Autorización

RESOURCE_ID=$(mka1 llm conversations create \
  --body '{ "metadata": { "project": "acme" } }' \
  -H 'X-On-Behalf-Of: user_alice' \
  -o json | jq -r '.id')

import { SDK } from '@meetkai/mka1'

const mka1 = new SDK({ bearerAuth: 'Bearer YOUR_API_KEY' })

// Alice crea una conversación y se convierte en su propietaria
const conv = await mka1.llm.conversations.create(
  { metadata: { project: 'acme' } },
  { headers: { 'X-On-Behalf-Of': 'user_alice' } }
)
const resourceId = conv.id // p. ej. conv_abc123

using MeetKai.MKA1;
using MeetKai.MKA1.Types.Components;

var sdk = new SDK(bearerAuth: "Bearer YOUR_API_KEY");

// Alice crea una conversación y se convierte en su propietaria
var conv = await sdk.Llm.Conversations.CreateAsync(
    body: new CreateConversationRequest()
    {
        Metadata = new Dictionary<string, string> { { "project", "acme" } },
    },
    xOnBehalfOf: "user_alice"
);
var resourceId = conv.ConversationObject!.Id;

from mka1 import SDK

sdk = SDK(bearer_auth="Bearer YOUR_API_KEY")

# Alice crea una conversación y se convierte en su propietaria
conv = sdk.llm.conversations.create(
    metadata={"project": "acme"},
    x_on_behalf_of="user_alice",
)
resource_id = conv.id

RESOURCE_ID=$(curl -s https://apigw.mka1.com/api/v1/llm/conversations \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data '{ "metadata": { "project": "acme" } }' | jq -r '.id')

mka1 permissions llm grant \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --user-id user_bob \
  --role reader \
  -H 'X-On-Behalf-Of: user_alice'

// Alice otorga acceso de lectura a user_bob en su conversación
await mka1.permissions.llm.grant(
  {
    resourceType: 'conversation',
    resourceId,
    userId: 'user_bob',
    role: 'reader',
  },
  { headers: { 'X-On-Behalf-Of': 'user_alice' } }
)

// Alice otorga acceso de lectura a user_bob en su conversación
await sdk.Permissions.Llm.GrantAsync(
    body: new GrantPermissionRequest()
    {
        ResourceType = LlmResourceType.Conversation,
        ResourceId = resourceId,
        UserId = "user_bob",
        Role = ResourceRole.Reader,
    },
    xOnBehalfOf: "user_alice"
);

# Alice otorga acceso de lectura a user_bob en su conversación
sdk.permissions.llm.grant(
    resource_type="conversation",
    resource_id=resource_id,
    user_id="user_bob",
    role="reader",
    x_on_behalf_of="user_alice",
)

curl https://apigw.mka1.com/api/v1/authorization/llm/grant \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data "{
    \"resourceType\": \"conversation\",
    \"resourceId\": \"$RESOURCE_ID\",
    \"userId\": \"user_bob\",
    \"role\": \"reader\"
  }"

mka1 permissions llm check \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --role reader \
  -H 'X-On-Behalf-Of: user_bob'

// Bob comprueba si tiene acceso de lectura
const result = await mka1.permissions.llm.check(
  {
    resourceType: 'conversation',
    resourceId,
    role: 'reader',
  },
  { headers: { 'X-On-Behalf-Of': 'user_bob' } }
)

console.log(result.allowed) // true

// Bob comprueba si tiene acceso de lectura
var result = await sdk.Permissions.Llm.CheckAsync(
    resourceType: LlmResourceType.Conversation,
    resourceId: resourceId,
    role: ResourceRole.Reader,
    xOnBehalfOf: "user_bob"
);

Console.WriteLine(result.CheckPermissionResponse!.Allowed); // true

# Bob comprueba si tiene acceso de lectura
result = sdk.permissions.llm.check(
    resource_type="conversation",
    resource_id=resource_id,
    role="reader",
    x_on_behalf_of="user_bob",
)

print(result.allowed)  # True

curl "https://apigw.mka1.com/api/v1/authorization/llm/check?resourceType=conversation&resourceId=$RESOURCE_ID&role=reader" \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_bob'

mka1 permissions llm revoke \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --user-id user_bob \
  --role reader \
  -H 'X-On-Behalf-Of: user_alice'

// Alice revoca el acceso de lectura de Bob
await mka1.permissions.llm.revoke(
  {
    resourceType: 'conversation',
    resourceId,
    userId: 'user_bob',
    role: 'reader',
  },
  { headers: { 'X-On-Behalf-Of': 'user_alice' } }
)

// Alice revoca el acceso de lectura de Bob
await sdk.Permissions.Llm.RevokeAsync(
    body: new RevokePermissionRequest()
    {
        ResourceType = LlmResourceType.Conversation,
        ResourceId = resourceId,
        UserId = "user_bob",
        Role = ResourceRole.Reader,
    },
    xOnBehalfOf: "user_alice"
);

# Alice revoca el acceso de lectura de Bob
sdk.permissions.llm.revoke(
    resource_type="conversation",
    resource_id=resource_id,
    user_id="user_bob",
    role="reader",
    x_on_behalf_of="user_alice",
)

curl https://apigw.mka1.com/api/v1/authorization/llm/revoke \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data "{
    \"resourceType\": \"conversation\",
    \"resourceId\": \"$RESOURCE_ID\",
    \"userId\": \"user_bob\",
    \"role\": \"reader\"
  }"

mka1 permissions llm grant \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --user-id '*' \
  --role reader \
  -H 'X-On-Behalf-Of: user_alice'

// Alice hace que su conversación sea legible públicamente
await mka1.permissions.llm.grant(
  {
    resourceType: 'conversation',
    resourceId,
    userId: '*',
    role: 'reader',
  },
  { headers: { 'X-On-Behalf-Of': 'user_alice' } }
)

// Alice hace que su conversación sea legible públicamente
await sdk.Permissions.Llm.GrantAsync(
    body: new GrantPermissionRequest()
    {
        ResourceType = LlmResourceType.Conversation,
        ResourceId = resourceId,
        UserId = "*",
        Role = ResourceRole.Reader,
    },
    xOnBehalfOf: "user_alice"
);

# Alice hace que su conversación sea legible públicamente
sdk.permissions.llm.grant(
    resource_type="conversation",
    resource_id=resource_id,
    user_id="*",
    role="reader",
    x_on_behalf_of="user_alice",
)

curl https://apigw.mka1.com/api/v1/authorization/llm/grant \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data "{
    \"resourceType\": \"conversation\",
    \"resourceId\": \"$RESOURCE_ID\",
    \"userId\": \"*\",
    \"role\": \"reader\"
  }"

# Paso 1 — Alice crea una conversación (ella se convierte en la propietaria)
CONV_JSON=$(mka1 llm conversations create \
  --body '{ "metadata": { "project": "acme" } }' \
  -H 'X-On-Behalf-Of: user_alice' \
  -o json)
RESOURCE_ID=$(echo "$CONV_JSON" | jq -r '.id')

# Paso 2 — Alice otorga acceso de lectura a Bob
mka1 permissions llm grant \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --user-id user_bob \
  --role reader \
  -H 'X-On-Behalf-Of: user_alice'

# Paso 3 — Comprobar que Bob tiene acceso de lectura (allowed: true)
mka1 permissions llm check \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --role reader \
  -H 'X-On-Behalf-Of: user_bob'

# Paso 3b — Comprobar que Bob NO tiene acceso de escritura (allowed: false)
mka1 permissions llm check \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --role writer \
  -H 'X-On-Behalf-Of: user_bob'

# Paso 4 — Bob intenta otorgar (devuelve 403 Forbidden)
mka1 permissions llm grant \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --user-id user_charlie \
  --role reader \
  -H 'X-On-Behalf-Of: user_bob'

# Paso 5 — Alice revoca el acceso de Bob
mka1 permissions llm revoke \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --user-id user_bob \
  --role reader \
  -H 'X-On-Behalf-Of: user_alice'

# Paso 6 — Verificar que Bob ahora está denegado (allowed: false)
mka1 permissions llm check \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --role reader \
  -H 'X-On-Behalf-Of: user_bob'

import { SDK } from '@meetkai/mka1'

const mka1 = new SDK({ bearerAuth: 'Bearer YOUR_API_KEY' })

// Paso 1 — Alice crea una conversación (ella se convierte en la propietaria)
const conv = await mka1.llm.conversations.create(
  { metadata: { project: 'acme' } },
  { headers: { 'X-On-Behalf-Of': 'user_alice' } }
)
const resourceId = conv.id

// Paso 2 — Alice otorga acceso de lectura a Bob
await mka1.permissions.llm.grant(
  {
    resourceType: 'conversation',
    resourceId,
    userId: 'user_bob',
    role: 'reader',
  },
  { headers: { 'X-On-Behalf-Of': 'user_alice' } }
)

// Paso 3 — Comprobar los permisos de Bob
// Bob tiene acceso de lectura → permitido
const bobReader = await mka1.permissions.llm.check(
  {
    resourceType: 'conversation',
    resourceId,
    role: 'reader',
  },
  { headers: { 'X-On-Behalf-Of': 'user_bob' } }
)
console.log('Bob reader:', bobReader.allowed) // true

// Bob NO tiene acceso de escritura → denegado
const bobWriter = await mka1.permissions.llm.check(
  {
    resourceType: 'conversation',
    resourceId,
    role: 'writer',
  },
  { headers: { 'X-On-Behalf-Of': 'user_bob' } }
)
console.log('Bob writer:', bobWriter.allowed) // false

// Paso 4 — Bob intenta otorgar (falla con 403)
try {
  await mka1.permissions.llm.grant(
    {
      resourceType: 'conversation',
      resourceId,
      userId: 'user_charlie',
      role: 'reader',
    },
    { headers: { 'X-On-Behalf-Of': 'user_bob' } }
  )
} catch (err) {
  console.log('Bob grant rejected:', err.statusCode) // 403
}

// Paso 5 — Alice revoca el acceso de Bob
await mka1.permissions.llm.revoke(
  {
    resourceType: 'conversation',
    resourceId,
    userId: 'user_bob',
    role: 'reader',
  },
  { headers: { 'X-On-Behalf-Of': 'user_alice' } }
)

// Paso 6 — Verificar que Bob ahora está denegado
const bobAfterRevoke = await mka1.permissions.llm.check(
  {
    resourceType: 'conversation',
    resourceId,
    role: 'reader',
  },
  { headers: { 'X-On-Behalf-Of': 'user_bob' } }
)
console.log('Bob after revoke:', bobAfterRevoke.allowed) // false

using MeetKai.MKA1;
using MeetKai.MKA1.Types.Components;
using MeetKai.MKA1.Types.Errors;

var sdk = new SDK(bearerAuth: "Bearer YOUR_API_KEY");

// Paso 1 — Alice crea una conversación (ella se convierte en la propietaria)
var conv = await sdk.Llm.Conversations.CreateAsync(
    body: new CreateConversationRequest()
    {
        Metadata = new Dictionary<string, string> { { "project", "acme" } },
    },
    xOnBehalfOf: "user_alice"
);
var resourceId = conv.ConversationObject!.Id;

// Paso 2 — Alice otorga acceso de lectura a Bob
await sdk.Permissions.Llm.GrantAsync(
    body: new GrantPermissionRequest()
    {
        ResourceType = LlmResourceType.Conversation,
        ResourceId = resourceId,
        UserId = "user_bob",
        Role = ResourceRole.Reader,
    },
    xOnBehalfOf: "user_alice"
);

// Paso 3 — Comprobar los permisos de Bob
// Bob tiene acceso de lectura → permitido
var bobReader = await sdk.Permissions.Llm.CheckAsync(
    resourceType: LlmResourceType.Conversation,
    resourceId: resourceId,
    role: ResourceRole.Reader,
    xOnBehalfOf: "user_bob"
);
Console.WriteLine($"Bob reader: {bobReader.CheckPermissionResponse!.Allowed}"); // true

// Bob NO tiene acceso de escritura → denegado
var bobWriter = await sdk.Permissions.Llm.CheckAsync(
    resourceType: LlmResourceType.Conversation,
    resourceId: resourceId,
    role: ResourceRole.Writer,
    xOnBehalfOf: "user_bob"
);
Console.WriteLine($"Bob writer: {bobWriter.CheckPermissionResponse!.Allowed}"); // false

// Paso 4 — Bob intenta otorgar (falla con 403)
try
{
    await sdk.Permissions.Llm.GrantAsync(
        body: new GrantPermissionRequest()
        {
            ResourceType = LlmResourceType.Conversation,
            ResourceId = resourceId,
            UserId = "user_charlie",
            Role = ResourceRole.Reader,
        },
        xOnBehalfOf: "user_bob"
    );
}
catch (APIException ex)
{
    Console.WriteLine($"Bob grant rejected: {(int)ex.Response.StatusCode}"); // 403
}

// Paso 5 — Alice revoca el acceso de Bob
await sdk.Permissions.Llm.RevokeAsync(
    body: new RevokePermissionRequest()
    {
        ResourceType = LlmResourceType.Conversation,
        ResourceId = resourceId,
        UserId = "user_bob",
        Role = ResourceRole.Reader,
    },
    xOnBehalfOf: "user_alice"
);

// Paso 6 — Verificar que Bob ahora está denegado
var bobAfterRevoke = await sdk.Permissions.Llm.CheckAsync(
    resourceType: LlmResourceType.Conversation,
    resourceId: resourceId,
    role: ResourceRole.Reader,
    xOnBehalfOf: "user_bob"
);
Console.WriteLine($"Bob after revoke: {bobAfterRevoke.CheckPermissionResponse!.Allowed}"); // false

# Paso 1 — Alice crea una conversación (ella se convierte en la propietaria)
conv = sdk.llm.conversations.create(
    metadata={"project": "acme"},
    x_on_behalf_of="user_alice",
)
resource_id = conv.id

# Paso 2 — Alice otorga acceso de lectura a Bob
sdk.permissions.llm.grant(
    resource_type="conversation",
    resource_id=resource_id,
    user_id="user_bob",
    role="reader",
    x_on_behalf_of="user_alice",
)

# Paso 3 — Comprobar los permisos de Bob
# Bob tiene acceso de lectura -> permitido
bob_reader = sdk.permissions.llm.check(
    resource_type="conversation",
    resource_id=resource_id,
    role="reader",
    x_on_behalf_of="user_bob",
)
print("Bob reader:", bob_reader.allowed)  # True

# Bob NO tiene acceso de escritura -> denegado
bob_writer = sdk.permissions.llm.check(
    resource_type="conversation",
    resource_id=resource_id,
    role="writer",
    x_on_behalf_of="user_bob",
)
print("Bob writer:", bob_writer.allowed)  # False

# Paso 4 — Bob intenta otorgar (falla con 403)
try:
    sdk.permissions.llm.grant(
        resource_type="conversation",
        resource_id=resource_id,
        user_id="user_charlie",
        role="reader",
        x_on_behalf_of="user_bob",
    )
except Exception as err:
    print("Bob grant rejected:", err)  # 403

# Paso 5 — Alice revoca el acceso de Bob
sdk.permissions.llm.revoke(
    resource_type="conversation",
    resource_id=resource_id,
    user_id="user_bob",
    role="reader",
    x_on_behalf_of="user_alice",
)

# Paso 6 — Verificar que Bob ahora está denegado
bob_after_revoke = sdk.permissions.llm.check(
    resource_type="conversation",
    resource_id=resource_id,
    role="reader",
    x_on_behalf_of="user_bob",
)
print("Bob after revoke:", bob_after_revoke.allowed)  # False

# Paso 1 — Alice crea una conversación (ella se convierte en la propietaria)
CONV=$(curl -s https://apigw.mka1.com/api/v1/llm/conversations \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data '{ "metadata": { "project": "acme" } }')
RESOURCE_ID=$(echo "$CONV" | jq -r '.id')

# Paso 2 — Alice otorga acceso de lectura a Bob
curl https://apigw.mka1.com/api/v1/authorization/llm/grant \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data "{
    \"resourceType\": \"conversation\",
    \"resourceId\": \"$RESOURCE_ID\",
    \"userId\": \"user_bob\",
    \"role\": \"reader\"
  }"

# Paso 3 — Comprobar que Bob tiene acceso de lectura (allowed: true)
curl "https://apigw.mka1.com/api/v1/authorization/llm/check?resourceType=conversation&resourceId=$RESOURCE_ID&role=reader" \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_bob'

# Paso 3b — Comprobar que Bob NO tiene acceso de escritura (allowed: false)
curl "https://apigw.mka1.com/api/v1/authorization/llm/check?resourceType=conversation&resourceId=$RESOURCE_ID&role=writer" \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_bob'

# Paso 4 — Bob intenta otorgar (devuelve 403 Forbidden)
curl -s -o /dev/null -w "%{http_code}" \
  https://apigw.mka1.com/api/v1/authorization/llm/grant \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_bob' \
  --data "{
    \"resourceType\": \"conversation\",
    \"resourceId\": \"$RESOURCE_ID\",
    \"userId\": \"user_charlie\",
    \"role\": \"reader\"
  }"
# Salida: 403

# Paso 5 — Alice revoca el acceso de Bob
curl https://apigw.mka1.com/api/v1/authorization/llm/revoke \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data "{
    \"resourceType\": \"conversation\",
    \"resourceId\": \"$RESOURCE_ID\",
    \"userId\": \"user_bob\",
    \"role\": \"reader\"
  }"

# Paso 6 — Verificar que Bob ahora está denegado (allowed: false)
curl "https://apigw.mka1.com/api/v1/authorization/llm/check?resourceType=conversation&resourceId=$RESOURCE_ID&role=reader" \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_bob'