mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-29 12:59:13 +01:00
Dotta
d387cc0ff0
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Connection intents need secure provider implementations to complete setup. > - Some providers use managed OAuth or external credential brokers. > - Those tokens must stay out of durable Paperclip state and fail closed when refresh fails. > - This pull request adds managed connector backends and the required storage contract. > - The benefit is safer provider setup with governed credential lifecycles. ## Linked Issues or Issue Description Refs #11965 This is stack 8 of 11. It depends on stack 7 and replaces another reviewable part of #11965. ## What Changed - Add managed Google Workspace and external connector backends. - Add Vercel Connect support without storing provider bearer tokens. - Add replay-safe migration 0232 and its generated snapshot. - Fail closed and clear stale token bindings when organization OAuth refresh needs reauthorization. ## Verification - `pnpm --filter @paperclipai/server typecheck` - `pnpm --filter @paperclipai/server exec vitest run src/__tests__/tool-access-service.test.ts` - Result: 194 tests passed. - `pnpm --filter @paperclipai/db check:migrations` - `pnpm build` - `pnpm exec vitest run --project @paperclipai/server server/src/services/remote-url-credentials.test.ts` (5 passed, including URL userinfo vault extraction) ## Risks - Broker metadata errors can block provider setup. - OAuth refresh failure disables the shared organization connection until reauthorization. - Migration 0232 is generated, ordered after 0231, and safe to replay. > I checked `ROADMAP.md`. This stack continues the existing app connection work from #11965 and does not duplicate another planned item. ## Model Used OpenAI Codex, GPT-5. The runtime model ID and context window were not exposed. The model used reasoning, tool use, and code execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have linked the public source pull request with `Refs #` - [x] I have not referenced internal or instance-local Paperclip issues or links - [x] My branch name describes the change and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge
14 lines
1.7 KiB
SQL
14 lines
1.7 KiB
SQL
ALTER TABLE "connection_grants" ADD COLUMN IF NOT EXISTS "external_credential" jsonb;--> statement-breakpoint
|
|
ALTER TABLE "tool_connections" ADD COLUMN IF NOT EXISTS "credential_source" text DEFAULT 'paperclip_vault' NOT NULL;--> statement-breakpoint
|
|
ALTER TABLE "tool_connections" ADD COLUMN IF NOT EXISTS "external_credential" jsonb;--> statement-breakpoint
|
|
ALTER TABLE "connection_grants" DROP CONSTRAINT IF EXISTS "connection_grants_credential_source_one_of_check";--> statement-breakpoint
|
|
ALTER TABLE "connection_grants" ADD CONSTRAINT "connection_grants_credential_source_one_of_check" CHECK ("connection_grants"."external_credential" is null or jsonb_array_length("connection_grants"."credential_secret_refs") = 0);--> statement-breakpoint
|
|
ALTER TABLE "tool_connections" DROP CONSTRAINT IF EXISTS "tool_connections_credential_source_check";--> statement-breakpoint
|
|
ALTER TABLE "tool_connections" ADD CONSTRAINT "tool_connections_credential_source_check" CHECK ("tool_connections"."credential_source" in ('paperclip_vault', 'vercel_connect'));--> statement-breakpoint
|
|
ALTER TABLE "tool_connections" DROP CONSTRAINT IF EXISTS "tool_connections_credential_source_one_of_check";--> statement-breakpoint
|
|
ALTER TABLE "tool_connections" ADD CONSTRAINT "tool_connections_credential_source_one_of_check" CHECK ((
|
|
("tool_connections"."credential_source" = 'paperclip_vault' and "tool_connections"."external_credential" is null)
|
|
or
|
|
("tool_connections"."credential_source" = 'vercel_connect' and "tool_connections"."external_credential" is not null and jsonb_array_length("tool_connections"."credential_refs") = 0 and jsonb_array_length("tool_connections"."credential_secret_refs") = 0)
|
|
));
|