rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Default access source org across GraphQL and MCP

Browse Source 
Org-defaulting for picker providers only ran in the GraphQL resolver,
so a picker-provider source created or updated through the MCP API
connected fine but resolved no users until the org was picked. Move
the defaulting into the accessreview service as
AutoSelectDefaultOrganization and call it from both surfaces, moving
the providerOrgConfigs picker dispatch alongside it (the three console
picker resolvers now dispatch through service accessors, behavior
unchanged).

Also harden the moved path: resolve the provider from cheap connector
metadata before building the authenticated HTTP client, so the ~50
non-picker providers no longer pay a decrypt/refresh/DB-write on every
create/update; bound the outbound ListOrgs call with a 10s timeout so
a hung provider cannot stall the mutation; and re-check inside the
ConfigureAccessReviewSource tx (OnlyIfUnset) so an org the user picks
while ListOrgs is in flight is not overwritten by the first listed
org.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-07-22 14:46:08 +02:00
parent f711e9d816
commit 2971637c72
4 changed files with 236 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/server/api/mcp/v1/schema.resolvers.go
View File

@@ -3679,6 +3679,8 @@ func (r *Resolver) CreateAccessReviewSourceTool(ctx context.Context, req *mcp.Ca
return nil, types.CreateAccessReviewSourceOutput{}, fmt.Errorf("cannot create access source: %w", err)
}
r.accessReview.AutoSelectDefaultOrganization(ctx, scope, source)
return nil, types.CreateAccessReviewSourceOutput{
AccessReviewSource: types.NewAccessReviewSource(source),
}, nil
@@ -3700,7 +3702,11 @@ func (r *Resolver) UpdateAccessReviewSourceTool(ctx context.Context, req *mcp.Ca
updateReq.Name = &input.Name
}
connectorSet := false
if rawConnectorID := UnwrapOmittable(input.ConnectorID); rawConnectorID != nil {
connectorSet = true
if *rawConnectorID != nil {
id, err := gid.ParseGID(**rawConnectorID)
if err != nil {
@@ -3725,6 +3731,13 @@ func (r *Resolver) UpdateAccessReviewSourceTool(ctx context.Context, req *mcp.Ca
return nil, types.UpdateAccessReviewSourceOutput{}, fmt.Errorf("cannot update access source: %w", err)
}
// A connector was just (re)linked: default its org so the source is
// usable right away. Matches the GraphQL surface; skipped on name/CSV-only
// updates to avoid a needless provider round-trip.
if connectorSet {
r.accessReview.AutoSelectDefaultOrganization(ctx, scope, source)
}
return nil, types.UpdateAccessReviewSourceOutput{
AccessReviewSource: types.NewAccessReviewSource(source),
}, nil