fix(insights): grant service auth website scope

Author: izadoesdev

apps/insights/src/generation.ts

@@ -1,5 +1,4 @@
 import type { AppContext } from "@databuddy/ai/config/context";
-import { createServiceAuth } from "@databuddy/rpc";
 import {
 	ANTHROPIC_CACHE_1H,
 	createModelFromId,
@@ -38,6 +37,7 @@ import {
 } from "./persistence";
 import { reflectAndRank } from "./reflection";
 import { resolveInsightsForWebsite } from "./resolution";
+import { createInsightsServiceAuth } from "./service-auth";
 import {
 	buildInvestigationPrompt,
 	buildSystemPrompt,
@@ -314,7 +314,7 @@ async function runInsightsAgent(params: {
 			timezone: params.config.timezone,
 			currentDateTime: new Date().toISOString(),
 			chatId: `insights:${params.organizationId}:${params.websiteId}`,
-			serviceAuth: createServiceAuth(params.organizationId, ["read:data"]),
+			serviceAuth: createInsightsServiceAuth(params.organizationId),
 		};
 
 		const collected: ParsedInsight[] = [];

apps/insights/src/service-auth.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, it, mock } from "bun:test";
+
+const mockCreateServiceAuth = mock((organizationId: string, scopes: string[]) => ({
+	apiKey: { organizationId, scopes },
+	session: null,
+}));
+
+mock.module("@databuddy/rpc", () => ({
+	createServiceAuth: mockCreateServiceAuth,
+}));
+
+const { createInsightsServiceAuth, INSIGHTS_SERVICE_AUTH_SCOPES } = await import(
+	"./service-auth"
+);
+
+describe("createInsightsServiceAuth", () => {
+	it("grants read data and website management scopes to insights agents", () => {
+		const auth = createInsightsServiceAuth("org_1");
+
+		expect(auth.apiKey?.organizationId).toBe("org_1");
+		expect(auth.apiKey?.scopes).toEqual(["read:data", "manage:websites"]);
+		expect(INSIGHTS_SERVICE_AUTH_SCOPES).toEqual([
+			"read:data",
+			"manage:websites",
+		]);
+	});
+});

apps/insights/src/service-auth.ts

@@ -0,0 +1,10 @@
+import { createServiceAuth } from "@databuddy/rpc";
+
+export const INSIGHTS_SERVICE_AUTH_SCOPES = [
+	"read:data",
+	"manage:websites",
+] as const;
+
+export function createInsightsServiceAuth(organizationId: string) {
+	return createServiceAuth(organizationId, [...INSIGHTS_SERVICE_AUTH_SCOPES]);
+}