mirror of
https://github.com/mudler/LocalAI.git
synced 2026-11-07 13:03:20 -05:00
Ettore Di Giacinto
e790271c63
A connection now has a write mode, chosen on the add-on page: off (the default), propose (each change waits for the person to confirm) or auto (a chat of the person makes it at once). The host enforces it for every write tool of an add-on that holds a credential, before the add-on is called, and holds the call to the repository list of the connection. Host: - Binding.WriteMode, stored in both stores and in the connector API (write_mode). Absent means off, so existing bindings stay read only. - A credentialed add-on may declare write tools. They name the resource with the credential slot argument, never resourceId. A tool can set approval "always", a ceiling that keeps a proposal even in auto. - The proposal broker fetches the credential for the preview and again for the apply, so it is never stored. A mode lowered between the proposal and the confirmation refuses the apply. A proposal that awaits a person cannot be confirmed by a chat turn. - New capability name tools.write for the roles a connector kind declares. Add-on, tools (kind write): comment-issue, comment-pr, create-issue, edit-issue (title, close or reopen), add-labels, review-comment-pr. They preview plain facts, refuse a stale target, cap and screen the text for secrets, and keep a receipt journal plus a hidden marker in the text, so a change whose answer was lost is not sent twice. Assisted-by: Claude:claude-sonnet-5-5 go gofmt ginkgo node
47 lines
1.5 KiB
Go
47 lines
1.5 KiB
Go
package studio
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/mudler/LocalAI/core/services/studio/connectors"
|
|
)
|
|
|
|
// CredentialGrant is the secret and the allowed resource a tool call of an
|
|
// add-on gets from the binding of its caller.
|
|
type CredentialGrant struct {
|
|
// Secret is the unsealed token of the binding.
|
|
Secret string
|
|
// Resource is the list entry the call named, or the zero value for a call
|
|
// that named none.
|
|
Resource connectors.ResourceEntry
|
|
// WriteMode is the write mode of the binding the secret comes from.
|
|
WriteMode string
|
|
}
|
|
|
|
// CredentialFor finds the binding that a tool call of an add-on uses and
|
|
// opens its token. The binding is one of the user's own for that add-on: the
|
|
// first that lists the resource key, or for a call without a key the first with
|
|
// a token. The error is connectors.ErrNoCredential when the user has no usable
|
|
// binding and a *connectors.NotAllowedError when no list holds the key.
|
|
func (c *Connectors) CredentialFor(ctx context.Context, user, addonID, key string) (CredentialGrant, error) {
|
|
all, err := c.o.Store.ListBindings(ctx, principal(user))
|
|
if err != nil {
|
|
return CredentialGrant{}, err
|
|
}
|
|
var mine []connectors.Binding
|
|
for _, b := range all {
|
|
if b.AddonID == addonID {
|
|
mine = append(mine, b)
|
|
}
|
|
}
|
|
b, entry, err := connectors.Pick(mine, key)
|
|
if err != nil {
|
|
return CredentialGrant{}, err
|
|
}
|
|
secret, err := c.openToken(ctx, b)
|
|
if err != nil {
|
|
return CredentialGrant{}, err
|
|
}
|
|
return CredentialGrant{Secret: secret, Resource: entry, WriteMode: b.Writes()}, nil
|
|
}
|