feat: project templates and shareable links

Addresses the bulk of #4107

To be addressed in a follow-up:
- Copying multi-user MCP servers
- Preventing users from copying projects containing MCP servers they
  don't have access to
- Preventing copied project upgrades when the user doesn't have access
  to MCP servers in the latest snapshot

Signed-off-by: Nick Hale <[email protected]>

Author: njhale

apiclient/types/project.go

@@ -9,6 +9,8 @@ type Project struct {
 	SourceProjectID              string                       `json:"sourceProjectID,omitempty"`
 	UserID                       string                       `json:"userID,omitempty"`
 	WorkflowNamesFromIntegration WorkflowNamesFromIntegration `json:"workflowNamesFromIntegration,omitempty"`
+	TemplateUpgradeAvailable     bool                         `json:"templateUpgradeAvailable,omitempty"`
+	TemplateUpgradeInProgress    bool                         `json:"templateUpgradeInProgress,omitempty"`
 }
 
 type WorkflowNamesFromIntegration struct {

apiclient/types/template.go

@@ -2,19 +2,15 @@ package types
 
 type ProjectTemplate struct {
 	Metadata
-	ProjectTemplateManifest
-	ProjectSnapshot ThreadManifest `json:"projectSnapshot,omitempty"`
-	MCPServers      []string       `json:"mcpServers,omitempty"`
-	AssistantID     string         `json:"assistantID,omitempty"`
-	ProjectID       string         `json:"projectID,omitempty"`
-	PublicID        string         `json:"publicID,omitempty"`
-	Ready           bool           `json:"ready,omitempty"`
-}
-
-type ProjectTemplateManifest struct {
-	Name     string `json:"name,omitempty"`
-	Public   bool   `json:"public,omitempty"`
-	Featured bool   `json:"featured,omitempty"`
+	ProjectSnapshot                  ThreadManifest `json:"projectSnapshot,omitempty"`
+	ProjectSnapshotRevision          Time           `json:"projectSnapshotRevision,omitempty"`
+	ProjectSnapshotStale             bool           `json:"projectSnapshotStale,omitempty"`
+	ProjectSnapshotUpgradeInProgress bool           `json:"projectSnapshotUpgradeInProgress,omitempty"`
+	MCPServers                       []string       `json:"mcpServers,omitempty"`
+	AssistantID                      string         `json:"assistantID,omitempty"`
+	ProjectID                        string         `json:"projectID,omitempty"`
+	PublicID                         string         `json:"publicID,omitempty"`
+	Ready                            bool           `json:"ready,omitempty"`
 }
 
 type ProjectTemplateList List[ProjectTemplate]

apiclient/types/zz_generated.deepcopy.go

@@ -108,11 +108,9 @@ var apiResources = []string{
 	"GET    /api/assistants/{assistant_id}/projects/{project_id}/tasks/{task_id}/runs/{run_id}/files/{file...}",
 	"POST   /api/assistants/{assistant_id}/projects/{project_id}/tasks/{task_id}/runs/{run_id}/files/{file...}",
 	"POST   /api/assistants/{assistant_id}/projects/{project_id}/tasks/{task_id}/runs/{run_id}/steps/{step_id}/run",
-	"PUT    /api/assistants/{assistant_id}/projects/{project_id}/templates/{template_id}",
-	"DELETE /api/assistants/{assistant_id}/projects/{project_id}/templates/{template_id}",
-	"GET    /api/assistants/{assistant_id}/projects/{project_id}/templates/{template_id}",
-	"POST   /api/assistants/{assistant_id}/projects/{project_id}/templates",
-	"GET    /api/assistants/{assistant_id}/projects/{project_id}/templates",
+	"POST   /api/assistants/{assistant_id}/projects/{project_id}/template",
+	"GET    /api/assistants/{assistant_id}/projects/{project_id}/template",
+	"DELETE /api/assistants/{assistant_id}/projects/{project_id}/template",
 	"GET    /api/assistants/{assistant_id}/projects/{project_id}/threads",
 	"POST   /api/assistants/{assistant_id}/projects/{project_id}/threads",
 	"DELETE /api/assistants/{assistant_id}/projects/{project_id}/threads/{thread_id}",
@@ -149,6 +147,7 @@ var apiResources = []string{
 	"GET    /api/assistants/{assistant_id}/projects/{project_id}/tools/{tool_id}/local-authenticate",
 	"DELETE /api/assistants/{assistant_id}/projects/{project_id}/tools/{tool_id}/local-deauthenticate",
 	"POST   /api/assistants/{assistant_id}/projects/{project_id}/tools/{tool_id}/test",
+	"POST   /api/assistants/{assistant_id}/projects/{project_id}/upgrade-from-template",
 	"GET    /api/mcp-server-instances",
 	"GET    /api/mcp-server-instances/{mcp_server_instance_id}",
 	"POST   /api/mcp-server-instances",
@@ -293,6 +292,7 @@ func (a *Authorizer) evaluateResources(req *http.Request, vars GetVar, user user
 		MCPID:                  vars("mcp_id"), // this will be either a server ID or a server instance ID
 		PendingAuthorizationID: vars("pending_authorization_id"),
 		ThreadShareID:          vars("share_public_id"),
+		TemplateID:             vars("template_public_id"), // for /api/templates/{template_public_id} routes
 		ToolID:                 vars("tool_id"),
 		WorkspaceID:            vars("workspace_id"),
 	}

pkg/api/authz/resources.go

@@ -16,6 +16,7 @@ func (a *Authorizer) checkTemplate(req *http.Request, resources *Resources) (boo
 	var templateShareList v1.ThreadShareList
 	err := a.cache.List(req.Context(), &templateShareList, kclient.InNamespace(system.DefaultNamespace), kclient.MatchingFields{
 		"spec.publicID": resources.TemplateID,
+		"spec.template": "true",
 	})
 
 	return len(templateShareList.Items) > 0, err

pkg/api/authz/template.go

@@ -210,6 +210,10 @@ func (m *MCPHandler) ListServer(req api.Context) error {
 	items := make([]types.MCPServer, 0, len(servers.Items))
 
 	for _, server := range servers.Items {
+		if server.Annotations[v1.HideMCPServerAnnotation] == "true" {
+			continue
+		}
+
 		// Add extracted env vars to the server definition
 		addExtractedEnvVars(&server)
 

pkg/api/handlers/mcp.go

@@ -56,7 +56,7 @@ func convertProjectMCPServer(projectServer *v1.ProjectMCPServer, mcpServer *v1.M
 	}
 	pmcp.Alias = mcpServer.Spec.Alias
 
-	if cred != nil && mcpServer.Spec.MCPCatalogID == "" {
+	if mcpServer.Spec.MCPCatalogID == "" {
 		// For single-user servers, grab more status information from the MCP server.
 		// We don't show this for shared servers, because the user can't do anything about it
 		// if something is wrong with one of those; only the admin can.

pkg/api/handlers/projectmcp.go

@@ -247,6 +247,51 @@ func (h *ProjectsHandler) GetProject(req api.Context) error {
 	return req.Write(convertProject(&thread, nil))
 }
 
+// UpgradeFromTemplate upgrades a project to the latest snapshot of a project if the snapshot has changed since
+// the project was created or the last time the project was upgraded.
+func (h *ProjectsHandler) UpgradeFromTemplate(req api.Context) error {
+	var (
+		projectID = strings.Replace(req.PathValue("project_id"), system.ProjectPrefix, system.ThreadPrefix, 1)
+		thread    v1.Thread
+	)
+
+	if err := req.Get(&thread, projectID); err != nil {
+		return err
+	}
+
+	if thread.Spec.SourceThreadName == "" || !thread.Spec.Project {
+		return types.NewErrBadRequest("project was not created from a template")
+	}
+
+	if !thread.Status.SourceThreadUpgradeAvailable || thread.Annotations[v1.ThreadUpgradeApprovedAnnotation] == "true" {
+		// Project hasn't diverged from the snapshot or is in the process of upgrading, nothing to do
+		return nil
+	}
+
+	// Get the source thread to verify it's a template
+	var source v1.Thread
+	if err := req.Get(&source, thread.Spec.SourceThreadName); err != nil {
+		return err
+	}
+
+	// Verify the source is actually a template
+	if !source.Spec.Template {
+		return types.NewErrBadRequest("source project is not a template")
+	}
+
+	// Project has diverged from the snapsbot, upgrade to the latest snapshot by setting the upgrade annotation
+	if thread.Annotations == nil {
+		thread.Annotations = map[string]string{}
+	}
+	thread.Annotations[v1.ThreadUpgradeApprovedAnnotation] = "true"
+
+	// Copy snapshot revision annotation from source template
+	thread.Annotations[v1.ProjectSnapshotRevisionAnnotation] = source.Annotations[v1.ProjectSnapshotRevisionAnnotation]
+
+	// Persist spec/annotation updates first
+	return req.Update(&thread)
+}
+
 func (h *ProjectsHandler) ListProjects(req api.Context) error {
 	var (
 		assistantID = req.PathValue("assistant_id")
@@ -469,6 +514,8 @@ func convertProject(thread *v1.Thread, parentThread *v1.Thread) types.Project {
 		Editor:                       thread.IsEditor(),
 		UserID:                       thread.Spec.UserID,
 		WorkflowNamesFromIntegration: thread.Status.WorkflowNamesFromIntegration,
+		TemplateUpgradeAvailable:     thread.Status.SourceThreadUpgradeAvailable || thread.Annotations[v1.ThreadUpgradeApprovedAnnotation] == "true",
+		TemplateUpgradeInProgress:    thread.Status.UpgradeInProgress,
 	}
 
 	// Include tools from parent project