mirror of
https://github.com/onyx-dot-app/onyx.git
synced 2026-10-22 11:22:49 -05:00
Wenxi
e9c36400a7
## Description Give each user and scheduled task its own action settings. Workspace-disabled actions always remain blocked. Admins can require workspace settings or let users choose their own settings. Scheduled tasks now show app and MCP cards. Apps start disabled. When creating a task, enabling an app copies the user's current settings. Existing tasks keep their saved choices when apps are enabled again; missing choices require approval. Later requests use the task's saved settings and current workspace restrictions. One migration replaces app-wide task pre-approvals with per-action settings. Existing tasks receive auto-approval only for known actions in apps they already pre-approved. Apps remain enabled even if they have no known actions. New actions require approval. The migration remains with the code that reads the new tables. Action recognition identifies the request. One policy resolver then applies workspace restrictions, task membership, personal or task settings, and session grants. Failed recognition or policy lookup blocks the request. A completed scheduled session cannot use personal settings for later requests. The next PR adds app settings editors. This PR includes the task editor because its payload changes with the task API. ## How Has This Been Tested? The complete stack passed 71 local Kind scenario checks, covering browser editing, persistence, access restrictions, real proxy requests, and scheduled execution. Checks include a real 180-second approval timeout, live policy changes, and completed-task request rejection. This PR’s intermediate tree passed 1,053 backend unit tests, 148 database tests, five route-contract tests, and 39 frontend tests. Python and TypeScript checks and changed-file pre-commit checks passed. No migration was applied to the user's database during this verification. ## Additional Options - [ ] [Optional] Please cherry-pick this PR to the latest release version. - [x] [Optional] Override Linear Check <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added per-action approval settings for connected apps and MCP tools, with workspace, personal, and scheduled-task controls. * Scheduled tasks can enable apps and configure individual actions when creating or editing tasks; settings are also visible on task details. New tasks start with apps disabled. * Policy editors support searching, bulk changes, and resetting editable choices. * **Security & Permissions** * Workspace restrictions remain binding, and task settings are checked during active runs. * Actions requiring approval still prompt users when app credentials are unavailable. <!-- end of auto-generated comment: release notes by coderabbit.ai -->