[Improve] Derive the AgentMail inbox from an inbox-scoped API key - #2486
Merged
Conversation
An inbox-scoped key passes every inbox check and is then refused on the organization-level webhook endpoints, which read as a permissions problem even for a full-access key. The save now falls back to the inbox's own webhook endpoints on that refusal, records the detected scope so status and disconnect address the same endpoints, and the error names the exact request AgentMail refused when the fallback does not apply. Also fixes the doubled "(optional)" on the Pod ID field and teaches the mock AgentMail server the inbox-scoped webhook routes.
Contributor
![roomote-community[bot]](https://avatars.githubusercontent.com/u/211522643?s=60&v=4){kind=small}
A Roomote deployment owns exactly one inbox, so the intended AgentMail key is one created from inside that inbox. The save now resolves the inbox from the key (it must see exactly one, or the one pinned by R_AGENTMAIL_INBOX_ID) and manages the webhook through the inbox's own endpoints, which is all an inbox-scoped key can reach. That removes the inbox chooser and free-text field, the inbox provisioning path, the pod id field and pod plumbing, and the key-scope detection this PR briefly introduced. Permission errors name the exact refused request.
mrubens
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Saving the Email (AgentMail) settings with an inbox-scoped API key failed with a 403 on the organization-level
/v0/webhooksendpoints, even with every permission enabled. Rather than detect key scopes, this PR makes the inbox-scoped key the intended shape and simplifies setup around it.R_AGENTMAIL_INBOX_ID, which the key must be able to see). A key that sees none or several is refused with copy that names the inboxes and explains how to create an inbox-scoped key. Setup is now: paste key, save./v0/inboxes/{inbox_id}/webhooks), which both inbox-scoped and organization-level keys can reach. Event types converge in place; a drifted URL or a missing secret recreates the registration.listAgentMailInboxesprocedure, the inbox provisioning path, the Pod ID field and pod plumbing, and the key-scope detection this PR briefly introduced.R_AGENTMAIL_POD_IDis dropped from the env schema (it never shipped in a release) and cleaned up on disconnect.Test plan
pnpm check-types,pnpm lint,pnpm knip, docs link check