Scope tool policies to the account they are set under

Merged
RH
2mo ago
+257-67

On the integration Tools tab, a policy set from a row inside an account section used to write a connection-wildcarded pattern (integration.*.*.tool). With two connections of one integration, blocking a tool under one account blocked it under the other too.

  • Rows inside an account section now write integration.<owner>.<connection>.tool; category rows write integration.<owner>.<connection>.group.*.
  • Each account header gets a menu that sets a rule for the whole connection (integration.<owner>.<connection>.*).
  • The tool detail badge uses the same account-pinned pattern, so it recognizes its own rule.
  • Members no longer see policy menus they cannot use. The server refuses org policy writes from non-admins.
  • messageFromExit now reads message from error instances whose message is a getter, so a refused write shows the server's reason instead of a generic failure. The duplicate decoder in integration-add.tsx reuses it.

The flat Tools page keeps the connection-agnostic form.

Verified: react unit tests, policies-ui and selfhost integration-creation-permissions e2e scenarios.