Add approval request HTTP surface

crates/crank-core/src/approval.rs

@@ -0,0 +1,39 @@
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use time::OffsetDateTime;
+
+use crate::ids::{AgentId, ApprovalRequestId, OperationId, PlatformApiKeyId, WorkspaceId};
+use crate::operation::OperationApprovalRiskLevel;
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ApprovalRequestStatus {
+    #[default]
+    Pending,
+    Approved,
+    Denied,
+    Expired,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct ApprovalRequest {
+    pub id: ApprovalRequestId,
+    pub workspace_id: WorkspaceId,
+    pub agent_id: AgentId,
+    pub operation_id: OperationId,
+    pub operation_version: u32,
+    pub status: ApprovalRequestStatus,
+    pub risk_level: OperationApprovalRiskLevel,
+    pub confirmation_title: String,
+    pub confirmation_body: String,
+    pub request_payload: Value,
+    pub response_payload: Option<Value>,
+    #[serde(with = "time::serde::rfc3339")]
+    pub created_at: OffsetDateTime,
+    #[serde(with = "time::serde::rfc3339")]
+    pub expires_at: OffsetDateTime,
+    #[serde(with = "time::serde::rfc3339::option")]
+    pub decided_at: Option<OffsetDateTime>,
+    pub decided_by_key_id: Option<PlatformApiKeyId>,
+    pub decision_note: Option<String>,
+}

crates/crank-core/src/ids.rs

@@ -53,6 +53,7 @@ define_id!(UserSessionId);
 define_id!(AgentId);
 define_id!(InvitationId);
 define_id!(PlatformApiKeyId);
+define_id!(ApprovalRequestId);
 define_id!(InvocationLogId);
 define_id!(AuditEventId);
 define_id!(SecretId);

crates/crank-core/src/lib.rs

@@ -1,5 +1,6 @@
 pub mod access;
 pub mod agent;
+pub mod approval;
 pub mod auth;
 pub mod cache;
 pub mod edition;
@@ -18,6 +19,7 @@ pub mod domain {
         PlatformApiKeyKind, PlatformApiKeyScope, PlatformApiKeyStatus, User, UserStatus,
     };
     pub use crate::agent::{Agent, AgentOperationBinding, AgentStatus, AgentVersion};
+    pub use crate::approval::{ApprovalRequest, ApprovalRequestStatus};
     pub use crate::auth::{
         ApiKeyHeaderAuthConfig, ApiKeyQueryAuthConfig, AuthConfig, AuthProfile, BasicAuthConfig,
         BearerAuthConfig,
@@ -31,9 +33,9 @@ pub mod domain {
         ProductEdition,
     };
     pub use crate::ids::{
-        AgentId, AuditEventId, AuthProfileId, DescriptorId, InvitationId, InvocationLogId,
-        OperationId, PlatformApiKeyId, SampleId, SecretId, ToolId, UserId, UserSessionId,
-        WorkspaceId,
+        AgentId, ApprovalRequestId, AuditEventId, AuthProfileId, DescriptorId, InvitationId,
+        InvocationLogId, OperationId, PlatformApiKeyId, SampleId, SecretId, ToolId, UserId,
+        UserSessionId, WorkspaceId,
     };
     pub use crate::observability::{
         InvocationLevel, InvocationLog, InvocationSource, InvocationStatus, UsagePeriod,
@@ -89,6 +91,7 @@ pub use access::{
     PlatformApiKeyKind, PlatformApiKeyScope, PlatformApiKeyStatus, User, UserStatus,
 };
 pub use agent::{Agent, AgentOperationBinding, AgentStatus, AgentVersion};
+pub use approval::{ApprovalRequest, ApprovalRequestStatus};
 pub use auth::{
     ApiKeyHeaderAuthConfig, ApiKeyQueryAuthConfig, AuthConfig, AuthProfile, BasicAuthConfig,
     BearerAuthConfig,
@@ -121,8 +124,9 @@ pub use ext::protocol::{
     SharedProtocolAdapter,
 };
 pub use ids::{
-    AgentId, AuditEventId, AuthProfileId, DescriptorId, InvitationId, InvocationLogId, OperationId,
-    PlatformApiKeyId, SampleId, SecretId, ToolId, UserId, UserSessionId, WorkspaceId,
+    AgentId, ApprovalRequestId, AuditEventId, AuthProfileId, DescriptorId, InvitationId,
+    InvocationLogId, OperationId, PlatformApiKeyId, SampleId, SecretId, ToolId, UserId,
+    UserSessionId, WorkspaceId,
 };
 pub use observability::{
     InvocationLevel, InvocationLog, InvocationSource, InvocationStatus, UsagePeriod, UsageRollup,