Autorização

RESOURCE_ID=$(mka1 llm conversations create \
  --body '{ "metadata": { "project": "acme" } }' \
  -H 'X-On-Behalf-Of: user_alice' \
  -o json | jq -r '.id')

import { SDK } from '@meetkai/mka1'

const mka1 = new SDK({ bearerAuth: 'Bearer YOUR_API_KEY' })

// Alice creates a conversation and becomes its owner
const conv = await mka1.llm.conversations.create({
  xOnBehalfOf: 'user_alice',
  createConversationRequest: {
    metadata: { project: 'acme' },
  },
})
const resourceId = conv.id // e.g. conv_abc123

using MeetKai.MKA1;
using MeetKai.MKA1.Types.Components;

var sdk = new SDK(bearerAuth: "Bearer YOUR_API_KEY");

// Alice creates a conversation and becomes its owner
var conv = await sdk.Llm.Conversations.CreateAsync(
    body: new CreateConversationRequest()
    {
        Metadata = new Dictionary<string, string> { { "project", "acme" } },
    },
    xOnBehalfOf: "user_alice"
);
var resourceId = conv.ConversationObject!.Id;

from meetkai_mka1 import SDK

sdk = SDK(bearer_auth="Bearer YOUR_API_KEY")

# Alice cria uma conversa e se torna sua proprietária
conv = sdk.llm.conversations.create(
    metadata={"project": "acme"},
    x_on_behalf_of="user_alice",
)
resource_id = conv.id

RESOURCE_ID=$(curl -s https://apigw.mka1.com/api/v1/llm/conversations \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data '{ "metadata": { "project": "acme" } }' | jq -r '.id')

mka1 permissions llm grant \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --user-id user_bob \
  --role reader \
  -H 'X-On-Behalf-Of: user_alice'

// Alice grants reader access to user_bob on her conversation
await mka1.permissions.llm.grant({
  xOnBehalfOf: 'user_alice',
  grantPermissionRequest: {
    resourceType: 'conversation',
    resourceId,
    userId: 'user_bob',
    role: 'reader',
  },
})

// Alice grants reader access to user_bob on her conversation
await sdk.Permissions.Llm.GrantAsync(
    body: new GrantPermissionRequest()
    {
        ResourceType = LlmResourceType.Conversation,
        ResourceId = resourceId,
        UserId = "user_bob",
        Role = ResourceRole.Reader,
    },
    xOnBehalfOf: "user_alice"
);

# Alice concede acesso de leitor a user_bob em sua conversa
sdk.permissions.llm.grant(
    resource_type="conversation",
    resource_id=resource_id,
    user_id="user_bob",
    role="reader",
    x_on_behalf_of="user_alice",
)

curl https://apigw.mka1.com/api/v1/authorization/llm/grant \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data "{
    \"resourceType\": \"conversation\",
    \"resourceId\": \"$RESOURCE_ID\",
    \"userId\": \"user_bob\",
    \"role\": \"reader\"
  }"

mka1 permissions llm check \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --role reader \
  -H 'X-On-Behalf-Of: user_bob'

// Bob checks whether he has reader access
const result = await mka1.permissions.llm.check({
  resourceType: 'conversation',
  resourceId,
  role: 'reader',
  xOnBehalfOf: 'user_bob',
})

console.log(result.allowed) // true

// Bob checks whether he has reader access
var result = await sdk.Permissions.Llm.CheckAsync(
    resourceType: LlmResourceType.Conversation,
    resourceId: resourceId,
    role: ResourceRole.Reader,
    xOnBehalfOf: "user_bob"
);

Console.WriteLine(result.CheckPermissionResponse!.Allowed); // true

# Bob verifica se tem acesso de leitor
result = sdk.permissions.llm.check(
    resource_type="conversation",
    resource_id=resource_id,
    role="reader",
    x_on_behalf_of="user_bob",
)

print(result.allowed)  # True

curl "https://apigw.mka1.com/api/v1/authorization/llm/check?resourceType=conversation&resourceId=$RESOURCE_ID&role=reader" \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_bob'

mka1 permissions llm revoke \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --user-id user_bob \
  --role reader \
  -H 'X-On-Behalf-Of: user_alice'

// Alice revokes Bob's reader access
await mka1.permissions.llm.revoke({
  xOnBehalfOf: 'user_alice',
  revokePermissionRequest: {
    resourceType: 'conversation',
    resourceId,
    userId: 'user_bob',
    role: 'reader',
  },
})

// Alice revokes Bob's reader access
await sdk.Permissions.Llm.RevokeAsync(
    body: new RevokePermissionRequest()
    {
        ResourceType = LlmResourceType.Conversation,
        ResourceId = resourceId,
        UserId = "user_bob",
        Role = ResourceRole.Reader,
    },
    xOnBehalfOf: "user_alice"
);

# Alice revoga o acesso de leitor de Bob
sdk.permissions.llm.revoke(
    resource_type="conversation",
    resource_id=resource_id,
    user_id="user_bob",
    role="reader",
    x_on_behalf_of="user_alice",
)

curl https://apigw.mka1.com/api/v1/authorization/llm/revoke \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data "{
    \"resourceType\": \"conversation\",
    \"resourceId\": \"$RESOURCE_ID\",
    \"userId\": \"user_bob\",
    \"role\": \"reader\"
  }"

mka1 permissions llm grant \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --user-id '*' \
  --role reader \
  -H 'X-On-Behalf-Of: user_alice'

// Alice makes her conversation publicly readable
await mka1.permissions.llm.grant({
  xOnBehalfOf: 'user_alice',
  grantPermissionRequest: {
    resourceType: 'conversation',
    resourceId,
    userId: '*',
    role: 'reader',
  },
})

// Alice makes her conversation publicly readable
await sdk.Permissions.Llm.GrantAsync(
    body: new GrantPermissionRequest()
    {
        ResourceType = LlmResourceType.Conversation,
        ResourceId = resourceId,
        UserId = "*",
        Role = ResourceRole.Reader,
    },
    xOnBehalfOf: "user_alice"
);

# Alice torna sua conversa publicamente legível
sdk.permissions.llm.grant(
    resource_type="conversation",
    resource_id=resource_id,
    user_id="*",
    role="reader",
    x_on_behalf_of="user_alice",
)

curl https://apigw.mka1.com/api/v1/authorization/llm/grant \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data "{
    \"resourceType\": \"conversation\",
    \"resourceId\": \"$RESOURCE_ID\",
    \"userId\": \"*\",
    \"role\": \"reader\"
  }"

# Etapa 1 — Alice cria uma conversa (ela se torna a proprietária)
CONV_JSON=$(mka1 llm conversations create \
  --body '{ "metadata": { "project": "acme" } }' \
  -H 'X-On-Behalf-Of: user_alice' \
  -o json)
RESOURCE_ID=$(echo "$CONV_JSON" | jq -r '.id')

# Etapa 2 — Alice concede acesso de leitor a Bob
mka1 permissions llm grant \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --user-id user_bob \
  --role reader \
  -H 'X-On-Behalf-Of: user_alice'

# Etapa 3 — Verifique se Bob tem acesso de leitor (allowed: true)
mka1 permissions llm check \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --role reader \
  -H 'X-On-Behalf-Of: user_bob'

# Etapa 3b — Verifique se Bob NÃO tem acesso de editor (allowed: false)
mka1 permissions llm check \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --role writer \
  -H 'X-On-Behalf-Of: user_bob'

# Etapa 4 — Bob tenta conceder (retorna 403 Forbidden)
mka1 permissions llm grant \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --user-id user_charlie \
  --role reader \
  -H 'X-On-Behalf-Of: user_bob'

# Etapa 5 — Alice revoga o acesso de Bob
mka1 permissions llm revoke \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --user-id user_bob \
  --role reader \
  -H 'X-On-Behalf-Of: user_alice'

# Etapa 6 — Verifique se Bob agora não tem acesso (allowed: false)
mka1 permissions llm check \
  --resource-type conversation \
  --resource-id "$RESOURCE_ID" \
  --role reader \
  -H 'X-On-Behalf-Of: user_bob'

import { SDK } from '@meetkai/mka1'
import { SDKError } from '@meetkai/mka1/models/errors'

const mka1 = new SDK({ bearerAuth: 'Bearer YOUR_API_KEY' })

// Step 1 — Alice creates a conversation (she becomes the owner)
const conv = await mka1.llm.conversations.create({
  xOnBehalfOf: 'user_alice',
  createConversationRequest: {
    metadata: { project: 'acme' },
  },
})
const resourceId = conv.id

// Step 2 — Alice grants reader access to Bob
await mka1.permissions.llm.grant({
  xOnBehalfOf: 'user_alice',
  grantPermissionRequest: {
    resourceType: 'conversation',
    resourceId,
    userId: 'user_bob',
    role: 'reader',
  },
})

// Step 3 — Check Bob's permissions
// Bob has reader access → allowed
const bobReader = await mka1.permissions.llm.check({
  resourceType: 'conversation',
  resourceId,
  role: 'reader',
  xOnBehalfOf: 'user_bob',
})
console.log('Bob reader:', bobReader.allowed) // true

// Bob does NOT have writer access → denied
const bobWriter = await mka1.permissions.llm.check({
  resourceType: 'conversation',
  resourceId,
  role: 'writer',
  xOnBehalfOf: 'user_bob',
})
console.log('Bob writer:', bobWriter.allowed) // false

// Step 4 — Bob tries to grant (fails with 403)
try {
  await mka1.permissions.llm.grant({
    xOnBehalfOf: 'user_bob',
    grantPermissionRequest: {
      resourceType: 'conversation',
      resourceId,
      userId: 'user_charlie',
      role: 'reader',
    },
  })
} catch (err) {
  if (err instanceof SDKError) {
    console.log('Bob grant rejected:', err.statusCode) // 403
  }
}

// Step 5 — Alice revokes Bob's access
await mka1.permissions.llm.revoke({
  xOnBehalfOf: 'user_alice',
  revokePermissionRequest: {
    resourceType: 'conversation',
    resourceId,
    userId: 'user_bob',
    role: 'reader',
  },
})

// Step 6 — Verify Bob is now denied
const bobAfterRevoke = await mka1.permissions.llm.check({
  resourceType: 'conversation',
  resourceId,
  role: 'reader',
  xOnBehalfOf: 'user_bob',
})
console.log('Bob after revoke:', bobAfterRevoke.allowed) // false

using MeetKai.MKA1;
using MeetKai.MKA1.Types.Components;
using MeetKai.MKA1.Types.Errors;

var sdk = new SDK(bearerAuth: "Bearer YOUR_API_KEY");

// Step 1 — Alice creates a conversation (she becomes the owner)
var conv = await sdk.Llm.Conversations.CreateAsync(
    body: new CreateConversationRequest()
    {
        Metadata = new Dictionary<string, string> { { "project", "acme" } },
    },
    xOnBehalfOf: "user_alice"
);
var resourceId = conv.ConversationObject!.Id;

// Step 2 — Alice grants reader access to Bob
await sdk.Permissions.Llm.GrantAsync(
    body: new GrantPermissionRequest()
    {
        ResourceType = LlmResourceType.Conversation,
        ResourceId = resourceId,
        UserId = "user_bob",
        Role = ResourceRole.Reader,
    },
    xOnBehalfOf: "user_alice"
);

// Step 3 — Check Bob's permissions
// Bob has reader access → allowed
var bobReader = await sdk.Permissions.Llm.CheckAsync(
    resourceType: LlmResourceType.Conversation,
    resourceId: resourceId,
    role: ResourceRole.Reader,
    xOnBehalfOf: "user_bob"
);
Console.WriteLine($"Bob reader: {bobReader.CheckPermissionResponse!.Allowed}"); // true

// Bob does NOT have writer access → denied
var bobWriter = await sdk.Permissions.Llm.CheckAsync(
    resourceType: LlmResourceType.Conversation,
    resourceId: resourceId,
    role: ResourceRole.Writer,
    xOnBehalfOf: "user_bob"
);
Console.WriteLine($"Bob writer: {bobWriter.CheckPermissionResponse!.Allowed}"); // false

// Step 4 — Bob tries to grant (fails with 403)
try
{
    await sdk.Permissions.Llm.GrantAsync(
        body: new GrantPermissionRequest()
        {
            ResourceType = LlmResourceType.Conversation,
            ResourceId = resourceId,
            UserId = "user_charlie",
            Role = ResourceRole.Reader,
        },
        xOnBehalfOf: "user_bob"
    );
}
catch (APIException ex)
{
    Console.WriteLine($"Bob grant rejected: {(int)ex.Response.StatusCode}"); // 403
}

// Step 5 — Alice revokes Bob's access
await sdk.Permissions.Llm.RevokeAsync(
    body: new RevokePermissionRequest()
    {
        ResourceType = LlmResourceType.Conversation,
        ResourceId = resourceId,
        UserId = "user_bob",
        Role = ResourceRole.Reader,
    },
    xOnBehalfOf: "user_alice"
);

// Step 6 — Verify Bob is now denied
var bobAfterRevoke = await sdk.Permissions.Llm.CheckAsync(
    resourceType: LlmResourceType.Conversation,
    resourceId: resourceId,
    role: ResourceRole.Reader,
    xOnBehalfOf: "user_bob"
);
Console.WriteLine($"Bob after revoke: {bobAfterRevoke.CheckPermissionResponse!.Allowed}"); // false

# Etapa 1 — Alice cria uma conversa (ela se torna a proprietária)
conv = sdk.llm.conversations.create(
    metadata={"project": "acme"},
    x_on_behalf_of="user_alice",
)
resource_id = conv.id

# Etapa 2 — Alice concede acesso de leitor a Bob
sdk.permissions.llm.grant(
    resource_type="conversation",
    resource_id=resource_id,
    user_id="user_bob",
    role="reader",
    x_on_behalf_of="user_alice",
)

# Etapa 3 — Verifique as permissões de Bob
# Bob tem acesso de leitor -> permitido
bob_reader = sdk.permissions.llm.check(
    resource_type="conversation",
    resource_id=resource_id,
    role="reader",
    x_on_behalf_of="user_bob",
)
print("Bob reader:", bob_reader.allowed)  # True

# Bob NÃO tem acesso de editor -> negado
bob_writer = sdk.permissions.llm.check(
    resource_type="conversation",
    resource_id=resource_id,
    role="writer",
    x_on_behalf_of="user_bob",
)
print("Bob writer:", bob_writer.allowed)  # False

# Etapa 4 — Bob tenta conceder (falha com 403)
try:
    sdk.permissions.llm.grant(
        resource_type="conversation",
        resource_id=resource_id,
        user_id="user_charlie",
        role="reader",
        x_on_behalf_of="user_bob",
    )
except Exception as err:
    print("Bob grant rejected:", err)  # 403

# Etapa 5 — Alice revoga o acesso de Bob
sdk.permissions.llm.revoke(
    resource_type="conversation",
    resource_id=resource_id,
    user_id="user_bob",
    role="reader",
    x_on_behalf_of="user_alice",
)

# Etapa 6 — Verifique se Bob agora não tem acesso
bob_after_revoke = sdk.permissions.llm.check(
    resource_type="conversation",
    resource_id=resource_id,
    role="reader",
    x_on_behalf_of="user_bob",
)
print("Bob after revoke:", bob_after_revoke.allowed)  # False

# Etapa 1 — Alice cria uma conversa (ela se torna a proprietária)
CONV=$(curl -s https://apigw.mka1.com/api/v1/llm/conversations \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data '{ "metadata": { "project": "acme" } }')
RESOURCE_ID=$(echo "$CONV" | jq -r '.id')

# Etapa 2 — Alice concede acesso de leitor a Bob
curl https://apigw.mka1.com/api/v1/authorization/llm/grant \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data "{
    \"resourceType\": \"conversation\",
    \"resourceId\": \"$RESOURCE_ID\",
    \"userId\": \"user_bob\",
    \"role\": \"reader\"
  }"

# Etapa 3 — Verifique se Bob tem acesso de leitor (allowed: true)
curl "https://apigw.mka1.com/api/v1/authorization/llm/check?resourceType=conversation&resourceId=$RESOURCE_ID&role=reader" \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_bob'

# Etapa 3b — Verifique se Bob NÃO tem acesso de editor (allowed: false)
curl "https://apigw.mka1.com/api/v1/authorization/llm/check?resourceType=conversation&resourceId=$RESOURCE_ID&role=writer" \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_bob'

# Etapa 4 — Bob tenta conceder (retorna 403 Forbidden)
curl -s -o /dev/null -w "%{http_code}" \
  https://apigw.mka1.com/api/v1/authorization/llm/grant \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_bob' \
  --data "{
    \"resourceType\": \"conversation\",
    \"resourceId\": \"$RESOURCE_ID\",
    \"userId\": \"user_charlie\",
    \"role\": \"reader\"
  }"
# Saída: 403

# Etapa 5 — Alice revoga o acesso de Bob
curl https://apigw.mka1.com/api/v1/authorization/llm/revoke \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_alice' \
  --data "{
    \"resourceType\": \"conversation\",
    \"resourceId\": \"$RESOURCE_ID\",
    \"userId\": \"user_bob\",
    \"role\": \"reader\"
  }"

# Etapa 6 — Verifique se Bob agora não tem acesso (allowed: false)
curl "https://apigw.mka1.com/api/v1/authorization/llm/check?resourceType=conversation&resourceId=$RESOURCE_ID&role=reader" \
  --header 'Authorization: Bearer <mka1-api-key>' \
  --header 'X-On-Behalf-Of: user_bob'