officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

apify tool, tools API + automation UI, integrations config, super admin restrictions

Browse Source 
- apify tool: TOOL.md definition, index.ts implementation with auto-auth via OFFICER_APIFY_TOKEN, output_path for large datasets
- tools API: /tools routes (list, detail, chat, create, delete) mirroring tasks pattern
- automation UI: tools tab in sidebar, NewTool component, tool detail view
- apify integration: settings page for enterprise API key config, pi-bridge passes env var to containers
- tiktok-trends task: rewritten as agent instructions using apify tool with output_path, scripted report generation for 50KB read limit
- restrict edit/delete of native/global capabilities to Super Admin only (backend + frontend)
- tools authoring guide: TOOLS.md with full spec for TOOL.md frontmatter, index.ts execute signature, patterns

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-03-02 20:00:45 +00:00
co-authored by Claude Opus 4.6
parent 776738a983
commit bd362dc586
19 changed files with 1059 additions and 149 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/api/integrations/integrations.ts
+34
View File
@@ -33,6 +33,40 @@ integrationsRouter.get('/', async (ctx) => {
return ctx.json([]);
});
// --- Enterprise: Apify config (Super Admin only) ---
type ApifyConfig = { apiToken: string };
export const readApifyConfig = async (): Promise<ApifyConfig | null> => {
const integration = await getServerIntegration('apify');
if (!integration) return null;
const config = integration.config as Record<string, unknown>;
if (!config.apiToken) return null;
return config as unknown as ApifyConfig;
};
integrationsRouter.get('/apify/config', async (ctx) => {
const user = ctx.get('user');
if (user.role !== 'Super Admin') throw FORBIDDEN();
return ctx.json(await readApifyConfig());
});
integrationsRouter.put('/apify/config', async (ctx) => {
const user = ctx.get('user');
if (user.role !== 'Super Admin') throw FORBIDDEN();
const body = ctx.get('body') as { apiToken?: string };
const config = { apiToken: body.apiToken ?? '' };
await upsertServerIntegration('apify', config);
return ctx.json(config);
});
integrationsRouter.get('/apify/status', async (ctx) => {
const config = await readApifyConfig();
return ctx.json({ configured: !!config?.apiToken });
});
// --- Enterprise: Google OAuth config (Super Admin only) ---
integrationsRouter.get('/google/config', async (ctx) => {
src/servers/api/pi/pi-bridge.ts
+14
View File
@@ -190,6 +190,16 @@ async function ensureGoogleTokenFile(userId: number, email: string): Promise<str
return filePath;
}
async function getApifyToken(): Promise<string> {
try {
const integration = await getServerIntegration('apify');
const config = integration?.config as Record<string, string> | undefined;
return config?.apiToken ?? '';
} catch {
return '';
}
}
async function getBrowserRelayEnv(userId: number): Promise<Record<string, string>> {
const port = getRelayPort();
if (!port) return {};
@@ -265,6 +275,7 @@ export async function spawnPi(
const googleConfigHost = await ensureGoogleConfigFile();
await ensureGoogleTokenFile(sandbox.userId, sandbox.email);
const browserRelayEnv = await getBrowserRelayEnv(sandbox.userId);
const apifyToken = await getApifyToken();
const envFlags = [
'-e', `HOME=${containerHome}`,
@@ -276,6 +287,7 @@ export async function spawnPi(
'-e', `OFFICER_GOOGLE_CONFIG_PATH=/officer/google-oauth.json`,
'-e', `OFFICER_GOOGLE_TOKEN_PATH=/officer/user/integrations/google.json`,
'-e', `OFFICER_EMAIL_DB=/officer/emails.db`,
...(apifyToken ? ['-e', `OFFICER_APIFY_TOKEN=${apifyToken}`] : []),
...Object.entries(browserRelayEnv).flatMap(([k, v]) => ['-e', `${k}=${v}`]),
];
@@ -321,6 +333,7 @@ export async function spawnPi(
const googleConfigPath = await ensureGoogleConfigFile();
const googleTokenPath = await ensureGoogleTokenFile(userId, email);
const browserRelayEnv = await getBrowserRelayEnv(userId);
const apifyTokenLocal = await getApifyToken();
proc = Bun.spawn(args, {
cwd,
@@ -339,6 +352,7 @@ export async function spawnPi(
OFFICER_GOOGLE_CONFIG_PATH: googleConfigPath,
OFFICER_GOOGLE_TOKEN_PATH: googleTokenPath,
OFFICER_EMAIL_DB: join(DATA_PATH, email, 'emails.db'),
...(apifyTokenLocal ? { OFFICER_APIFY_TOKEN: apifyTokenLocal } : {}),
...browserRelayEnv,
},
});
src/servers/api/processes/processes.ts
+1 -1
View File
@@ -54,7 +54,7 @@ function resolveFile(name: string, native: Map<string, string>, global: Map<stri
}
function isPrivileged(role: string) {
return role === 'Admin' || role === 'Owner' || role === 'Super Admin';
return role === 'Super Admin';
}
export const processesRouter = createRouter();
src/servers/api/server-settings/resources.ts
+1 -1
View File
@@ -41,7 +41,7 @@ function mergeConfig(native: Record<string, string>, global: Record<string, stri
}
function isPrivileged(role: string) {
return role === 'Admin' || role === 'Owner' || role === 'Super Admin';
return role === 'Super Admin';
}
export async function readResourceConfig(name: string): Promise<Record<string, string>> {
src/servers/api/skills/skills.ts
+1 -1
View File
@@ -41,7 +41,7 @@ export async function readSkillDirs(dir: string): Promise<Map<string, string>> {
type Scope = 'native' | 'global' | 'user';
function isPrivileged(role: string) {
return role === 'Admin' || role === 'Owner' || role === 'Super Admin';
return role === 'Super Admin';
}
function resolveScope(dirName: string, native: Map<string, string>, global: Map<string, string>, user: Map<string, string>): Scope {
src/servers/api/tasks/tasks.ts
+1 -1
View File
@@ -73,7 +73,7 @@ function resolveFile(name: string, native: Map<string, string>, global: Map<stri
}
function isPrivileged(role: string) {
return role === 'Admin' || role === 'Owner' || role === 'Super Admin';
return role === 'Super Admin';
}
export const tasksRouter = createRouter();
src/servers/api/tools/tools.ts
+217
View File
@@ -0,0 +1,217 @@
import { createRouter } from '../../create-router';
import { readdir, mkdir, rm } from 'node:fs/promises';
import { join, dirname } from 'node:path';
import { getNativeToolsDir, getGlobalToolsDir, getUserToolsDir } from '../../data-path';
type Frontmatter = {
name: string;
description: string;
};
export function parseFrontmatter(raw: string): { frontmatter: Frontmatter; body: string; rawYaml: string } {
const match = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
if (!match) return { frontmatter: { name: '', description: '' }, body: raw, rawYaml: '' };
const yaml = match[1]!;
const body = match[2]!;
const name = yaml.match(/^name:\s*(.+)$/m)?.[1]?.trim() ?? '';
const description = yaml.match(/^description:\s*(.+)$/m)?.[1]?.trim() ?? '';
return { frontmatter: { name, description }, body, rawYaml: yaml };
}
export async function readToolDirs(dir: string): Promise<Map<string, string>> {
const result = new Map<string, string>();
try {
const entries = await readdir(dir, { withFileTypes: true });
for (const entry of entries) {
if (!entry.isDirectory()) continue;
const toolFile = join(dir, entry.name, 'TOOL.md');
if (await Bun.file(toolFile).exists()) {
result.set(entry.name, toolFile);
}
}
} catch {
// directory doesn't exist yet
}
return result;
}
type Scope = 'native' | 'global' | 'user';
function resolveScope(dirName: string, native: Map<string, string>, global: Map<string, string>, user: Map<string, string>): Scope {
if (user.has(dirName)) return 'user';
if (global.has(dirName)) return 'global';
return 'native';
}
function resolveFile(name: string, native: Map<string, string>, global: Map<string, string>, user: Map<string, string>): { filePath: string; scope: Scope } | null {
if (user.has(name)) return { filePath: user.get(name)!, scope: 'user' };
if (global.has(name)) return { filePath: global.get(name)!, scope: 'global' };
if (native.has(name)) return { filePath: native.get(name)!, scope: 'native' };
return null;
}
function isPrivileged(role: string) {
return role === 'Super Admin';
}
export const toolsRouter = createRouter();
toolsRouter.get('/', async (ctx) => {
const user = ctx.get('user');
const nativeTools = await readToolDirs(getNativeToolsDir());
const globalTools = await readToolDirs(getGlobalToolsDir());
const userTools = await readToolDirs(getUserToolsDir(user.email));
const merged = new Map(nativeTools);
for (const [name, path] of globalTools) merged.set(name, path);
for (const [name, path] of userTools) merged.set(name, path);
const tools = await Promise.all(
Array.from(merged.entries()).map(async ([dirName, filePath]) => {
const raw = await Bun.file(filePath).text();
const { frontmatter } = parseFrontmatter(raw);
const scope = resolveScope(dirName, nativeTools, globalTools, userTools);
return {
dirName,
name: frontmatter.name || dirName,
description: frontmatter.description,
scope,
filePath,
};
}),
);
return ctx.json(tools);
});
toolsRouter.get('/:name', async (ctx) => {
const user = ctx.get('user');
const name = ctx.req.param('name');
const nativeTools = await readToolDirs(getNativeToolsDir());
const globalTools = await readToolDirs(getGlobalToolsDir());
const userTools = await readToolDirs(getUserToolsDir(user.email));
const resolved = resolveFile(name, nativeTools, globalTools, userTools);
if (!resolved) return ctx.text('Not found', 404);
const raw = await Bun.file(resolved.filePath).text();
const { frontmatter, body, rawYaml } = parseFrontmatter(raw);
const chatMeta = join(dirname(resolved.filePath), 'chat', 'meta.json');
const chatSessionId = await Bun.file(chatMeta).json().then((m: { id: string }) => m.id).catch(() => null);
return ctx.json({
name: frontmatter.name || name,
description: frontmatter.description,
scope: resolved.scope,
body,
rawFrontmatter: rawYaml,
filePath: resolved.filePath,
chatSessionId,
});
});
toolsRouter.get('/:name/chat', async (ctx) => {
const user = ctx.get('user');
const name = ctx.req.param('name');
const nativeTools = await readToolDirs(getNativeToolsDir());
const globalTools = await readToolDirs(getGlobalToolsDir());
const userTools = await readToolDirs(getUserToolsDir(user.email));
const resolved = resolveFile(name, nativeTools, globalTools, userTools);
if (!resolved) return ctx.text('Not found', 404);
const chatDir = join(dirname(resolved.filePath), 'chat');
const sessionId = await Bun.file(join(chatDir, 'meta.json')).json().then((m: { id: string }) => m.id).catch(() => null);
const messages = await Bun.file(join(chatDir, 'messages.json')).json().catch(() => []);
return ctx.json({ sessionId, messages });
});
toolsRouter.put('/:name/chat', async (ctx) => {
const user = ctx.get('user');
const name = ctx.req.param('name');
const nativeTools = await readToolDirs(getNativeToolsDir());
const globalTools = await readToolDirs(getGlobalToolsDir());
const userTools = await readToolDirs(getUserToolsDir(user.email));
const resolved = resolveFile(name, nativeTools, globalTools, userTools);
if (!resolved) return ctx.text('Not found', 404);
if (resolved.scope !== 'user' && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
const chatDir = join(dirname(resolved.filePath), 'chat');
const { sessionId, messages } = await ctx.req.json<{ sessionId: string; messages: unknown[] }>();
await mkdir(chatDir, { recursive: true });
await Bun.write(join(chatDir, 'messages.json'), JSON.stringify(messages));
if (sessionId) await Bun.write(join(chatDir, 'meta.json'), JSON.stringify({ id: sessionId }));
return ctx.json({ ok: true });
});
toolsRouter.delete('/:name/chat', async (ctx) => {
const user = ctx.get('user');
const name = ctx.req.param('name');
const nativeTools = await readToolDirs(getNativeToolsDir());
const globalTools = await readToolDirs(getGlobalToolsDir());
const userTools = await readToolDirs(getUserToolsDir(user.email));
const resolved = resolveFile(name, nativeTools, globalTools, userTools);
if (!resolved) return ctx.text('Not found', 404);
if (resolved.scope !== 'user' && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
const chatDir = join(dirname(resolved.filePath), 'chat');
await rm(chatDir, { recursive: true, force: true });
return ctx.json({ ok: true });
});
toolsRouter.post('/', async (ctx) => {
const user = ctx.get('user');
const { name } = await ctx.req.json<{ name: string }>();
if (!name?.trim()) return ctx.text('Name is required', 400);
const dirName = name.trim().toLowerCase().replace(/\s+/g, '-').replace(/[^a-z0-9-]/g, '');
if (!dirName) return ctx.text('Invalid name', 400);
const targetDir = isPrivileged(user.role) ? getGlobalToolsDir() : getUserToolsDir(user.email);
const scope: Scope = isPrivileged(user.role) ? 'global' : 'user';
const dir = join(targetDir, dirName);
const filePath = join(dir, 'TOOL.md');
if (await Bun.file(filePath).exists()) {
return ctx.text('Tool already exists', 409);
}
await mkdir(dir, { recursive: true });
await Bun.write(filePath, `---\nname: ${name.trim()}\ndescription: \n---\n`);
return ctx.json({ name: name.trim(), dirName, filePath, scope });
});
toolsRouter.delete('/:name', async (ctx) => {
const user = ctx.get('user');
const name = ctx.req.param('name');
const nativeTools = await readToolDirs(getNativeToolsDir());
const globalTools = await readToolDirs(getGlobalToolsDir());
const userTools = await readToolDirs(getUserToolsDir(user.email));
const resolved = resolveFile(name, nativeTools, globalTools, userTools);
if (!resolved) return ctx.text('Not found', 404);
if (resolved.scope !== 'user' && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
await rm(dirname(resolved.filePath), { recursive: true });
return ctx.json({ ok: true });
});