fix(api): unblock provider terms review and link to data source settings

Draft
DE
1mo ago
+148-6

Summary

Authenticated teams without exchangeRetrieve currently receive 403 when the CLI or MCP asks to read provider terms, before a user can review the agreement. Allow the GET provider-terms routes through the authenticated proxy, retaining team identity and existing write/acceptance checks.

Terms-required responses now link to the dashboard's existing /app/settings?tab=data-sources acceptance surface instead of provider pages reported to return 404. Provider and version remain in both the structured action and message.

Validation

  • 27 tests pass: real Express route requests with mocked authentication/upstream for successful review, unauthenticated refusal, gated ledger writes, missing organization and acceptance authority refusal; existing Exchange routing and terms-action tests.
  • Prettier and git diff --check pass.
  • Full TypeScript check is blocked by missing OpenTelemetry packages in the existing local dependency installation; no diagnostics in changed files.
  • Dashboard destination verified against web settings route implementation; deployment acceptance flow has not been tested. Keep draft pending deployment validation.

Related: https://github.com/firecrawl/exchange/issues/563 and https://github.com/firecrawl/exchange/issues/540.
Client follow-ups: https://github.com/firecrawl/cli/pull/246 and https://github.com/firecrawl/firecrawl-mcp-server/pull/405.

Summary by cubic

Unblocks provider terms review for authenticated teams without exchangeRetrieve, so CLI and MCP users can read terms before accepting. Terms-required responses now link to /app/settings?tab=data-sources instead of provider pages that return 404.

Bug Fixes

  • GET /provider-terms routes now proxy with requiresRetrieveFlag: false, keeping team identity; POST accept/events routes keep the existing flag and org/authority checks.
  • Provider and version stay in the structured action and message; deployment acceptance flow isn't tested yet, so keep the PR draft until validated.
  • Related: firecrawl/exchange#563 and firecrawl/exchange#540; client follow-ups in firecrawl/cli#246 and firecrawl/firecrawl-mcp-server#405.