feat(auth): separate environment administration permissions

apps/mobile/src/features/agent-awareness/liveActivityPreferences.test.ts

@@ -25,7 +25,14 @@ vi.mock("react-native", () => ({
   Platform: { OS: "ios" },
 }));
 
-vi.mock("../cloud/linkEnvironment", () => ({
+vi.mock("expo-constants", () => ({
+  default: { expoConfig: {} },
+}));
+
+vi.mock("expo-device", () => ({}));
+
+vi.mock("../cloud/linkEnvironment", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("../cloud/linkEnvironment")>()),
   linkEnvironmentToCloudWithPreference: vi.fn(() => Effect.void),
 }));
 
@@ -78,6 +85,7 @@ describe("liveActivityPreferences", () => {
         previousEnabled: true,
         clerkToken: "clerk-token",
         connections: [connection],
+        canConfigureEnvironment: () => true,
       });
 
       expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledWith({
@@ -98,6 +106,7 @@ describe("liveActivityPreferences", () => {
         previousEnabled: false,
         clerkToken: "clerk-token",
         connections: [connection],
+        canConfigureEnvironment: () => true,
       });
 
       expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledWith({
@@ -118,6 +127,7 @@ describe("liveActivityPreferences", () => {
         previousEnabled: true,
         clerkToken: null,
         connections: [connection],
+        canConfigureEnvironment: () => true,
       });
 
       expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledWith({
@@ -139,6 +149,7 @@ describe("liveActivityPreferences", () => {
         previousEnabled: false,
         clerkToken: "clerk-token",
         connections: [connection, managedConnection],
+        canConfigureEnvironment: () => true,
       });
 
       expect(linkEnvironmentToCloudWithPreference).toHaveBeenCalledTimes(1);
@@ -162,6 +173,7 @@ describe("liveActivityPreferences", () => {
           previousEnabled: true,
           clerkToken: "clerk-token",
           connections: [connection],
+          canConfigureEnvironment: () => true,
         }),
       );
 
@@ -184,4 +196,105 @@ describe("liveActivityPreferences", () => {
       });
     }).pipe(Effect.provide(testLayer));
   });
+
+  it.effect("only re-links environments with relay access when enabling updates", () => {
+    const readOnlyConnection: SavedRemoteConnection = {
+      ...connection,
+      environmentId: "read-only" as EnvironmentId,
+    };
+
+    return Effect.gen(function* () {
+      yield* setLiveActivityUpdatesEnabled({
+        enabled: true,
+        previousEnabled: false,
+        clerkToken: "clerk-token",
+        connections: [readOnlyConnection, connection],
+        canConfigureEnvironment: (environmentId) => environmentId === connection.environmentId,
+      });
+
+      expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledWith({
+        liveActivitiesEnabled: true,
+      });
+      expect(linkEnvironmentToCloudWithPreference).toHaveBeenCalledExactlyOnceWith({
+        clerkToken: "clerk-token",
+        connection,
+        liveActivitiesEnabled: true,
+      });
+    }).pipe(Effect.provide(testLayer));
+  });
+
+  it.effect("keeps device updates independently switchable without relay access", () =>
+    Effect.gen(function* () {
+      for (const enabled of [false, true]) {
+        yield* setLiveActivityUpdatesEnabled({
+          enabled,
+          previousEnabled: !enabled,
+          clerkToken: "clerk-token",
+          connections: [connection],
+          canConfigureEnvironment: () => false,
+        });
+      }
+
+      expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenNthCalledWith(1, {
+        liveActivitiesEnabled: false,
+      });
+      expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenNthCalledWith(2, {
+        liveActivitiesEnabled: true,
+      });
+      expect(linkEnvironmentToCloudWithPreference).not.toHaveBeenCalled();
+    }).pipe(Effect.provide(testLayer)),
+  );
+
+  it.effect("checks current relay access after updating the device registration", () => {
+    let canConfigureEnvironment = true;
+    vi.mocked(updateAgentAwarenessRegistrationPreferences).mockImplementationOnce(() =>
+      Effect.sync(() => {
+        canConfigureEnvironment = false;
+      }),
+    );
+
+    return Effect.gen(function* () {
+      yield* setLiveActivityUpdatesEnabled({
+        enabled: false,
+        previousEnabled: true,
+        clerkToken: "clerk-token",
+        connections: [connection],
+        canConfigureEnvironment: () => canConfigureEnvironment,
+      });
+
+      expect(linkEnvironmentToCloudWithPreference).not.toHaveBeenCalled();
+      expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenCalledTimes(1);
+    }).pipe(Effect.provide(testLayer));
+  });
+
+  it.effect("does not retry environment changes after relay access is revoked", () => {
+    let canConfigureEnvironment = true;
+    vi.mocked(linkEnvironmentToCloudWithPreference).mockImplementationOnce(() =>
+      Effect.sync(() => {
+        canConfigureEnvironment = false;
+      }).pipe(
+        Effect.andThen(
+          Effect.fail(new CloudEnvironmentLinkError({ message: "relay access revoked" })),
+        ),
+      ),
+    );
+
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        setLiveActivityUpdatesEnabled({
+          enabled: false,
+          previousEnabled: true,
+          clerkToken: "clerk-token",
+          connections: [connection],
+          canConfigureEnvironment: () => canConfigureEnvironment,
+        }),
+      );
+
+      expect(exit._tag).toBe("Failure");
+      expect(linkEnvironmentToCloudWithPreference).toHaveBeenCalledTimes(1);
+      expect(updateAgentAwarenessRegistrationPreferences).toHaveBeenNthCalledWith(2, {
+        liveActivitiesEnabled: true,
+      });
+    }).pipe(Effect.provide(testLayer));
+  });
 });

apps/mobile/src/features/agent-awareness/liveActivityPreferences.ts

@@ -1,4 +1,5 @@
 import * as Effect from "effect/Effect";
+import type { EnvironmentId } from "@t3tools/contracts";
 
 import type { SavedRemoteConnection } from "../../lib/connection";
 import { linkEnvironmentToCloudWithPreference } from "../cloud/linkEnvironment";
@@ -10,11 +11,26 @@ export const setLiveActivityUpdatesEnabled = Effect.fn("setLiveActivityUpdatesEn
     readonly previousEnabled: boolean;
     readonly clerkToken: string | null;
     readonly connections: ReadonlyArray<SavedRemoteConnection>;
+    readonly canConfigureEnvironment: (environmentId: EnvironmentId) => boolean;
   }) {
     const linkedConnections = input.connections.filter(
       (connection) => connection.bearerToken !== null,
     );
 
+    const updateEnvironmentPreference = Effect.fn("updateEnvironmentPreference")(function* (
+      connection: SavedRemoteConnection,
+      enabled: boolean,
+      clerkToken: string,
+    ) {
+      if (!input.canConfigureEnvironment(connection.environmentId)) return;
+
+      yield* linkEnvironmentToCloudWithPreference({
+        clerkToken,
+        connection,
+        liveActivitiesEnabled: enabled,
+      });
+    });
+
     const updateRelayPreference = Effect.fn("updateRelayPreference")(function* (enabled: boolean) {
       yield* updateAgentAwarenessRegistrationPreferences({
         liveActivitiesEnabled: enabled,
@@ -25,12 +41,7 @@ export const setLiveActivityUpdatesEnabled = Effect.fn("setLiveActivityUpdatesEn
 
       yield* Effect.forEach(
         linkedConnections,
-        (connection) =>
-          linkEnvironmentToCloudWithPreference({
-            clerkToken,
-            connection,
-            liveActivitiesEnabled: enabled,
-          }),
+        (connection) => updateEnvironmentPreference(connection, enabled, clerkToken),
         { concurrency: "unbounded" },
       );
     });
@@ -50,11 +61,7 @@ export const setLiveActivityUpdatesEnabled = Effect.fn("setLiveActivityUpdatesEn
       yield* Effect.forEach(
         linkedConnections,
         (connection) =>
-          linkEnvironmentToCloudWithPreference({
-            clerkToken,
-            connection,
-            liveActivitiesEnabled: input.previousEnabled,
-          }).pipe(
+          updateEnvironmentPreference(connection, input.previousEnabled, clerkToken).pipe(
             Effect.catchCause((cause) =>
               Effect.logWarning(
                 `Could not restore Live Activity preference for environment ${connection.environmentId}.`,

apps/mobile/src/features/archive/ArchivedThreadsScreen.tsx

@@ -4,6 +4,7 @@ import type {
 } from "@t3tools/client-runtime/state/shell";
 import { LegendList } from "@legendapp/list/react-native";
 import {
+  AuthOrchestrationOperateScope,
   type EnvironmentId,
   type EnvironmentMachineKind,
   resolveEnvironmentMachineKind,
@@ -34,6 +35,7 @@ import { useSafeAreaInsets } from "react-native-safe-area-context";
 import { relativeTime } from "../../lib/time";
 import { useUniwindTheme } from "../../lib/useUniwindTheme";
 import { useServerConfigs } from "../../state/entities";
+import { useEnvironmentScope } from "../../state/session";
 import { ThreadSwipeable } from "../home/thread-swipe-actions";
 import {
   createNativeMailSearchToolbarItem,
@@ -416,22 +418,72 @@ function ArchivedThreadRow(props: {
 }) {
   const { width: windowWidth } = useWindowDimensions();
   const cardColor = useUniwindTheme()["--color-card"];
+  const canOperateThread = useEnvironmentScope(
+    props.thread.environmentId,
+    AuthOrchestrationOperateScope,
+  );
   const timestamp = relativeTime(props.thread.archivedAt ?? props.thread.updatedAt);
   const subtitle = [props.environmentLabel, props.thread.branch].filter((part): part is string =>
     Boolean(part),
   );
+  const rowContent = (
+    <View
+      className={`flex-row items-center gap-3 bg-card px-4 py-3 ${props.isLast ? "" : "border-b border-separator"}`}
+    >
+      <View className="h-[34px] w-[34px] items-center justify-center rounded-[11px] bg-subtle">
+        <SymbolView
+          name="archivebox.fill"
+          size={15}
+          tintColorClassName={"accent-icon-subtle"}
+          type="monochrome"
+        />
+      </View>
+
+      <View className="min-w-0 flex-1 gap-1">
+        <View className="flex-row items-center gap-2">
+          <Text
+            className="min-w-0 flex-1 text-base font-t3-bold leading-snug text-foreground"
+            numberOfLines={1}
+          >
+            {props.thread.title}
+          </Text>
+          <Text className="min-w-[30px] text-right text-xs tabular-nums text-foreground-tertiary">
+            {timestamp}
+          </Text>
+        </View>
+        {subtitle.length > 0 ? (
+          <View className="flex-row items-center gap-1.5">
+            <SymbolView
+              name="arrow.triangle.branch"
+              size={10}
+              tintColorClassName={"accent-icon-subtle"}
+              type="monochrome"
+            />
+            <Text
+              className="min-w-0 flex-1 font-mono text-2xs text-foreground-tertiary"
+              numberOfLines={1}
+            >
+              {subtitle.join(" · ")}
+            </Text>
+          </View>
+        ) : null}
+      </View>
+    </View>
+  );
+  // Keep the group's rounded corners on both interactive and read-only rows.
+  const containerStyle = {
+    borderTopLeftRadius: props.isFirst ? 20 : 0,
+    borderTopRightRadius: props.isFirst ? 20 : 0,
+    borderBottomLeftRadius: props.isLast ? 20 : 0,
+    borderBottomRightRadius: props.isLast ? 20 : 0,
+    overflow: "hidden" as const,
+  };
+  if (!canOperateThread) return <View style={containerStyle}>{rowContent}</View>;
+
   return (
     <ThreadSwipeable
       backgroundColor={cardColor}
-      // Round + clip the swipeable container so the group's corners stay
-      // rounded while rows swipe; the row itself stays square inside.
-      containerStyle={{
-        borderTopLeftRadius: props.isFirst ? 20 : 0,
-        borderTopRightRadius: props.isFirst ? 20 : 0,
-        borderBottomLeftRadius: props.isLast ? 20 : 0,
-        borderBottomRightRadius: props.isLast ? 20 : 0,
-        overflow: "hidden",
-      }}
+      containerStyle={containerStyle}
       fullSwipeWidth={windowWidth - 32}
       onDelete={props.onDelete}
       onSwipeableClose={props.onSwipeableClose}
@@ -445,50 +497,7 @@ function ArchivedThreadRow(props: {
       simultaneousWithExternalGesture={props.simultaneousSwipeGesture}
       threadTitle={props.thread.title}
     >
-      {() => (
-        <View
-          className={`flex-row items-center gap-3 bg-card px-4 py-3 ${props.isLast ? "" : "border-b border-separator"}`}
-        >
-          <View className="h-[34px] w-[34px] items-center justify-center rounded-[11px] bg-subtle">
-            <SymbolView
-              name="archivebox.fill"
-              size={15}
-              tintColorClassName={"accent-icon-subtle"}
-              type="monochrome"
-            />
-          </View>
-
-          <View className="min-w-0 flex-1 gap-1">
-            <View className="flex-row items-center gap-2">
-              <Text
-                className="min-w-0 flex-1 text-base font-t3-bold leading-snug text-foreground"
-                numberOfLines={1}
-              >
-                {props.thread.title}
-              </Text>
-              <Text className="min-w-[30px] text-right text-xs tabular-nums text-foreground-tertiary">
-                {timestamp}
-              </Text>
-            </View>
-            {subtitle.length > 0 ? (
-              <View className="flex-row items-center gap-1.5">
-                <SymbolView
-                  name="arrow.triangle.branch"
-                  size={10}
-                  tintColorClassName={"accent-icon-subtle"}
-                  type="monochrome"
-                />
-                <Text
-                  className="min-w-0 flex-1 font-mono text-2xs text-foreground-tertiary"
-                  numberOfLines={1}
-                >
-                  {subtitle.join(" · ")}
-                </Text>
-              </View>
-            ) : null}
-          </View>
-        </View>
-      )}
+      {() => rowContent}
     </ThreadSwipeable>
   );
 }