[comp] Production Deploy

Merged
GI
5mo ago
+4121-375

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

Summary by cubic

Enables keyless hosted MCP via OAuth (Gram) with per-user RBAC, multi‑org support, and a settings org picker. Adds an Overview nudge center and Trust Portal setup prompt, fixes Google Workspace sync timestamps and reactivates users, and prevents large evidence export timeouts.

  • New Features

    • Hosted MCP OAuth: better-auth mcp plugin with a trusted Gram client (env‑driven); exposes /api/auth/mcp/*.
    • Auth: HybridAuthGuard + PermissionGuard accept MCP OAuth bearer tokens, bind org (auto or saved), enforce app‑access, block org‑less users, return 403 to choose org, and bypass for platform admins; consistent RBAC for OAuth tokens.
    • MCP org selection: session‑only, permission‑guarded GET/PUT /v1/mcp/organization; settings UI picker shows only orgs with app access.
    • OpenAPI: declared oauth2 (authorization code) targeting /api/auth/mcp/{authorize,token} and offered alongside the API key; added summaries/descriptions to offboarding endpoints; excluded /v1/mcp/* from public docs; CI enforces summaries/descriptions.
    • MCP server: regenerated @trycompai/mcp-server to v0.0.2 with clearer tool descriptions.
    • Overview nudges: stacked nudge center (Offboarding, Trust Portal setup, Framework updates) with tests; Trust page shows a getting‑started card.
    • Trust Portal: auto‑publish for new orgs via a guarded settings warm‑up; “configured” detection utility powers nudges.
    • Integrations: record lastSyncAt after GWS sync; reactivate previously deactivated users when active again in GWS (clears offboardDate).
    • Tasks/Evidence export: prevent proxy timeouts on large orgs by flushing headers early and appending an EXPORT_INFO.txt first; tests updated.
    • Portal: hide archived policies from employee lists.
    • Build/CI: disabled TS declaration emit; gram.json + workflow to push packages/docs/openapi.json to Gram on main with least‑privilege token.

  • Migration

    • Run Prisma migrations.
    • Configure env in apps/api: GRAM_OAUTH_CLIENT_ID, GRAM_OAUTH_CLIENT_SECRET, GRAM_OAUTH_REDIRECT_URI (optional: MCP_OAUTH_LOGIN_PAGE, MCP_RESOURCE_URL).
    • In GitHub, set repo secret GRAM_API_KEY to enable the Gram sync workflow.