Give bots tools and MCP servers per bot and workspace, with status and tests

- Bots and workspaces get tools and MCP servers from their settings pages; bots also from chips under the chat composer, removable there - "Every bot" now gives one to every bot now and every new bot; each can still drop it (attach-every-bot-extensions.ts moves old installs over) - Status lines: MCP servers record whether they connect, tools whether their last run worked - Test connection in the MCP form and a Test panel in the tool form check the form as it is, without saving - Hide Google sign-in on the login form Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-19 15:35:13 +01:00
parent c6ec7d77a2
commit 6294b911e6
69 changed files with 2026 additions and 271 deletions
@@ -0,0 +1,56 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabBotExtensionsOverview from "@/src/functions/backend/db/extensions/grab-bot-extensions-overview";
+import setBotExtension from "@/src/functions/backend/db/extensions/set-bot-extension";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SetBotExtensionRequestSchema } from "@/src/schemas/extension-schema";
+import type { BotExtensionsPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Super admins and admins (the super admin alone for the coordinator):
+ * gives a bot an MCP server or tool.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<BotExtensionsPayload>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { bot_id, kind, id, workspace_id } = parseWithSchema({ schema: SetBotExtensionRequestSchema, data: body });
+        const { bot, name } = await setBotExtension({ user_id: user.id, bot_id, kind, id, attached: true });
+
+        await logEvent({
+            title: "Bot tool added",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} gave ${kind == "mcp" ? "the MCP server" : "the tool"} ${name} to ${bot.name} (#${bot.id}).`,
+            metadata: { bot_id, kind, id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `Added ${name}.`,
+            singleRes: await grabBotExtensionsOverview({ user_id: user.id, bot_id, workspace_id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,57 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabBotExtensionsOverview from "@/src/functions/backend/db/extensions/grab-bot-extensions-overview";
+import setBotExtension from "@/src/functions/backend/db/extensions/set-bot-extension";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SetBotExtensionRequestSchema } from "@/src/schemas/extension-schema";
+import type { BotExtensionsPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Super admins and admins (the super admin alone for the coordinator):
+ * takes an MCP server or tool from a bot, even one every bot started
+ * with.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<BotExtensionsPayload>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { bot_id, kind, id, workspace_id } = parseWithSchema({ schema: SetBotExtensionRequestSchema, data: body });
+        const { bot, name } = await setBotExtension({ user_id: user.id, bot_id, kind, id, attached: false });
+
+        await logEvent({
+            title: "Bot tool removed",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} took ${kind == "mcp" ? "the MCP server" : "the tool"} ${name} from ${bot.name} (#${bot.id}).`,
+            metadata: { bot_id, kind, id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `Removed ${name}.`,
+            singleRes: await grabBotExtensionsOverview({ user_id: user.id, bot_id, workspace_id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,44 @@
+import grabSuperAdminUser from "@/src/functions/backend/backups/grab-super-admin-user";
+import testMcpDraft from "@/src/functions/backend/db/extensions/test-mcp-draft";
+import { TestMcpServerRequestSchema } from "@/src/schemas/extension-schema";
+import type { McpServerTestPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Super admin only: connects to an MCP server as the form has it, saved or
+ * not, and returns its tools or why it didn't connect. Nothing is saved.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<McpServerTestPayload>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const user = await grabSuperAdminUser({ req });
+
+        if (!user?.id) {
+            throw new AppError(`Only a super admin can do that.`);
+        }
+
+        const data = parseWithSchema({ schema: TestMcpServerRequestSchema, data: body });
+        const result = await testMcpDraft({ data });
+
+        return {
+            success: true,
+            msg: result.ok
+                ? `Connected: ${result.tools.length} ${result.tools.length == 1 ? "tool" : "tools"}.`
+                : `Couldn't connect.`,
+            singleRes: result.ok ? { ok: true, tools: result.tools } : { ok: false, tools: [], error: result.error },
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -1,4 +1,5 @@
 import grabSuperAdminUser from "@/src/functions/backend/backups/grab-super-admin-user";
+import grabToolsOverview from "@/src/functions/backend/db/extensions/grab-tools-overview";
 import testCustomTool from "@/src/functions/backend/db/extensions/test-custom-tool";
 import { TestCustomToolRequestSchema } from "@/src/schemas/extension-schema";
 import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
@@ -12,8 +13,9 @@ import type {
 } from "@moduletrace/bunext/types";

 /**
- * Super admin only: runs a custom tool once with sample arguments and
- * returns what a bot would read.
+ * Super admin only: runs a custom tool (saved, or as its form has it)
+ * once with sample arguments and
+ * returns what a bot would read, with the page data (its new status).
 */
 export const handler: BunextAPIRouteHandler<
    APIResponseObject<CustomToolTestPayload>
@@ -29,19 +31,23 @@ export const handler: BunextAPIRouteHandler<
            throw new AppError(`Only a super admin can do that.`);
        }

-        const { custom_tool_id, args, computer_id } = parseWithSchema({ schema: TestCustomToolRequestSchema, data: body });
-        const output = await testCustomTool({ custom_tool_id, args, computer_id });
+        const { custom_tool_id, draft, args, computer_id } = parseWithSchema({ schema: TestCustomToolRequestSchema, data: body });
+        const { output, ok } = await testCustomTool({ custom_tool_id, draft, args, computer_id });

        await logEvent({
            title: "Tool tried",
            category: "system",
            user_id: user.id,
-            plain_text: `User #${user.id} tried the tool #${custom_tool_id}.`,
+            plain_text: `User #${user.id} tried ${custom_tool_id ? `the tool #${custom_tool_id}` : "a tool's draft"}.`,
            metadata: { custom_tool_id },
            ip_address: grabRequestIP(req),
        });

-        return { success: true, msg: "Ran it.", singleRes: { output } };
+        return {
+            success: true,
+            msg: ok ? "It worked." : "It failed.",
+            singleRes: { output, ok, overview: await grabToolsOverview({ user_id: user.id }) },
+        };
    } catch (error: unknown) {
        return { success: false, msg: safeErrorMessage({ error }) };
    }
@@ -0,0 +1,56 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabWorkspaceExtensionsOverview from "@/src/functions/backend/db/extensions/grab-workspace-extensions-overview";
+import setWorkspaceExtension from "@/src/functions/backend/db/extensions/set-workspace-extension";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SetWorkspaceExtensionRequestSchema } from "@/src/schemas/extension-schema";
+import type { BotExtensionsPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Super admins and admins: gives a workspace an MCP server or tool, which
+ * every bot working there gets, there.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<BotExtensionsPayload>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, kind, id } = parseWithSchema({ schema: SetWorkspaceExtensionRequestSchema, data: body });
+        const { workspace, name } = await setWorkspaceExtension({ user_id: user.id, workspace_id, kind, id, attached: true });
+
+        await logEvent({
+            title: "Workspace tool added",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} gave ${kind == "mcp" ? "the MCP server" : "the tool"} ${name} to the workspace ${workspace.name} (#${workspace.id}).`,
+            metadata: { workspace_id, kind, id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `Added ${name}.`,
+            singleRes: await grabWorkspaceExtensionsOverview({ user_id: user.id, workspace_id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,55 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabWorkspaceExtensionsOverview from "@/src/functions/backend/db/extensions/grab-workspace-extensions-overview";
+import setWorkspaceExtension from "@/src/functions/backend/db/extensions/set-workspace-extension";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SetWorkspaceExtensionRequestSchema } from "@/src/schemas/extension-schema";
+import type { BotExtensionsPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Super admins and admins: takes an MCP server or tool from a workspace.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<BotExtensionsPayload>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, kind, id } = parseWithSchema({ schema: SetWorkspaceExtensionRequestSchema, data: body });
+        const { workspace, name } = await setWorkspaceExtension({ user_id: user.id, workspace_id, kind, id, attached: false });
+
+        await logEvent({
+            title: "Workspace tool removed",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} took ${kind == "mcp" ? "the MCP server" : "the tool"} ${name} from the workspace ${workspace.name} (#${workspace.id}).`,
+            metadata: { workspace_id, kind, id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `Removed ${name}.`,
+            singleRes: await grabWorkspaceExtensionsOverview({ user_id: user.id, workspace_id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};