feat(settings): add Files menu to configure org S3 buckets

apps/mesh/migrations/083-org-file-configs.ts

@@ -0,0 +1,44 @@
+import { type Kysely, sql } from "kysely";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+  await db.schema
+    .createTable("org_file_configs")
+    .addColumn("id", "text", (col) => col.primaryKey())
+    .addColumn("organization_id", "text", (col) =>
+      col.notNull().references("organization.id").onDelete("cascade"),
+    )
+    .addColumn("name", "text", (col) => col.notNull())
+    .addColumn("description", "text")
+    .addColumn("bucket", "text", (col) => col.notNull())
+    .addColumn("region", "text", (col) => col.notNull())
+    .addColumn("endpoint", "text")
+    .addColumn("force_path_style", "boolean", (col) =>
+      col.notNull().defaultTo(false),
+    )
+    .addColumn("encrypted_credentials", "text", (col) => col.notNull())
+    .addColumn("created_by", "text", (col) => col.notNull())
+    .addColumn("created_at", "timestamptz", (col) =>
+      col.notNull().defaultTo(sql`CURRENT_TIMESTAMP`),
+    )
+    .addColumn("updated_by", "text", (col) => col.notNull())
+    .addColumn("updated_at", "timestamptz", (col) =>
+      col.notNull().defaultTo(sql`CURRENT_TIMESTAMP`),
+    )
+    .execute();
+
+  await db.schema
+    .createIndex("idx_org_file_configs_org")
+    .on("org_file_configs")
+    .column("organization_id")
+    .execute();
+
+  // Case-insensitive uniqueness within an org.
+  await sql`
+    CREATE UNIQUE INDEX idx_org_file_configs_org_name
+    ON org_file_configs (organization_id, lower(name))
+  `.execute(db);
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  await db.schema.dropTable("org_file_configs").execute();
+}

apps/mesh/migrations/index.ts

@@ -81,6 +81,7 @@ import * as migration079striplegacyfreestylevmmapentries from "./079-strip-legac
 import * as migration080asyncresearchjobs from "./080-async-research-jobs.ts";
 import * as migration081asyncresearchjobsresultcontent from "./081-async-research-jobs-result-content.ts";
 import * as migration082secrets from "./082-secrets.ts";
+import * as migration083orgfileconfigs from "./083-org-file-configs.ts";
 
 /**
  * Core migrations for the Mesh application.
@@ -179,6 +180,7 @@ const migrations: Record<string, Migration> = {
   "081-async-research-jobs-result-content":
     migration081asyncresearchjobsresultcontent,
   "082-secrets": migration082secrets,
+  "083-org-file-configs": migration083orgfileconfigs,
 };
 
 export default migrations;

apps/mesh/src/core/context-factory.ts

@@ -431,6 +431,7 @@ import {
 import { createClientPool } from "@/mcp-clients/outbound/client-pool";
 import { AIProviderKeyStorage } from "@/storage/ai-provider-keys";
 import { SecretStorage } from "@/storage/secrets";
+import { OrgFileConfigStorage } from "@/storage/org-file-configs";
 import { OAuthPkceStateStorage } from "@/storage/oauth-pkce-states";
 import { AIProviderFactory } from "@/ai-providers/factory";
 import type { ModelListCache } from "@/ai-providers/model-list-cache";
@@ -1019,6 +1020,7 @@ export async function createMeshContextFactory(
     virtualMcpPluginConfigs: new VirtualMcpPluginConfigsStorage(config.db),
     aiProviderKeys: new AIProviderKeyStorage(config.db, vault),
     secrets: new SecretStorage(config.db, vault),
+    orgFileConfigs: new OrgFileConfigStorage(config.db, vault),
     oauthPkceStates: new OAuthPkceStateStorage(config.db),
     automations: createAutomationsStorage(config.db),
     triggerCallbackTokens: new KyselyTriggerCallbackTokenStorage(config.db),

apps/mesh/src/core/define-tool.test.ts

@@ -54,6 +54,7 @@ const createMockContext = (): MeshContext => ({
     virtualMcpPluginConfigs: null as never,
     aiProviderKeys: null as never,
     secrets: null as never,
+    orgFileConfigs: null as never,
     oauthPkceStates: null as never,
     automations: null as never,
     orgSsoConfig: null as never,

apps/mesh/src/core/mesh-context.test.ts

@@ -28,6 +28,7 @@ const createMockContext = (overrides?: Partial<MeshContext>): MeshContext => ({
     virtualMcpPluginConfigs: null as never,
     aiProviderKeys: null as never,
     secrets: null as never,
+    orgFileConfigs: null as never,
     oauthPkceStates: null as never,
     automations: null as never,
     orgSsoConfig: null as never,

apps/mesh/src/core/mesh-context.ts

@@ -264,6 +264,7 @@ import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { AIProviderKeyStorage } from "@/storage/ai-provider-keys";
 import { SecretStorage } from "@/storage/secrets";
+import { OrgFileConfigStorage } from "@/storage/org-file-configs";
 import type { OAuthPkceStateStorage } from "@/storage/oauth-pkce-states";
 import { AIProviderFactory } from "@/ai-providers/factory";
 import type { FireAutomationOutcome } from "../automations/dbos-workflow";
@@ -293,6 +294,7 @@ export interface MeshStorage {
   tags: TagStorage;
   aiProviderKeys: AIProviderKeyStorage;
   secrets: SecretStorage;
+  orgFileConfigs: OrgFileConfigStorage;
   oauthPkceStates: OAuthPkceStateStorage;
   automations: AutomationsStorage;
   triggerCallbackTokens: TriggerCallbackTokenStorage;

apps/mesh/src/shared/utils/generate-id.ts

@@ -18,7 +18,8 @@ type IdPrefixes =
   | "dash"
   | "aik"
   | "sec"
-  | "vpc";
+  | "vpc"
+  | "fcfg";
 
 export function generatePrefixedId(prefix: IdPrefixes) {
   return `${prefix}_${nanoid()}`;

apps/mesh/src/storage/org-file-configs.ts

@@ -0,0 +1,252 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+import type { CredentialVault } from "../encryption/credential-vault";
+import type { Database, FileConfigInfo, OrgFileConfigTable } from "./types";
+import { generatePrefixedId } from "@/shared/utils/generate-id";
+
+type FileConfigRow = {
+  id: string;
+  organization_id: string;
+  name: string;
+  description: string | null;
+  bucket: string;
+  region: string;
+  endpoint: string | null;
+  force_path_style: boolean;
+  created_by: string;
+  created_at: Date | string;
+  updated_by: string;
+  updated_at: Date | string;
+};
+
+const PUBLIC_COLUMNS = [
+  "id",
+  "organization_id",
+  "name",
+  "description",
+  "bucket",
+  "region",
+  "endpoint",
+  "force_path_style",
+  "created_by",
+  "created_at",
+  "updated_by",
+  "updated_at",
+] as const satisfies readonly (keyof OrgFileConfigTable)[];
+
+export interface FileConfigCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+}
+
+function toIsoString(value: Date | string): string {
+  return value instanceof Date ? value.toISOString() : String(value);
+}
+
+export class OrgFileConfigNotFoundError extends Error {
+  constructor(identifier: string) {
+    super(`File config ${identifier} not found`);
+    this.name = "OrgFileConfigNotFoundError";
+  }
+}
+
+export class OrgFileConfigStorage {
+  constructor(
+    private db: Kysely<Database>,
+    private vault: CredentialVault,
+  ) {}
+
+  private rowToInfo(row: FileConfigRow): FileConfigInfo {
+    return {
+      id: row.id,
+      organizationId: row.organization_id,
+      name: row.name,
+      description: row.description,
+      bucket: row.bucket,
+      region: row.region,
+      endpoint: row.endpoint,
+      forcePathStyle: row.force_path_style,
+      createdBy: row.created_by,
+      createdAt: toIsoString(row.created_at),
+      updatedBy: row.updated_by,
+      updatedAt: toIsoString(row.updated_at),
+    };
+  }
+
+  async create(params: {
+    organizationId: string;
+    name: string;
+    description?: string | null;
+    bucket: string;
+    region: string;
+    endpoint?: string | null;
+    forcePathStyle?: boolean;
+    credentials: FileConfigCredentials;
+    createdBy: string;
+  }): Promise<FileConfigInfo> {
+    const id = generatePrefixedId("fcfg");
+    const encryptedCredentials = await this.vault.encrypt(
+      JSON.stringify(params.credentials),
+    );
+    const now = new Date();
+
+    const row = await this.db
+      .insertInto("org_file_configs")
+      .values({
+        id,
+        organization_id: params.organizationId,
+        name: params.name,
+        description: params.description ?? null,
+        bucket: params.bucket,
+        region: params.region,
+        endpoint: params.endpoint ?? null,
+        force_path_style: params.forcePathStyle ?? false,
+        encrypted_credentials: encryptedCredentials,
+        created_by: params.createdBy,
+        created_at: now,
+        updated_by: params.createdBy,
+        updated_at: now,
+      })
+      .returning(PUBLIC_COLUMNS)
+      .executeTakeFirstOrThrow();
+
+    return this.rowToInfo(row);
+  }
+
+  async update(params: {
+    id: string;
+    organizationId: string;
+    name?: string;
+    description?: string | null;
+    bucket?: string;
+    region?: string;
+    endpoint?: string | null;
+    forcePathStyle?: boolean;
+    credentials?: FileConfigCredentials;
+    updatedBy: string;
+  }): Promise<FileConfigInfo> {
+    const existing = await this.db
+      .selectFrom("org_file_configs")
+      .where("id", "=", params.id)
+      .where("organization_id", "=", params.organizationId)
+      .select(["id"])
+      .executeTakeFirst();
+
+    if (!existing) throw new OrgFileConfigNotFoundError(params.id);
+
+    const patch: Partial<{
+      name: string;
+      description: string | null;
+      bucket: string;
+      region: string;
+      endpoint: string | null;
+      force_path_style: boolean;
+      encrypted_credentials: string;
+      updated_by: string;
+      updated_at: Date;
+    }> = {
+      updated_by: params.updatedBy,
+      updated_at: new Date(),
+    };
+
+    if (params.name !== undefined) patch.name = params.name;
+    if (params.description !== undefined)
+      patch.description = params.description;
+    if (params.bucket !== undefined) patch.bucket = params.bucket;
+    if (params.region !== undefined) patch.region = params.region;
+    if (params.endpoint !== undefined) patch.endpoint = params.endpoint;
+    if (params.forcePathStyle !== undefined)
+      patch.force_path_style = params.forcePathStyle;
+    if (params.credentials !== undefined) {
+      patch.encrypted_credentials = await this.vault.encrypt(
+        JSON.stringify(params.credentials),
+      );
+    }
+
+    const row = await this.db
+      .updateTable("org_file_configs")
+      .set(patch)
+      .where("id", "=", params.id)
+      .where("organization_id", "=", params.organizationId)
+      .returning(PUBLIC_COLUMNS)
+      .executeTakeFirstOrThrow();
+
+    return this.rowToInfo(row);
+  }
+
+  async delete(id: string, organizationId: string): Promise<void> {
+    const existing = await this.db
+      .selectFrom("org_file_configs")
+      .where("id", "=", id)
+      .where("organization_id", "=", organizationId)
+      .select(["id"])
+      .executeTakeFirst();
+
+    if (!existing) throw new OrgFileConfigNotFoundError(id);
+
+    await this.db
+      .deleteFrom("org_file_configs")
+      .where("id", "=", id)
+      .where("organization_id", "=", organizationId)
+      .execute();
+  }
+
+  async list(organizationId: string): Promise<FileConfigInfo[]> {
+    const rows = await this.db
+      .selectFrom("org_file_configs")
+      .where("organization_id", "=", organizationId)
+      .select(PUBLIC_COLUMNS)
+      .orderBy("created_at", "desc")
+      .execute();
+
+    return rows.map((row) => this.rowToInfo(row));
+  }
+
+  async findById(id: string, organizationId: string): Promise<FileConfigInfo> {
+    const row = await this.db
+      .selectFrom("org_file_configs")
+      .where("id", "=", id)
+      .where("organization_id", "=", organizationId)
+      .select(PUBLIC_COLUMNS)
+      .executeTakeFirst();
+
+    if (!row) throw new OrgFileConfigNotFoundError(id);
+    return this.rowToInfo(row);
+  }
+
+  async resolveById(
+    id: string,
+    organizationId: string,
+  ): Promise<{ info: FileConfigInfo; credentials: FileConfigCredentials }> {
+    const row = await this.db
+      .selectFrom("org_file_configs")
+      .where("id", "=", id)
+      .where("organization_id", "=", organizationId)
+      .selectAll()
+      .executeTakeFirst();
+
+    if (!row) throw new OrgFileConfigNotFoundError(id);
+
+    const decrypted = await this.vault.decrypt(row.encrypted_credentials);
+    const credentials = JSON.parse(decrypted) as FileConfigCredentials;
+    return { info: this.rowToInfo(row), credentials };
+  }
+
+  async resolveByName(params: {
+    organizationId: string;
+    name: string;
+  }): Promise<{ info: FileConfigInfo; credentials: FileConfigCredentials }> {
+    const row = await this.db
+      .selectFrom("org_file_configs")
+      .where("organization_id", "=", params.organizationId)
+      .where(sql<boolean>`lower(name) = lower(${params.name})`)
+      .selectAll()
+      .executeTakeFirst();
+
+    if (!row) throw new OrgFileConfigNotFoundError(params.name);
+
+    const decrypted = await this.vault.decrypt(row.encrypted_credentials);
+    const credentials = JSON.parse(decrypted) as FileConfigCredentials;
+    return { info: this.rowToInfo(row), credentials };
+  }
+}