mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 02:26:12 +02:00
DottaandPaperclip
a959e47508
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Apps give agents controlled access to external services. > - Google Chat uses OAuth profiles and reviewed MCP tools. > - Those profiles request membership and read-state access that the supported feature set does not need. > - Removing read-state access also requires us to block unread search filters, including on existing connections. > - This pull request reduces both OAuth methods and enforces the reduced search contract before dispatch. > - Users retain conversation lookup, message history, ordinary search, and approved message sending. ## Linked Issues or Issue Description **What happened?** Both Google Chat profiles request membership and read-state scopes. The supported tool set does not include membership listing or read-state updates. Message search still advertises an unread filter. Related work: Refs #12619. **Expected behavior** Managed and customer-owned OAuth request only the scopes needed for supported features. Unsupported unread filters fail clearly before any provider call. Existing cached catalogs and broader grants must not bypass that policy. **Steps to reproduce** Start Google Chat OAuth from either connection method and inspect the requested scopes. Inspect the message-search tool schema, then submit a search with `searchParameters.isUnread` set to true or false. **Paperclip version or commit** The scope change is based on master at `110d176fc`. **Deployment mode** Managed Cloud and self-hosted instances with Google Chat Apps enabled. ## What Changed - Remove `chat.memberships.readonly` and `chat.users.readstate.readonly` from shared profiles and all four Chat connection methods. - Hide unsupported read-state fields and instructions in agent and board Test tool schemas. - Reject explicit unread filters, including false, null, snake-case fields, and encoded filter objects, before provider dispatch. - Recheck previously approved calls and support existing profile-bound and URL-only Chat connections. - Add scope, signed broker request, OAuth URL, allowlist, schema, and dispatch regression tests. - Document coordinated app/broker rollout, existing-grant reconnects, and the remaining deployment checks. ## Verification - All seven focused OAuth and Chat gateway test files pass: 498 tests on the rebased branch. - `pnpm -r typecheck` and `pnpm build` pass, using pinned pnpm 9.15.4. - The complete sharded CI test matrix passes, including general server, Chat, workspace, serialized server, Runner, and all eight browser e2e shards. The duplicate unsharded local `pnpm test:run` was stopped after CI passed; it did not complete locally. - `git diff --check` passes. - `node scripts/ingest-app-definitions.mjs` succeeds and leaves the branch unchanged. Google Workspace JSON is the durable reviewed input used by the generator. - All current-head CI checks pass at `7ee755371714dc036fff1c7da844776fee3f2ec1`, including typecheck, build, and canary dry run. Greptile is 5/5 with zero unresolved threads. The generator concern was withdrawn after review of the source and regeneration evidence. - No production deployment or live Google consent test was performed. After coordinated deployment, verify reduced consent scopes, normal search/history, message sending, and rejection of unread filters. ## Risks - Coordinate deployment with the companion Cloud broker scope change. Mixed versions can reject exact-scope requests. - Existing tokens are not narrowed or revoked. Grants with old scopes need new consent. Do not revoke a shared Google client to migrate one profile. - Explicit unread filters now return an error instead of being sent to Google. Ordinary search and the approved send tool remain available. - No database, UI, lockfile, or workflow changes. ## Model Used OpenAI Codex, a GPT-5-based coding agent, with tool use and code execution. The exact runtime model ID and context window were not exposed in this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing>
190 lines
7.1 KiB
JSON
190 lines
7.1 KiB
JSON
{
|
|
"schemaVersion": 1,
|
|
"slug": "google-chat",
|
|
"name": "Google Chat",
|
|
"description": "Search and read Google Chat conversations and send messages.",
|
|
"categories": [
|
|
"communication",
|
|
"productivity"
|
|
],
|
|
"featured": false,
|
|
"branding": {
|
|
"logoUrl": "/brands/apps/google-chat.svg"
|
|
},
|
|
"urlPatterns": [
|
|
"https://chatmcp.googleapis.com/*",
|
|
"https://chat.google.com/*"
|
|
],
|
|
"docsUrl": "https://developers.google.com/workspace/chat/api/reference/mcp",
|
|
"setupPrerequisite": {
|
|
"title": "Google Developer Preview access required",
|
|
"description": "Google must register both the Workspace email used to authorize Paperclip and the Google Cloud project that owns the OAuth client. Registration is limited to those emails and projects; it does not enable unrelated Paperclip customers.",
|
|
"steps": [
|
|
"Apply with the Workspace email that will sign in and the Google Cloud project that owns the OAuth client.",
|
|
"Wait for the Google Group notification and then Google's final project-registration email, usually within a couple of days.",
|
|
"Add every additional tester email or Cloud project through Google's member request forms before connecting."
|
|
],
|
|
"actionLabel": "Apply or verify Developer Preview enrollment",
|
|
"actionUrl": "https://developers.google.com/workspace/preview"
|
|
},
|
|
"redirectConstraints": "https-or-loopback-http",
|
|
"methods": [
|
|
{
|
|
"key": "paperclip-read",
|
|
"label": "Connect with Paperclip",
|
|
"transport": "mcp_remote",
|
|
"auth": "oauth",
|
|
"oauthStrategy": "paperclip_cloud_connector",
|
|
"connectorProfile": "chat.read",
|
|
"capabilityProfile": {
|
|
"key": "read",
|
|
"label": "Read only",
|
|
"description": "Search conversations and read messages."
|
|
},
|
|
"grantKinds": [
|
|
"user",
|
|
"organization"
|
|
],
|
|
"ownershipModes": [
|
|
"platform_shared"
|
|
],
|
|
"whenToUse": "Use Paperclip-managed OAuth for read-only Chat access.",
|
|
"defaults": {
|
|
"serverUrl": "https://chatmcp.googleapis.com/mcp/v1",
|
|
"scopesHint": [
|
|
"https://www.googleapis.com/auth/chat.spaces.readonly",
|
|
"https://www.googleapis.com/auth/chat.messages.readonly"
|
|
]
|
|
},
|
|
"guidanceMd": "Connect Google Chat to search conversations and read messages. Read/unread filtering and membership listing are not supported.",
|
|
"warnings": [
|
|
"Google Workspace MCP servers are in Developer Preview."
|
|
],
|
|
"riskTier": "S3"
|
|
},
|
|
{
|
|
"key": "customer-read-oauth",
|
|
"label": "Use your own Google OAuth app",
|
|
"transport": "mcp_remote",
|
|
"auth": "oauth",
|
|
"capabilityProfile": {
|
|
"key": "read",
|
|
"label": "Read only",
|
|
"description": "Search conversations and read messages."
|
|
},
|
|
"grantKinds": [
|
|
"user",
|
|
"organization"
|
|
],
|
|
"ownershipModes": [
|
|
"customer"
|
|
],
|
|
"whenToUse": "Use a customer-owned OAuth client for read-only Chat access.",
|
|
"defaults": {
|
|
"serverUrl": "https://chatmcp.googleapis.com/mcp/v1",
|
|
"authorizationEndpoint": "https://accounts.google.com/o/oauth2/v2/auth",
|
|
"tokenEndpoint": "https://oauth2.googleapis.com/token",
|
|
"metadataUrl": "https://accounts.google.com/.well-known/openid-configuration",
|
|
"scopesHint": [
|
|
"https://www.googleapis.com/auth/chat.spaces.readonly",
|
|
"https://www.googleapis.com/auth/chat.messages.readonly"
|
|
],
|
|
"oauthAuthorizationParams": {
|
|
"access_type": "offline",
|
|
"prompt": "consent"
|
|
}
|
|
},
|
|
"guidanceMd": "Enable the Chat and Chat MCP APIs, configure a Chat app, then register Paperclip's callback URI. Read/unread filtering and membership listing are not supported.",
|
|
"consoleLinks": {
|
|
"register": "https://console.cloud.google.com/auth/clients",
|
|
"docs": "https://developers.google.com/workspace/guides/configure-mcp-servers"
|
|
},
|
|
"warnings": [
|
|
"A Google Chat app must be configured in the Cloud project.",
|
|
"Google Workspace MCP servers are in Developer Preview."
|
|
],
|
|
"riskTier": "S3"
|
|
},
|
|
{
|
|
"key": "paperclip-write",
|
|
"label": "Connect with Paperclip",
|
|
"transport": "mcp_remote",
|
|
"auth": "oauth",
|
|
"oauthStrategy": "paperclip_cloud_connector",
|
|
"connectorProfile": "chat.write",
|
|
"capabilityProfile": {
|
|
"key": "write",
|
|
"label": "Read & send",
|
|
"description": "Read Chat and send messages."
|
|
},
|
|
"grantKinds": [
|
|
"user",
|
|
"organization"
|
|
],
|
|
"ownershipModes": [
|
|
"platform_shared"
|
|
],
|
|
"whenToUse": "Use Paperclip-managed OAuth to read Chat and send messages.",
|
|
"defaults": {
|
|
"serverUrl": "https://chatmcp.googleapis.com/mcp/v1",
|
|
"scopesHint": [
|
|
"https://www.googleapis.com/auth/chat.spaces.readonly",
|
|
"https://www.googleapis.com/auth/chat.messages.readonly",
|
|
"https://www.googleapis.com/auth/chat.messages.create"
|
|
]
|
|
},
|
|
"guidanceMd": "Connect Google Chat to read conversations and send approved messages. Read/unread filtering and membership listing are not supported.",
|
|
"warnings": [
|
|
"Sending messages requires approval.",
|
|
"Google Workspace MCP servers are in Developer Preview."
|
|
],
|
|
"riskTier": "S4"
|
|
},
|
|
{
|
|
"key": "customer-write-oauth",
|
|
"label": "Use your own Google OAuth app",
|
|
"transport": "mcp_remote",
|
|
"auth": "oauth",
|
|
"capabilityProfile": {
|
|
"key": "write",
|
|
"label": "Read & send",
|
|
"description": "Read Chat and send messages."
|
|
},
|
|
"grantKinds": [
|
|
"user",
|
|
"organization"
|
|
],
|
|
"ownershipModes": [
|
|
"customer"
|
|
],
|
|
"whenToUse": "Use a customer-owned OAuth client to read Chat and send messages.",
|
|
"defaults": {
|
|
"serverUrl": "https://chatmcp.googleapis.com/mcp/v1",
|
|
"authorizationEndpoint": "https://accounts.google.com/o/oauth2/v2/auth",
|
|
"tokenEndpoint": "https://oauth2.googleapis.com/token",
|
|
"metadataUrl": "https://accounts.google.com/.well-known/openid-configuration",
|
|
"scopesHint": [
|
|
"https://www.googleapis.com/auth/chat.spaces.readonly",
|
|
"https://www.googleapis.com/auth/chat.messages.readonly",
|
|
"https://www.googleapis.com/auth/chat.messages.create"
|
|
],
|
|
"oauthAuthorizationParams": {
|
|
"access_type": "offline",
|
|
"prompt": "consent"
|
|
}
|
|
},
|
|
"guidanceMd": "Enable the Chat and Chat MCP APIs, configure a Chat app, then register Paperclip's callback URI. Read/unread filtering and membership listing are not supported.",
|
|
"consoleLinks": {
|
|
"register": "https://console.cloud.google.com/auth/clients",
|
|
"docs": "https://developers.google.com/workspace/guides/configure-mcp-servers"
|
|
},
|
|
"warnings": [
|
|
"Sending messages requires approval.",
|
|
"A Google Chat app must be configured in the Cloud project.",
|
|
"Google Workspace MCP servers are in Developer Preview."
|
|
],
|
|
"riskTier": "S4"
|
|
}
|
|
]
|
|
}
|