Uh oh!
There was an error while loading. Please reload this page.
feat: Artist TikTok Connections via Composio - #170
Merged
Conversation
- Add artist_composio_connections type to database.types.ts - Create selectArtistComposioConnection.ts (single lookup by artist+toolkit) - Create selectArtistComposioConnections.ts (all connections for artist) - Create insertArtistComposioConnection.ts (upsert on unique constraint) - Create deleteArtistComposioConnection.ts (delete by id) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add ALLOWED_ARTIST_CONNECTORS constant with 'tiktok' as first connector - Create checkAccountArtistAccess function in Recoup-API (migrated from Recoup-Chat) - Create getArtistConnectors function to return connector status for artists - Create GET /api/artist-connectors endpoint with: - Bearer token and API key auth via validateAuthContext - Artist access validation via checkAccountArtistAccess - Returns list of allowed connectors with connection status Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add validateAuthorizeArtistConnectorBody.ts with Zod schema for request validation
- Add authorizeArtistConnector.ts to generate OAuth URLs via Composio
- Add POST /api/artist-connectors/authorize route with auth and access control
- Callback URL redirects to /chat?artist_connected={artistId}&toolkit={slug}
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>- Add DELETE handler to disconnect an artist's connector from Composio - Create validateDisconnectArtistConnectorBody.ts with Zod schema - Create verifyArtistConnectorOwnership.ts to check connection ownership - Create disconnectArtistConnector.ts to remove from Composio and DB Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add 'artist-connectors' to CallbackDestination type in getCallbackUrl.ts
- Add artistId and toolkit to CallbackOptions interface
- Handle artist-connectors destination returning /chat?artist_connected={artistId}&toolkit={toolkit}
- Update authorizeArtistConnector.ts to use getCallbackUrl instead of local function
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>Add 'tiktok' to the ENABLED_TOOLKITS array so TikTok tools are available in Tool Router sessions, enabling the LLM to access TikTok data. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add artistConnections parameter to createToolRouterSession (Record<string, string> | undefined) - Pass connectedAccounts option to composio.create() call - Update getComposioTools to accept and pass artistConnections parameter - Add JSDoc documentation for the new parameter This enables artist-specific Composio connections to be used when creating Tool Router sessions, allowing the LLM to use the correct TikTok account for the selected artist. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Modified getComposioTools to accept artistId parameter - If artistId provided, fetches artist_composio_connections from DB - Transforms connections to Record<string, string> format - Passes artistConnections to createToolRouterSession - Modified setupToolsForRequest to extract artistId from body - Passes artistId through to getComposioTools Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add POST /api/artist-connectors/complete endpoint to finalize OAuth flow: - Query Composio for the user's connected account after OAuth redirect - Store the connection mapping in artist_composio_connections table - Add Zod validation for request body (artist_id, toolkit_slug) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughRoutes were refactored to delegate connector operations to centralized handlers; connector APIs were made entity-scoped (account/artist), with new validators, access checks, artist-connector restrictions, and tooling to surface and pass artist connections to the tool router. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant Route as /api/connectors/authorize
participant Handler as authorizeConnectorHandler
participant Validator as validateAuthorizeConnectorRequest
participant Auth as validateAuthContext
participant Access as checkAccountArtistAccess
participant Core as authorizeConnector
participant Composio as Composio API
Client->>Route: POST
Route->>Handler: delegate request
Handler->>Validator: validate + auth
Validator->>Auth: validateAuthContext
Auth-->>Validator: accountId
alt account_id provided
Validator->>Access: checkAccountArtistAccess
alt denied
Access-->>Validator: false
Validator-->>Handler: NextResponse(403)
Handler-->>Client: 403
else granted
Validator-->>Handler: params{composioEntityId, connector, authConfigs?, callbackUrl?}
end
else no account_id
Validator-->>Handler: params{composioEntityId, connector, callbackUrl?}
end
Handler->>Core: authorizeConnector(composioEntityId, connector, options)
Core->>Composio: create session
Composio-->>Core: session+redirectUrl
Core-->>Handler: result
Handler-->>Client: 200 {success:true, data}
sequenceDiagram
participant Client
participant Route as /api/connectors
participant Handler as getConnectorsHandler
participant Validator as validateGetConnectorsRequest
participant Auth as validateAuthContext
participant Access as checkAccountArtistAccess
participant Core as getConnectors
participant Composio as Composio API
Client->>Route: GET?account_id=...
Route->>Handler: delegate request
Handler->>Validator: validate + auth + query
Validator->>Auth: validateAuthContext
Auth-->>Validator: accountId
alt account_id provided
Validator->>Access: checkAccountArtistAccess
alt denied
Access-->>Validator: false
Validator-->>Handler: NextResponse(403)
Handler-->>Client: 403
else granted
Validator-->>Handler: params{composioEntityId, allowedToolkits?}
end
else no account_id
Validator-->>Handler: params{composioEntityId: accountId}
end
Handler->>Core: getConnectors(composioEntityId, options)
Core->>Composio: fetch connectors
Composio-->>Core: connectors[]
Core-->>Handler: connectors[]
Handler-->>Client: 200 {success:true, connectors}
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
🚥 Pre-merge checks | ❌ 1❌ Failed checks (1 warning)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Braintrust eval reportCatalog Opportunity Analysis Evaluation (HEAD-1770003038)
Catalog Songs Count Evaluation (HEAD-1770003038)
First Week Album Sales Evaluation (HEAD-1770003038)
Memory & Storage Tools Evaluation (HEAD-1770003038)
Monthly Listeners Tracking Evaluation (HEAD-1770003038)
Search Web Tool Evaluation (HEAD-1770003038)
Social Scraping Evaluation (HEAD-1770003037)
Spotify Followers Evaluation (HEAD-1770003037)
Spotify Tools Evaluation (HEAD-1770003037)
TikTok Analytics Questions Evaluation (HEAD-1770003037)
|
- Remove artist_composio_connections table and related code - Remove /complete endpoint (no longer needed) - Use artistId directly as Composio entity when connecting - Query Composio at chat time for artist connections - Pass connections to user session via connectedAccounts Composio is now the source of truth for artist connections.
…tConnectors, disconnectConnector
- Add TDD to code principles - Document thin route files pattern (follow /api/pulses) - Document handler functions pattern - Document combined request validators (validateXxxRequest) - Add DRY guidance for entity types (use options, not duplicate files) - Add file naming convention (name after function, not constant) - Add testing requirements for API changes
- Merge test branch to sync with base - Update test to expect (accountId, artistId, roomId) signature - Add test case for when artistId is provided
Merge test to main
Consolidates the authorize endpoint into the main connectors route to match the updated API docs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…Access SRP: each query is now its own file with dedicated tests: - selectAccountArtistId (account_artist_ids) - selectArtistOrganizationIds (artist_organization_ids) - selectAccountOrganizationIds (account_organization_ids) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
| const { artist_id, connector } = validated; | ||
| // Verify connector is allowed | ||
| if (!isAllowedArtistConnector(connector)) { |
Contributor
There was a problem hiding this comment.
SRP
- actual: multiple validations happening in the API endpoint definition file.
- required: move any verification of input params into the
validateAuthorizeArtistConnectorBodyfunction.
| // Verify user has access to this artist | ||
| const hasAccess = await checkAccountArtistAccess(accountId, artist_id); | ||
| if (!hasAccess) { |
Contributor
There was a problem hiding this comment.
SRP
- actual: multiple validations happening in the API endpoint definition file.
- required: move any verification of input params into the validateAuthorizeArtistConnectorBody function.
- Check out other example endpoints like
/api/pulsesto see a cleaner implementation.
| * @param request - The incoming request | ||
| * @returns List of connectors with connection status | ||
| */ | ||
| export async function GET(request: NextRequest): Promise<NextResponse> { |
Contributor
There was a problem hiding this comment.
SRP
- actual: endpoint file also defines the handler
- required: standalone handler function similar to
/api/pulses
| const { searchParams } = new URL(request.url); | ||
| const artistId = searchParams.get("artist_id"); | ||
| if (!artistId) { |
Contributor
There was a problem hiding this comment.
SRP
- actual: multiple validations happening in the API endpoint definition file.
- required: move any verification of input params into a verify function.
- Check out other example endpoints like /api/pulses to see a cleaner implementation.
| // Verify user has access to this artist | ||
| const hasAccess = await checkAccountArtistAccess(accountId, artistId); | ||
| if (!hasAccess) { |
Contributor
There was a problem hiding this comment.
SRP
- actual: multiple validations happening in the API endpoint definition file.
- required: move any verification of input params into a verify function.
- Check out other example endpoints like /api/pulses to see a cleaner implementation.
| }); | ||
| vi.mocked(checkAccountArtistAccess).mockResolvedValue(true); | ||
| const request = new NextRequest(`http://localhost/api/connectors?entity_id=${mockEntityId}`); |
Contributor
There was a problem hiding this comment.
Why are we using entity_id instead of account_id?
| * Custom auth configs for toolkits that require custom OAuth credentials. | ||
| * e.g., { tiktok: "ac_xxxxx" } | ||
| */ | ||
| authConfigs?: Record<string, string>; |
Contributor
There was a problem hiding this comment.
Why is authConfigs a generic Record<string, string> type instead of a more explicit typing?
| * | ||
| * Why: Used by the /api/connectors/authorize endpoint to let users | ||
| * connect from the settings page (not in-chat). | ||
| * The entityId is an account ID - either the caller's own account or |
Contributor
There was a problem hiding this comment.
Why are you using entityId instead of accountId?
Contributor
There was a problem hiding this comment.
Why are any changes needed to this file?
Contributor
There was a problem hiding this comment.
lib/supabase/account_workspace_ids/checkAccountWorkspaceAccess.ts -
refactor to selectAccountWorkspaces
…Access SRP: standalone supabase query with dedicated tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use "account" terminology consistently per codebase conventions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
No caller uses this option — YAGNI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The comment claimed ownership verification that the function doesn't do. Updated to reflect it only validates request shape. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Not a direct Supabase query — it aggregates supabase calls, so it belongs in the domain layer. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ntWorkspaceId directly YAGNI — the wrapper was just !!data. The sole consumer now calls the supabase query directly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
sweetmantech
approved these changes
Feb 12, 2026
| */ | ||
| export async function authorizeConnector( | ||
| userId: string, | ||
| entityId: string, |
Contributor
There was a problem hiding this comment.
lib/composio/connectors/authorizeConnector.ts is there any reason
this needs to be called entityId? We prefer accountId
Comment on lines
+60
to
+78
| // If filtering, ensure we return all allowed toolkits (even if not in Composio response) | ||
| if (allowedToolkits) { | ||
| const existingSlugs = new Set(connectors.map(c => c.slug)); | ||
| for (const slug of allowedToolkits) { | ||
| if (!existingSlugs.has(slug)) { | ||
| connectors.push({ | ||
| slug, | ||
| name: displayNames[slug] || slug, | ||
| isConnected: false, | ||
| connectedAccountId: undefined, | ||
| }); | ||
| } | ||
| } | ||
| // Filter to only allowed and maintain order | ||
| return allowedToolkits.map(slug => connectors.find(c => c.slug === slug)!); | ||
| } | ||
| return connectors; |
Contributor
There was a problem hiding this comment.
what are the bottom filtering doing in
lib/composio/connectors/getConnectors.ts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds custom Zod messages and missing_fields/status fields to error responses for both POST and DELETE /api/connectors validation, matching the standard pattern used across other API endpoints. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Apr 17, 2026
This was referenced Apr 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stories Implemented
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit