SEC - TASKER: enforce workspace-scoped agent access

plane-src/apps/web/core/services/workspace-codex-agent.service.ts

@@ -39,6 +39,7 @@ export type TCodexAgentToken = {
   agent_id: string;
   name: string;
   status: TCodexAgentTokenStatus;
+  token_suffix: string | null;
   expires_at: string | null;
   last_used_at: string | null;
   created_at: string;
@@ -66,6 +67,16 @@ export type TCodexAgentCreateTokenResponse = {
   token_record: TCodexAgentToken;
 };
 
+export type TCodexAgentTokenListResponse = {
+  ok: boolean;
+  tokens: TCodexAgentToken[];
+};
+
+export type TCodexAgentSetupResponse = {
+  ok: boolean;
+  setup?: TCodexAgentSetupPacket;
+};
+
 export class WorkspaceCodexAgentService extends APIService {
   constructor() {
     super(API_BASE_URL);
@@ -90,6 +101,18 @@ export class WorkspaceCodexAgentService extends APIService {
       });
   }
 
+  async updateAgent(
+    workspaceSlug: string,
+    agentId: string,
+    data: { display_name?: string; avatar_url?: string | null }
+  ): Promise<{ ok: boolean; agent: TCodexAgent }> {
+    return this.patch(`/api/workspaces/${workspaceSlug}/codex-agent-api/agents/${agentId}/`, data)
+      .then((response) => response?.data)
+      .catch((error) => {
+        throw error?.response?.data;
+      });
+  }
+
   async upsertGrant(
     workspaceSlug: string,
     agentId: string,
@@ -118,6 +141,22 @@ export class WorkspaceCodexAgentService extends APIService {
       });
   }
 
+  async listTokens(workspaceSlug: string, agentId: string): Promise<TCodexAgentTokenListResponse> {
+    return this.get(`/api/workspaces/${workspaceSlug}/codex-agent-api/agents/${agentId}/tokens/`)
+      .then((response) => response?.data)
+      .catch((error) => {
+        throw error?.response?.data;
+      });
+  }
+
+  async getSetup(workspaceSlug: string, agentId: string): Promise<TCodexAgentSetupResponse> {
+    return this.get(`/api/workspaces/${workspaceSlug}/codex-agent-api/agents/${agentId}/setup/`)
+      .then((response) => response?.data)
+      .catch((error) => {
+        throw error?.response?.data;
+      });
+  }
+
   async revokeAgent(workspaceSlug: string, agentId: string): Promise<{ ok: boolean; agent: TCodexAgent }> {
     return this.post(`/api/workspaces/${workspaceSlug}/codex-agent-api/agents/${agentId}/revoke/`)
       .then((response) => response?.data)