feat(api): backend prereqs for CLI v1

Merged
SA
6mo ago
+425-205

Summary

Lands the cloud + desktop changes the new CLI depends on, ahead of the CLI itself, so the next CLI PR can stack cleanly.

  • task router: task.list (filters + pagination), task.byIdOrSlug, task.create. Keeps task.all and task.createFromUi as deprecated aliases so the shipped CLI on main keeps compiling against this backend during the rollout. task.update accepts-but-ignores the deprecated branch field for the same reason.
  • automation router: list / create / update / delete / run-now shape the CLI talks to.
  • host router: list / checkAccess / setOnline shape the CLI talks to.
  • v2-workspace router: workspace.list and create entry points the CLI uses.
  • web: cli/authorize and oauth/consent flows + pendingAuthRedirect util.
  • desktop / mobile: drop unused sessionHosts collection registrations.
  • host-service: project router shape adjustments.

CLI sources land in a follow-up PR stacked on top of this one.

Test plan

  • bun run typecheck clean
  • bun run lint:fix clean
  • CLI on main continues to compile/run against this backend (deprecated aliases verified)
  • task.list filters (priority/status/assignee/search) return expected rows
  • automation create + dispatch works end-to-end
  • cli/authorize + oauth/consent round-trip on web

Summary by cubic

Preps the backend for CLI v1 with new task/host/workspace/automation endpoints and improved sign-in redirects. Also tightens CLI OAuth callback validation, adds stricter automation input checks, and improves JWT auth fallback.

  • New Features

    • Tasks: added task.list (filters + pagination incl. assigneeMe, creatorMe, search), task.byIdOrSlug, and unified task.create; kept task.all and task.createFromUi as temporary aliases; task.update accepts-but-ignores deprecated branch.
    • Automation: list/create/update/delete/run-now; create accepts v2ProjectId or v2WorkspaceId and derives the project when a workspace is given; one of the two is required.
    • Hosts: added host.list scoped to the user’s orgs and membership.
    • Workspaces: added v2-workspace.list with org and optional host filter; includes project info.
    • Web: /cli/authorize and /oauth/consent now rely on proxy to preserve and restore the full path + query via ?redirect=....

  • Bug Fixes

    • Automation: create now validates v2ProjectId and v2WorkspaceId consistency (must match when both provided) and verifies v2ProjectId belongs to the org when no workspace is given.
    • CLI OAuth: tightened redirect_uri validation by parsing with URL and requiring http loopback with no userinfo.
    • Auth: jwtProcedure now re-throws TRPCError from verifyJWT and falls back to session only for unverifiable tokens; clearer bearer token errors.
    • Tasks: task.list search escapes % and _ before building the ilike pattern.

Summary by CodeRabbit

  • New Features

    • Task listing with filters and lookup by ID or slug
    • New host and workspace listing endpoints (organization-scoped)
    • Project list now returns richer project metadata

  • Bug Fixes

    • Preserves original destination when redirecting to sign-in
    • Improved JWT handling with clearer error messaging and session fallback
    • Tighter redirect URI validation for CLI/oauth flows

  • Refactor

    • Unified task creation flow; removed automatic remote task-create calls from local insert hooks