[superlog] Add manage:websites scope to insights service auth

[izadoesdev]

Summary

• grant insights service auth the manage:websites scope required by insight website updates
• centralize the insights service auth scope list behind a small helper
• add a focused unit test for the service auth scopes

Supersedes #471 with a clean branch from current staging.

Verification

• cd apps/insights && bun test src/service-auth.test.ts
• cd apps/insights && bun run check-types
• bunx ultracite check apps/insights/src/generation.ts apps/insights/src/service-auth.ts apps/insights/src/service-auth.test.ts
• cd apps/insights && bun test src
• bun run lint
• bun run check-types
• bun run test

---

Summary by cubic

Add the manage:websites scope to insights service auth so insights can update websites. This unblocks website updates and centralizes the scope list behind a small helper with tests.

• Bug Fixes

  • Grant manage:websites to insights service auth to allow website updates without permission errors.

• Refactors

  • Centralize scopes via createInsightsServiceAuth and INSIGHTS_SERVICE_AUTH_SCOPES in service-auth, and switch the agent in generation.ts to use it (wraps @databuddy/rpc).
  • Add a focused unit test that verifies the exact scopes.

^{Written for commit b42063e. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
databuddy-status	Ready	Preview, Comment	Jun 30, 2026 4:08pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
dashboard	Skipped		Jun 30, 2026 4:08pm
documentation	Skipped		Jun 30, 2026 4:08pm

[izadoesdev]

Clean replacement for #471, rebased onto current staging.

What changed:

• centralizes insights service auth scopes in apps/insights/src/service-auth.ts
• grants manage:websites alongside read:data, which is required for insight website-management calls
• adds a focused unit test for the helper

Local verification passed:

• cd apps/insights && bun test src/service-auth.test.ts
• cd apps/insights && bun run check-types
• bunx ultracite check apps/insights/src/generation.ts apps/insights/src/service-auth.ts apps/insights/src/service-auth.test.ts
• cd apps/insights && bun test src
• bun run lint
• bun run check-types
• bun run test

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4187a267-ea96-43fc-8284-c9f02b89f500

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/superlog-insights-service-auth-scope

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR grants the insights service the manage:websites scope in addition to the existing read:data scope, enabling the insights agent to perform website update operations. It also extracts scope configuration into a dedicated service-auth.ts module and adds a focused unit test.

• service-auth.ts (new): Centralizes INSIGHTS_SERVICE_AUTH_SCOPES as an exported as const tuple and wraps createServiceAuth in a createInsightsServiceAuth helper.
• generation.ts: Replaces the inline createServiceAuth(…, ["read:data"]) call with the new helper, picking up the additional scope.
• service-auth.test.ts (new): Mocks @databuddy/rpc via mock.module, dynamically imports the module under test, and asserts both the returned auth object and the exported scope constant match the expected values.

Confidence Score: 5/5

Safe to merge — the change is a narrow scope addition and a refactor into a well-tested helper with no behavioural changes to generation logic.

The diff is small and well-contained: a new two-function module, a one-line call-site swap, and a focused test. The manage:websites scope is already established across the codebase (Slack integration, MCP tools, API key model) so its semantics are known and the insights agent legitimately needs it for website updates. No edge cases or regressions were identified.

No files require special attention.

Important Files Changed

Filename	Overview
apps/insights/src/service-auth.ts	New helper that centralizes the insights service auth scopes; straightforward and correct.
apps/insights/src/service-auth.test.ts	New unit test; correctly mocks the module dependency before dynamic import and asserts both the propagated scopes and the exported constant.
apps/insights/src/generation.ts	Mechanical swap of inline createServiceAuth call for the new helper; no logic changes beyond scope addition.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Gen as generation.ts
    participant SA as service-auth.ts
    participant RPC as @databuddy/rpc

    Gen->>SA: createInsightsServiceAuth(organizationId)
    SA->>SA: spread INSIGHTS_SERVICE_AUTH_SCOPES ["read:data", "manage:websites"]
    SA->>RPC: createServiceAuth(organizationId, scopes)
    RPC-->>SA: "PreResolvedAuth { apiKey: { organizationId, scopes, type: "automation" }, session: null }"
    SA-->>Gen: PreResolvedAuth
    Gen->>Gen: "set context.serviceAuth = auth"

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Gen as generation.ts
    participant SA as service-auth.ts
    participant RPC as @databuddy/rpc

    Gen->>SA: createInsightsServiceAuth(organizationId)
    SA->>SA: spread INSIGHTS_SERVICE_AUTH_SCOPES ["read:data", "manage:websites"]
    SA->>RPC: createServiceAuth(organizationId, scopes)
    RPC-->>SA: "PreResolvedAuth { apiKey: { organizationId, scopes, type: "automation" }, session: null }"
    SA-->>Gen: PreResolvedAuth
    Gen->>Gen: "set context.serviceAuth = auth"

Loading

_{Reviews (1): Last reviewed commit: "fix(insights): grant service auth websit..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant Agent as Insights Agent (generation.ts)
    participant ServiceAuth as Insights Service Auth (service-auth.ts)
    participant RPC as @databuddy/rpc (createServiceAuth)

    Note over Agent,RPC: NEW: Scopes now include "manage:websites"

    Agent->>ServiceAuth: createInsightsServiceAuth(organizationId)
    ServiceAuth->>RPC: createServiceAuth(orgId, ["read:data", "manage:websites"])
    RPC-->>ServiceAuth: serviceAuth (apiKey + scopes)
    ServiceAuth-->>Agent: serviceAuth

    Note over Agent,RPC: Agent uses serviceAuth for RPC calls<br/>(e.g., updating websites)

Loading

<sub>Shadow auto-approve: would auto-approve. Adds required manage:websites scope for website updates; centralizes scopes in a helper with a focused unit test. The change is small, isolated, and well-structured.

Re-trigger cubic</sub>