|
request.requestingUserId ||
|
|
"No email available"
|
|
}
|
|
context={
|
|
request.invite
|
|
? `${request.invite.allowedJoinTypes} join invite${request.invite.humanRole ? ` • default role ${request.invite.humanRole}` : ""}`
|
|
: "Invite metadata unavailable"
|
|
}
|
|
detail={`Submitted ${new Date(request.createdAt).toLocaleString()}`}
|
|
approveLabel="Approve human"
|
|
rejectLabel="Reject human"
|
|
disabled={joinRequestActionPending}
|
|
onApprove={() => approveJoinRequestMutation.mutate(request.id)}
|
|
onReject={() => rejectJoinRequestMutation.mutate(request.id)}
|
|
/>
|
|
))}
|
|
</div>
|
|
</div>
|
|
) : null}
|
|
|
|
<div className="overflow-x-auto">
|
|
<table className="w-full min-w-(--sz-44rem) text-left text-sm">
|
|
<thead>
|
|
<tr className="border-b border-border text-muted-foreground">
|
|
<th className="px-3 py-2 font-medium">Name</th>
|
|
<th className="px-3 py-2 font-medium">Email</th>
|
|
<th className="px-3 py-2 font-medium">Role</th>
|
|
<th className="px-3 py-2 font-medium">Status</th>
|
|
<th className="px-3 py-2 text-right font-medium">Action</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{members.length === 0 ? (
|
|
<tr>
|
|
<td colSpan={5} className="px-3 py-8 text-muted-foreground">
|
|
No user memberships found for this organization yet.
|
|
</td>
|
|
</tr>
|
|
) : members.map((member) => {
|
|
const removalReason = member.removal?.reason ?? null;
|
|
const canArchive = member.removal?.canArchive ?? true;
|
|
const displayName = memberDisplayName(member);
|
|
return (
|
|
<tr key={member.id} className="border-b border-border last:border-b-0">
|
|
<td className="px-3 py-3">
|
|
<div className="flex min-w-0 items-center gap-2.5">
|
|
<Avatar size="sm">
|
|
{member.user?.image ? <AvatarImage src={member.user.image} alt={displayName} /> : null}
|
|
<AvatarFallback>{memberInitials(member)}</AvatarFallback>
|
|
</Avatar>
|
|
<span className="truncate font-medium">{displayName}</span>
|
|
</div>
|
|
</td>
|
|
<td className="px-3 py-3 text-muted-foreground">
|
|
{member.user?.email || member.principalId}
|
|
</td>
|
|
<td className="px-3 py-3">
|
|
{member.membershipRole
|
|
? HUMAN_COMPANY_MEMBERSHIP_ROLE_LABELS[member.membershipRole]
|
|
: "Unset"}
|
|
</td>
|
|
<td className="px-3 py-3">
|
|
<Badge variant={member.status === "active" ? "secondary" : member.status === "suspended" ? "destructive" : "outline"}>
|
|
{member.status.replace("_", " ")}
|
|
</Badge>
|
|
</td>
|
|
<td className="px-3 py-3 text-right">
|
|
<div className="flex justify-end gap-2">
|
|
<Button size="sm" variant="outline" onClick={() => setEditingMemberId(member.id)}>
|
|
Edit
|
|
</Button>
|
|
<span
|
|
className="inline-flex"
|
|
title={!canArchive ? removalReason ?? undefined : undefined}
|
|
>
|
|
<Button
|
|
size="sm"
|
|
variant="outline"
|
|
onClick={() => setRemovingMemberId(member.id)}
|
|
disabled={!canArchive}
|
|
title={!canArchive ? removalReason ?? undefined : undefined}
|
|
>
|
|
<Trash2 className="mr-1 h-3.5 w-3.5" />
|
|
Remove
|
|
</Button>
|
|
</span>
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
);
|
|
})}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</section>
|
|
|
|
<Dialog open={!!editingMember} onOpenChange={(open) => !open && setEditingMemberId(null)}>
|
|
<DialogContent className="max-w-2xl">
|
|
<DialogHeader>
|
|
<DialogTitle>Edit member</DialogTitle>
|
|
<DialogDescription>
|
|
Update organization role and membership status for {editingMember?.user?.name || editingMember?.user?.email || editingMember?.principalId}.
|
|
</DialogDescription>
|
|
</DialogHeader>
|
|
{editingMember && (
|
|
<div className="space-y-5">
|
|
<div className="grid gap-4 md:grid-cols-2">
|
|
<label className="space-y-2 text-sm">
|
|
<span className="font-medium">Organization role</span>
|
|
<select
|
|
className="w-full rounded-md border border-border bg-background px-3 py-2"
|
|
value={draftRole ?? ""}
|
|
onChange={(event) =>
|
|
setDraftRole((event.target.value || null) as CompanyMember["membershipRole"])
|
|
}
|
|
>
|
|
<option value="">Unset</option>
|
|
{Object.entries(HUMAN_COMPANY_MEMBERSHIP_ROLE_LABELS).map(([value, label]) => (
|
|
<option key={value} value={value}>
|
|
{label}
|
|
</option>
|
|
))}
|
|
</select>
|
|
</label>
|
|
<label className="space-y-2 text-sm">
|
|
<span className="font-medium">Membership status</span>
|
|
<select
|
|
className="w-full rounded-md border border-border bg-background px-3 py-2"
|
|
value={draftStatus}
|
|
onChange={(event) =>
|
|
setDraftStatus(event.target.value as EditableMemberStatus)
|
|
}
|
|
>
|
|
<option value="active">Active</option>
|
|
<option value="pending">Pending</option>
|
|
<option value="suspended">Suspended</option>
|
|
</select>
|
|
</label>
|
|
</div>
|
|
</div>
|
|
)}
|
|
<DialogFooter>
|
|
<Button variant="outline" onClick={() => setEditingMemberId(null)}>
|
|
Cancel
|
|
</Button>
|
|
<Button
|
|
onClick={() => {
|
|
if (!editingMember) return;
|
|
updateMemberMutation.mutate({
|
|
memberId: editingMember.id,
|
|
membershipRole: draftRole,
|
|
status: draftStatus,
|
|
});
|
|
}}
|
|
disabled={updateMemberMutation.isPending}
|
|
>
|
|
{updateMemberMutation.isPending ? "Saving…" : "Save member"}
|
|
</Button>
|
|
</DialogFooter>
|
|
</DialogContent>
|
|
</Dialog>
|
|
|
|
<Dialog open={!!removingMember} onOpenChange={(open) => !open && setRemovingMemberId(null)}>
|
|
<DialogContent className="max-w-xl">
|
|
<DialogHeader>
|
|
<DialogTitle>Remove member</DialogTitle>
|
|
<DialogDescription>
|
|
Archive {memberDisplayName(removingMember)} and move active assignments before hiding this user from assignment fields.
|
|
</DialogDescription>
|
|
</DialogHeader>
|
|
{removingMember && (
|
|
<div className="space-y-5">
|
|
<div className="rounded-lg border border-border px-3 py-3">
|
|
<div className="text-sm font-medium">{memberDisplayName(removingMember)}</div>
|
|
<div className="text-sm text-muted-foreground">{removingMember.user?.email || removingMember.principalId}</div>
|
|
<div className="mt-2 text-sm text-muted-foreground">
|
|
{assignedIssuesQuery.isLoading
|
|
? "Checking assigned tasks..."
|
|
: `${assignedIssues.length} open assigned task${assignedIssues.length === 1 ? "" : "s"}`}
|
|
</div>
|
|
</div>
|
|
|
|
{assignedIssues.length > 0 ? (
|
|
<div className="space-y-2">
|
|
<div className="text-sm font-medium">Task reassignment</div>
|
|
<select
|
|
className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm"
|
|
value={reassignmentTarget}
|
|
onChange={(event) => setReassignmentTarget(event.target.value)}
|
|
>
|
|
<option value="__unassigned">Leave unassigned</option>
|
|
{activeReassignmentUsers.length > 0 ? (
|
|
<optgroup label="Humans">
|
|
{activeReassignmentUsers.map((member) => (
|
|
<option key={member.id} value={`user:${member.principalId}`}>
|
|
{memberDisplayName(member)}
|
|
</option>
|
|
))}
|
|
</optgroup>
|
|
) : null}
|
|
{activeReassignmentAgents.length > 0 ? (
|
|
<optgroup label="Agents">
|
|
{activeReassignmentAgents.map((agent) => (
|
|
<option key={agent.id} value={`agent:${agent.id}`}>
|
|
{agent.name} ({agent.role})
|
|
</option>
|
|
))}
|
|
</optgroup>
|
|
) : null}
|
|
</select>
|
|
<div className="max-h-36 overflow-auto rounded-lg border border-border">
|
|
{assignedIssues.slice(0, 6).map((issue) => (
|
|
<div key={issue.id} className="border-b border-border px-3 py-2 text-sm last:border-b-0">
|
|
<div className="font-medium">{issue.identifier ?? issue.id.slice(0, 8)}</div>
|
|
<div className="truncate text-muted-foreground">{issue.title}</div>
|
|
</div>
|
|
))}
|
|
{assignedIssues.length > 6 ? (
|
|
<div className="px-3 py-2 text-sm text-muted-foreground">
|
|
{assignedIssues.length - 6} more task{assignedIssues.length - 6 === 1 ? "" : "s"}
|
|
</div>
|
|
) : null}
|
|
</div>
|
|
</div>
|
|
) : null}
|
|
</div>
|
|
)}
|
|
<DialogFooter>
|
|
<Button variant="outline" onClick={() => setRemovingMemberId(null)}>
|
|
Cancel
|
|
</Button>
|
|
<Button
|
|
variant="destructive"
|
|
onClick={() => {
|
|
if (!removingMember) return;
|
|
archiveMemberMutation.mutate({
|
|
memberId: removingMember.id,
|
|
target: reassignmentTarget,
|
|
});
|
|
}}
|
|
disabled={archiveMemberMutation.isPending || assignedIssuesQuery.isLoading}
|
|
>
|
|
{archiveMemberMutation.isPending ? "Removing..." : "Remove member"}
|
|
</Button>
|
|
</DialogFooter>
|
|
</DialogContent>
|
|
</Dialog>
|
|
</TabsContent>
|
|
{!hideInvitesTab && (
|
|
<TabsContent value="invites">
|
|
<InvitesSection />
|
|
</TabsContent>
|
|
)}
|
|
</Tabs>
|
|
</div>
|
|
);
|
|
}
|
|
|
|
export function CompanyAccessLegacyRoute() {
|
|
const { selectedCompanyId } = useCompany();
|
|
const { setBreadcrumbs } = useBreadcrumbs();
|
|
const { slots, isLoading, errorMessage } = usePluginSlots({
|
|
slotTypes: ["companySettingsPage"],
|
|
companyId: selectedCompanyId,
|
|
enabled: !!selectedCompanyId,
|
|
});
|
|
|
|
useEffect(() => {
|
|
setBreadcrumbs([
|
|
{ label: "Settings", href: "/company/settings" },
|
|
{ label: "Access" },
|
|
]);
|
|
}, [setBreadcrumbs]);
|
|
|
|
const permissionsSlot = slots.find((slot) => slot.routePath === "permissions");
|
|
if (permissionsSlot) {
|
|
return <Navigate to="/company/settings/permissions" replace />;
|
|
}
|
|
|
|
if (isLoading) {
|
|
return <div className="text-sm text-muted-foreground">Checking for advanced permission extensions...</div>;
|
|
}
|
|
|
|
return (
|
|
<div className="max-w-2xl space-y-5">
|
|
<div className="space-y-3">
|
|
<div className="flex items-center gap-2">
|
|
<Shield className="h-5 w-5 text-muted-foreground" />
|
|
<h1 className="text-lg font-semibold">Advanced Permissions</h1>
|
|
</div>
|
|
<p className="text-sm text-muted-foreground">
|
|
Advanced access, scoped assignment, and explicit grant controls are provided by installed organization settings extensions.
|
|
</p>
|
|
</div>
|
|
|
|
<div className="space-y-4 rounded-xl border border-border px-5 py-5">
|
|
<div className="space-y-2">
|
|
<h2 className="text-sm font-semibold">Advanced permissions unavailable</h2>
|
|
<p className="text-sm text-muted-foreground">
|
|
Core Paperclip keeps enforcing organization boundaries and any existing restrictive policy data, but editing advanced permissions requires an installed extension.
|
|
</p>
|
|
{errorMessage ? (
|
|
<p className="text-sm text-destructive">Plugin extensions unavailable: {errorMessage}</p>
|
|
) : null}
|
|
</div>
|
|
<div className="flex flex-wrap gap-2">
|
|
<Button asChild>
|
|
<Link to="/company/settings/members">Open Members</Link>
|
|
</Button>
|
|
<Button asChild variant="outline">
|
|
<Link to="/company/settings/members?tab=invites">Open Invites</Link>
|
|
</Button>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|
|
|
|
function memberDisplayName(member: CompanyMember | null) {
|
|
if (!member) return "this member";
|
|
return member.user?.name?.trim() || member.user?.email || member.principalId;
|
|
}
|
|
|
|
function memberInitials(member: CompanyMember) {
|
|
const value = memberDisplayName(member).trim();
|
|
const parts = value.split(/\s+/).filter(Boolean);
|
|
if (parts.length > 1) {
|
|
return `${parts[0]?.[0] ?? ""}${parts.at(-1)?.[0] ?? ""}`.toUpperCase();
|
|
}
|
|
return value.slice(0, 2).toUpperCase();
|
|
}
|
|
|
|
function isAssignableAgent(agent: Agent) {
|
|
return agent.status !== "terminated" && agent.status !== "pending_approval";
|
|
}
|
|
|
|
function isEditableMemberStatus(status: CompanyMember["status"]): status is EditableMemberStatus {
|
|
return status === "pending" || status === "active" || status === "suspended";
|
|
}
|
|
|
|
function PendingJoinRequestCard({
|
|
title,
|
|
subtitle,
|
|
context,
|
|
detail,
|
|
detailSecondary,
|
|
approveLabel,
|
|
rejectLabel,
|
|
disabled,
|
|
onApprove,
|
|
onReject,
|
|
}: {
|
|
title: string;
|
|
subtitle: string;
|
|
context: string;
|
|
detail: string;
|
|
detailSecondary?: string;
|
|
approveLabel: string;
|
|
rejectLabel: string;
|
|
disabled: boolean;
|
|
onApprove: () => void;
|
|
onReject: () => void;
|
|
}) {
|
|
return (
|
|
<div className="py-3">
|
|
<div className="flex flex-wrap items-start justify-between gap-4">
|
|
<div className="space-y-2">
|
|
<div>
|
|
<div className="font-medium">{title}</div>
|
|
<div className="text-sm text-muted-foreground">{subtitle}</div>
|
|
</div>
|
|
<div className="text-sm text-muted-foreground">{context}</div>
|
|
<div className="text-sm text-muted-foreground">{detail}</div>
|
|
{detailSecondary ? <div className="text-sm text-muted-foreground">{detailSecondary}</div> : null}
|
|
</div>
|
|
<div className="flex gap-2">
|
|
<Button type="button" variant="outline" onClick={onReject} disabled={disabled}>
|
|
{rejectLabel}
|
|
</Button>
|
|
<Button type="button" onClick={onApprove} disabled={disabled}>
|
|
{approveLabel}
|
|
</Button>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|