feat(marketplace): connection access (routes 25–27) and OAuth sign-in start (route 28)

README.md

@@ -1048,6 +1048,38 @@ foreach (var tool in catalog?.Tools ?? [])
     Console.WriteLine($"{tool.Name} {(tool.ReadOnlyHint == true ? "read-only" : "writes")}");
 ```
 
+## Marketplace connections — access
+
+Who may use a connection is set per role with generated access packages
+(`MarketplaceAccessLevel`: `None`, `Viewer`, `FunctionsOnly`, `ReadOnly`,
+`FullAccess`, plus the `Manage` flag):
+
+| Method | Call |
+| --- | --- |
+| `Code.GetMarketplaceIntegrationAccessAsync` | `GET /{version}/code/marketplace/integrations/{IntegrationViewId}/access` — the matrix: `Roles` (package, `IsCustom`, `Manage`, `Custom` policies, `DefaultNotApplied`), `Packages`, `Tools` (`ReadOnly`, `Grantable`), `Functions` |
+| `Code.SetMarketplaceIntegrationRoleAccessAsync` | `PUT …/access/roles` — `RoleId`, `Package`, `Manage`; returns the role id |
+| `Code.SaveMarketplaceIntegrationCustomAccessAsync` | `POST …/access/roles/custom` — `RoleId`, `BasePackage`, `Tools`, `Functions`, `Manage`, `NewPolicyForThisRoleOnly`; returns `PolicyId`, `Created`, `UsedByRoles` |
+
+`Code.StartMarketplaceIntegrationSignInAsync`
+(`POST /{version}/code/marketplace/integrations/{IntegrationViewId}/oauth/start`)
+starts the OAuth sign-in of an MCP connection: open `AuthorizeUrl` in a browser
+(`RedirectUrl` is the callback the vendor app must allow, `ExpiresAt` ends the
+attempt). A signed-in connection shows `SignedIn`, `SignedInBy`, `SignedInAt`
+and `TokenExpiresAt`; a listing shows `ConnectSteps` and `OAuthRedirectUrl`.
+
+`TestMarketplaceIntegrationAsync` also returns `AccessChanges`
+(`ReadOnlyAdded`, `ReadOnlyRemoved`, `NotGrantable`) and each step's
+`ErrorCode`.
+
+```csharp
+await hub.Code.SetMarketplaceIntegrationRoleAccessAsync(new SetMarketplaceIntegrationRoleAccess
+{
+    IntegrationViewId = "int_…",
+    RoleId = "acc_…_nr_…",
+    Package = MarketplaceAccessLevel.ReadOnly,
+});
+```
+
 ## Coverage Notes
 
 Generated coverage tracks the API and Hub DTO contract files. Some flows are not generated automatically:

src/Norbix.Sdk.Types/Generated/Hub.dtos.cs

@@ -3682,6 +3682,118 @@ public partial class GoogleCloudFunctionsCodeIntegrationDto
         public virtual string? Region { get; set; }
     }
 
+    [DataContract]
+    public partial class MarketplaceAccessChangesDto
+    {
+        [DataMember]
+        public virtual IReadOnlyList<string> ReadOnlyAdded { get; set; }
+
+        [DataMember]
+        public virtual IReadOnlyList<string> ReadOnlyRemoved { get; set; }
+
+        [DataMember]
+        public virtual IReadOnlyList<string> NotGrantable { get; set; }
+    }
+
+    [DataContract]
+    public partial class MarketplaceAccessCustomPolicyDto
+    {
+        [DataMember]
+        public virtual string PolicyId { get; set; }
+
+        [DataMember]
+        public virtual string Name { get; set; }
+
+        [DataMember]
+        public virtual int UsedByRoles { get; set; }
+    }
+
+    [DataContract]
+    public partial class MarketplaceAccessFunctionDto
+    {
+        [DataMember]
+        public virtual string FunctionId { get; set; }
+
+        [DataMember]
+        public virtual string Name { get; set; }
+
+        [DataMember]
+        public virtual string FunctionKey { get; set; }
+    }
+
+    public enum MarketplaceAccessLevel
+    {
+        None,
+        Viewer,
+        FunctionsOnly,
+        ReadOnly,
+        FullAccess,
+        Manage,
+    }
+
+    [DataContract]
+    public partial class MarketplaceAccessPackageDto
+    {
+        [DataMember]
+        public virtual MarketplaceAccessLevel Kind { get; set; }
+
+        [DataMember]
+        public virtual string PolicyId { get; set; }
+
+        [DataMember]
+        public virtual string Name { get; set; }
+
+        [DataMember]
+        public virtual bool Exists { get; set; }
+    }
+
+    [DataContract]
+    public partial class MarketplaceAccessRoleDto
+    {
+        [DataMember]
+        public virtual string RoleId { get; set; }
+
+        [DataMember]
+        public virtual string Name { get; set; }
+
+        [DataMember]
+        public virtual string Scope { get; set; }
+
+        [DataMember]
+        public virtual bool IsSystem { get; set; }
+
+        [DataMember]
+        public virtual bool Fixed { get; set; }
+
+        [DataMember]
+        public virtual MarketplaceAccessLevel Package { get; set; }
+
+        [DataMember]
+        public virtual bool IsCustom { get; set; }
+
+        [DataMember]
+        public virtual bool Manage { get; set; }
+
+        [DataMember]
+        public virtual IReadOnlyList<MarketplaceAccessCustomPolicyDto> Custom { get; set; }
+
+        [DataMember]
+        public virtual string? DefaultNotApplied { get; set; }
+    }
+
+    [DataContract]
+    public partial class MarketplaceAccessToolDto
+    {
+        [DataMember]
+        public virtual string Name { get; set; }
+
+        [DataMember]
+        public virtual bool ReadOnly { get; set; }
+
+        [DataMember]
+        public virtual bool Grantable { get; set; }
+    }
+
     public enum MarketplaceAvailability
     {
         Development,
@@ -3982,6 +4094,18 @@ public partial class MarketplaceIntegrationDto
 
         [DataMember]
         public virtual List<MarketplaceValidationStepResultDto>? LastValidationSteps { get; set; }
+
+        [DataMember]
+        public virtual bool SignedIn { get; set; }
+
+        [DataMember]
+        public virtual string? SignedInBy { get; set; }
+
+        [DataMember]
+        public virtual DateTime? SignedInAt { get; set; }
+
+        [DataMember]
+        public virtual DateTime? TokenExpiresAt { get; set; }
     }
 
     [DataContract]
@@ -4023,6 +4147,12 @@ public partial class MarketplaceIntegrationListProjection
 
         [DataMember]
         public virtual bool RequiresHumanDeliveryConfirmation { get; set; }
+
+        [DataMember]
+        public virtual bool SignedIn { get; set; }
+
+        [DataMember]
+        public virtual DateTime? SignedInAt { get; set; }
     }
 
     [DataContract]
@@ -4062,6 +4192,12 @@ public partial class MarketplaceListingDto
         [DataMember]
         public virtual MarketplaceAvailability Availability { get; set; }
 
+        [DataMember]
+        public virtual IReadOnlyList<string> ConnectSteps { get; set; }
+
+        [DataMember]
+        public virtual string? OAuthRedirectUrl { get; set; }
+
         [DataMember]
         public virtual bool IsOfficial { get; set; }
 
@@ -4234,6 +4370,9 @@ public partial class MarketplaceValidationStepResultDto
 
         [DataMember]
         public virtual string? Message { get; set; }
+
+        [DataMember]
+        public virtual string? ErrorCode { get; set; }
     }
 
     public partial class AccountComplianceDto
@@ -7126,6 +7265,9 @@ public partial class TestMarketplaceIntegrationResponse
 
         [DataMember]
         public virtual IReadOnlyList<MarketplaceValidationStepResultDto>? Steps { get; set; }
+
+        [DataMember]
+        public virtual MarketplaceAccessChangesDto? AccessChanges { get; set; }
     }
 
     [DataContract]
@@ -11602,6 +11744,33 @@ public partial class GetMarketplaceIntegration
         public virtual string IntegrationViewId { get; set; }
     }
 
+    [NorbixRoute("/{version}/code/marketplace/integrations/{IntegrationViewId}/access", "GET")]
+    public partial class GetMarketplaceIntegrationAccess
+        : CodeMashRequestBase, INorbixRequest<GetMarketplaceIntegrationAccessResponse>
+    {
+        ///<summary>
+        ///Integration view id, from get_marketplace_integrations.
+        ///</summary>
+        public virtual string IntegrationViewId { get; set; }
+    }
+
+    [DataContract]
+    public partial class GetMarketplaceIntegrationAccessResponse
+        : ResponseBase
+    {
+        [DataMember]
+        public virtual IReadOnlyList<MarketplaceAccessRoleDto> Roles { get; set; }
+
+        [DataMember]
+        public virtual IReadOnlyList<MarketplaceAccessPackageDto> Packages { get; set; }
+
+        [DataMember]
+        public virtual IReadOnlyList<MarketplaceAccessToolDto> Tools { get; set; }
+
+        [DataMember]
+        public virtual IReadOnlyList<MarketplaceAccessFunctionDto> Functions { get; set; }
+    }
+
     public partial class GetMarketplaceIntegrationResponse
         : ResponseBase
     {
@@ -11687,6 +11856,98 @@ public partial class SaveMarketplaceIntegration
         public virtual Dictionary<string, string> Secrets { get; set; } = new();
     }
 
+    [NorbixRoute("/{version}/code/marketplace/integrations/{IntegrationViewId}/access/roles/custom", "POST")]
+    [DataContract]
+    public partial class SaveMarketplaceIntegrationCustomAccess
+        : CodeMashRequestBase, INorbixRequest<SaveMarketplaceIntegrationCustomAccessResponse>
+    {
+        ///<summary>
+        ///Integration view id, from get_marketplace_integrations.
+        ///</summary>
+        [DataMember]
+        public virtual string IntegrationViewId { get; set; }
+
+        ///<summary>
+        ///The role's composite id: acc_…_nr_… or pr_…_nr_….
+        ///</summary>
+        [DataMember]
+        public virtual string RoleId { get; set; }
+
+        ///<summary>
+        ///The package to start from: None, Viewer, FunctionsOnly, ReadOnly or FullAccess.
+        ///</summary>
+        [DataMember]
+        public virtual MarketplaceAccessLevel BasePackage { get; set; }
+
+        ///<summary>
+        ///Tool names the role may run (from the connection's tools).
+        ///</summary>
+        [DataMember]
+        public virtual List<string> Tools { get; set; } = [];
+
+        ///<summary>
+        ///Function ids (func_…) of this connection the role may run.
+        ///</summary>
+        [DataMember]
+        public virtual List<string> Functions { get; set; } = [];
+
+        ///<summary>
+        ///True to include the Manage rights (edit the connection, its secrets, validation and functions).
+        ///</summary>
+        [DataMember]
+        public virtual bool Manage { get; set; }
+
+        ///<summary>
+        ///True to write a new policy for this role only when its current custom policy is shared with other roles.
+        ///</summary>
+        [DataMember]
+        public virtual bool NewPolicyForThisRoleOnly { get; set; }
+    }
+
+    [DataContract]
+    public partial class SaveMarketplaceIntegrationCustomAccessResponse
+        : ResponseBase
+    {
+        [DataMember]
+        public virtual string? PolicyId { get; set; }
+
+        [DataMember]
+        public virtual bool Created { get; set; }
+
+        [DataMember]
+        public virtual int UsedByRoles { get; set; }
+    }
+
+    [NorbixRoute("/{version}/code/marketplace/integrations/{IntegrationViewId}/access/roles", "PUT")]
+    [DataContract]
+    public partial class SetMarketplaceIntegrationRoleAccess
+        : CodeMashRequestBase, INorbixRequest<IdResponse>
+    {
+        ///<summary>
+        ///Integration view id, from get_marketplace_integrations.
+        ///</summary>
+        [DataMember]
+        public virtual string IntegrationViewId { get; set; }
+
+        ///<summary>
+        ///The role's composite id: acc_…_nr_… (account / team role) or pr_…_nr_… (project role).
+        ///</summary>
+        [DataMember]
+        public virtual string RoleId { get; set; }
+
+        ///<summary>
+        ///None, Viewer, FunctionsOnly, ReadOnly or FullAccess.
+        ///</summary>
+        [DataMember]
+        public virtual MarketplaceAccessLevel Package { get; set; }
+
+        ///<summary>
+        ///True to also give the Manage package (edit the connection, its secrets, validation and functions).
+        ///</summary>
+        [DataMember]
+        public virtual bool Manage { get; set; }
+    }
+
     [NorbixRoute("/{version}/code/marketplace/integrations/{IntegrationViewId}/token-mappings", "PUT")]
     [DataContract]
     public partial class SetMarketplaceIntegrationTokenMappingsRequest
@@ -11707,6 +11968,24 @@ public partial class SetMarketplaceIntegrationTokenMappingsResponse
     {
     }
 
+    [NorbixRoute("/{version}/code/marketplace/integrations/{IntegrationViewId}/oauth/start", "POST")]
+    public partial class StartMarketplaceIntegrationSignIn
+        : CodeMashRequestBase, INorbixRequest<StartMarketplaceIntegrationSignInResponse>
+    {
+        ///<summary>
+        ///Integration view id, from get_marketplace_integrations.
+        ///</summary>
+        public virtual string IntegrationViewId { get; set; }
+    }
+
+    public partial class StartMarketplaceIntegrationSignInResponse
+        : ResponseBase
+    {
+        public virtual string? AuthorizeUrl { get; set; }
+        public virtual string? RedirectUrl { get; set; }
+        public virtual DateTime? ExpiresAt { get; set; }
+    }
+
     [NorbixRoute("/{version}/code/marketplace/integrations/{IntegrationViewId}/test", "POST")]
     public partial class TestMarketplaceIntegration
         : CodeMashRequestBase, INorbixRequest<TestMarketplaceIntegrationResponse>