194c44c
use models::space::spaces;
use space::share::authz::{MANAGE_CHANNELS, effective_permissions};
use uuid::Uuid;
use crate::errors::AgentError;
use crate::services::service::AgentsService;
pub async fn require_collection_manage(
service: &AgentsService,
space: &spaces::Model,
caller: i64,
) -> Result<(), AgentError> {
if space.owner_id == caller {
return Ok(());
}
let perms = effective_permissions(&service.state, space, caller)
.await
.map_err(AgentError::from)?;
if perms.has(MANAGE_CHANNELS) {
Ok(())
} else {
Err(AgentError::Forbidden)
}
}
/// Whether the caller may attach the platform MCP to an agent run: only space
/// owners or members with MANAGE_CHANNELS, and only while an MCP endpoint the
/// sandbox runtime can reach is configured.
pub async fn can_enable_mcp(service: &AgentsService, space: &spaces::Model, caller: i64) -> bool {
mcp_configured(service) && can_manage_mcp(service, space, caller).await
}
/// Permission half of [`can_enable_mcp`], without the configuration check.
pub async fn can_manage_mcp(service: &AgentsService, space: &spaces::Model, caller: i64) -> bool {
if space.owner_id == caller {
return true;
}
match effective_permissions(&service.state, space, caller).await {
Ok(perms) => perms.has(MANAGE_CHANNELS),
Err(_) => false,
}
}
fn mcp_configured(service: &AgentsService) -> bool {
service.config().mcp.enabled() && !service.config().mcp.runtime_url().is_empty()
}