feat(tailscale): expand and validate API operations

Author: waleedlatif1

apps/docs/content/docs/integrations/tailscale.mdx

@@ -5938,30 +5938,46 @@ import {
   tableUpsertRowTool,
 } from '@/tools/table'
 import {
+  tailscaleApproveUserTool,
   tailscaleAuthorizeDeviceTool,
   tailscaleCreateAuthKeyTool,
   tailscaleDeleteAuthKeyTool,
+  tailscaleDeleteDeviceAttributeTool,
   tailscaleDeleteDeviceTool,
   tailscaleDeleteUserTool,
   tailscaleExpireDeviceKeyTool,
   tailscaleGetAclTool,
   tailscaleGetAuthKeyTool,
+  tailscaleGetDeviceAttributesTool,
   tailscaleGetDeviceRoutesTool,
   tailscaleGetDeviceTool,
+  tailscaleGetDnsConfigurationTool,
   tailscaleGetDnsPreferencesTool,
   tailscaleGetDnsSearchpathsTool,
+  tailscaleGetSplitDnsTool,
+  tailscaleGetTailnetSettingsTool,
+  tailscaleGetUserTool,
   tailscaleListAuthKeysTool,
   tailscaleListDevicesTool,
   tailscaleListDnsNameserversTool,
   tailscaleListUsersTool,
+  tailscaleRestoreUserTool,
   tailscaleSetAclTool,
+  tailscaleSetDeviceAttributeTool,
+  tailscaleSetDeviceNameTool,
   tailscaleSetDeviceRoutesTool,
   tailscaleSetDeviceTagsTool,
+  tailscaleSetDnsConfigurationTool,
   tailscaleSetDnsNameserversTool,
   tailscaleSetDnsPreferencesTool,
   tailscaleSetDnsSearchpathsTool,
+  tailscaleSetSplitDnsTool,
+  tailscaleSetUserRoleTool,
   tailscaleSuspendUserTool,
   tailscaleUpdateDeviceKeyTool,
+  tailscaleUpdateSplitDnsTool,
+  tailscaleUpdateTailnetSettingsTool,
+  tailscaleValidateAclTool,
 } from '@/tools/tailscale'
 import { tavilyCrawlTool, tavilyExtractTool, tavilyMapTool, tavilySearchTool } from '@/tools/tavily'
 import {
@@ -8251,30 +8267,46 @@ export const tools: Record<string, ExecutableToolConfig> = {
   supabase_storage_get_public_url: supabaseStorageGetPublicUrlTool,
   supabase_storage_create_signed_url: supabaseStorageCreateSignedUrlTool,
   supabase_storage_create_signed_upload_url: supabaseStorageCreateSignedUploadUrlTool,
-  tailscale_list_devices: tailscaleListDevicesTool,
-  tailscale_get_device: tailscaleGetDeviceTool,
-  tailscale_delete_device: tailscaleDeleteDeviceTool,
+  tailscale_approve_user: tailscaleApproveUserTool,
   tailscale_authorize_device: tailscaleAuthorizeDeviceTool,
-  tailscale_set_device_tags: tailscaleSetDeviceTagsTool,
-  tailscale_get_device_routes: tailscaleGetDeviceRoutesTool,
-  tailscale_set_device_routes: tailscaleSetDeviceRoutesTool,
-  tailscale_update_device_key: tailscaleUpdateDeviceKeyTool,
+  tailscale_create_auth_key: tailscaleCreateAuthKeyTool,
+  tailscale_delete_auth_key: tailscaleDeleteAuthKeyTool,
+  tailscale_delete_device: tailscaleDeleteDeviceTool,
+  tailscale_delete_device_attribute: tailscaleDeleteDeviceAttributeTool,
+  tailscale_delete_user: tailscaleDeleteUserTool,
   tailscale_expire_device_key: tailscaleExpireDeviceKeyTool,
+  tailscale_get_acl: tailscaleGetAclTool,
+  tailscale_get_auth_key: tailscaleGetAuthKeyTool,
+  tailscale_get_device: tailscaleGetDeviceTool,
+  tailscale_get_device_attributes: tailscaleGetDeviceAttributesTool,
+  tailscale_get_device_routes: tailscaleGetDeviceRoutesTool,
+  tailscale_get_dns_configuration: tailscaleGetDnsConfigurationTool,
+  tailscale_get_dns_preferences: tailscaleGetDnsPreferencesTool,
+  tailscale_get_dns_searchpaths: tailscaleGetDnsSearchpathsTool,
+  tailscale_get_split_dns: tailscaleGetSplitDnsTool,
+  tailscale_get_tailnet_settings: tailscaleGetTailnetSettingsTool,
+  tailscale_get_user: tailscaleGetUserTool,
+  tailscale_list_auth_keys: tailscaleListAuthKeysTool,
+  tailscale_list_devices: tailscaleListDevicesTool,
   tailscale_list_dns_nameservers: tailscaleListDnsNameserversTool,
+  tailscale_list_users: tailscaleListUsersTool,
+  tailscale_restore_user: tailscaleRestoreUserTool,
+  tailscale_set_acl: tailscaleSetAclTool,
+  tailscale_set_device_attribute: tailscaleSetDeviceAttributeTool,
+  tailscale_set_device_name: tailscaleSetDeviceNameTool,
+  tailscale_set_device_routes: tailscaleSetDeviceRoutesTool,
+  tailscale_set_device_tags: tailscaleSetDeviceTagsTool,
+  tailscale_set_dns_configuration: tailscaleSetDnsConfigurationTool,
   tailscale_set_dns_nameservers: tailscaleSetDnsNameserversTool,
-  tailscale_get_dns_preferences: tailscaleGetDnsPreferencesTool,
   tailscale_set_dns_preferences: tailscaleSetDnsPreferencesTool,
-  tailscale_get_dns_searchpaths: tailscaleGetDnsSearchpathsTool,
   tailscale_set_dns_searchpaths: tailscaleSetDnsSearchpathsTool,
-  tailscale_list_users: tailscaleListUsersTool,
+  tailscale_set_split_dns: tailscaleSetSplitDnsTool,
+  tailscale_set_user_role: tailscaleSetUserRoleTool,
   tailscale_suspend_user: tailscaleSuspendUserTool,
-  tailscale_delete_user: tailscaleDeleteUserTool,
-  tailscale_create_auth_key: tailscaleCreateAuthKeyTool,
-  tailscale_list_auth_keys: tailscaleListAuthKeysTool,
-  tailscale_get_auth_key: tailscaleGetAuthKeyTool,
-  tailscale_delete_auth_key: tailscaleDeleteAuthKeyTool,
-  tailscale_get_acl: tailscaleGetAclTool,
-  tailscale_set_acl: tailscaleSetAclTool,
+  tailscale_update_device_key: tailscaleUpdateDeviceKeyTool,
+  tailscale_update_split_dns: tailscaleUpdateSplitDnsTool,
+  tailscale_update_tailnet_settings: tailscaleUpdateTailnetSettingsTool,
+  tailscale_validate_acl: tailscaleValidateAclTool,
   calendly_get_current_user: calendlyGetCurrentUserTool,
   calendly_get_user: calendlyGetUserTool,
   calendly_list_event_types: calendlyListEventTypesTool,

apps/sim/blocks/blocks/tailscale.ts

@@ -0,0 +1,52 @@
+import type { TailscaleApproveUserResponse, TailscaleUserParams } from '@/tools/tailscale/types'
+import { assertTailscaleResponse } from '@/tools/tailscale/utils'
+import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
+
+export const tailscaleApproveUserTool: ToolConfig<
+  TailscaleUserParams,
+  TailscaleApproveUserResponse
+> = {
+  id: 'tailscale_approve_user',
+  name: 'Tailscale Approve User',
+  description: 'Approve a pending user to join the tailnet',
+  version: '1.0.0',
+  params: {
+    apiKey: {
+      type: 'string',
+      required: true,
+      visibility: 'user-only',
+      description:
+        'Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)',
+    },
+    userId: {
+      type: 'string',
+      required: true,
+      visibility: 'user-or-llm',
+      description: 'Tailscale user ID',
+    },
+  },
+  request: {
+    url: (params) =>
+      `https://api.tailscale.com/api/v2/users/${safeUrlPathSegment(params.userId, 'userId')}/approve`,
+    method: 'POST',
+    headers: (params) => ({
+      Authorization: `Bearer ${params.apiKey.trim()}`,
+      'Content-Type': 'application/json',
+    }),
+  },
+  transformResponse: async (response, params) => {
+    await assertTailscaleResponse(response)
+    return { success: true, output: { success: true, userId: params?.userId ?? '' } }
+  },
+  outputs: {
+    success: {
+      type: 'boolean',
+      description: 'Whether the operation succeeded',
+    },
+    userId: {
+      type: 'string',
+      description: 'ID of the affected user',
+    },
+  },
+}

apps/sim/tools/generated/tool-ids.ts

@@ -1,5 +1,10 @@
+import type {
+  TailscaleAuthorizeDeviceParams,
+  TailscaleAuthorizeDeviceResponse,
+} from '@/tools/tailscale/types'
+import { assertTailscaleResponse } from '@/tools/tailscale/utils'
 import type { ToolConfig } from '@/tools/types'
-import type { TailscaleAuthorizeDeviceParams, TailscaleAuthorizeDeviceResponse } from './types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const tailscaleAuthorizeDeviceTool: ToolConfig<
   TailscaleAuthorizeDeviceParams,
@@ -9,70 +14,60 @@ export const tailscaleAuthorizeDeviceTool: ToolConfig<
   name: 'Tailscale Authorize Device',
   description: 'Authorize or deauthorize a device on the tailnet',
   version: '1.0.0',
-
   params: {
     apiKey: {
       type: 'string',
       required: true,
       visibility: 'user-only',
-      description: 'Tailscale API key',
-    },
-    tailnet: {
-      type: 'string',
-      required: true,
-      visibility: 'user-or-llm',
-      description: 'Tailnet name (e.g., example.com) or "-" for default',
+      description:
+        'Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)',
     },
     deviceId: {
       type: 'string',
       required: true,
       visibility: 'user-or-llm',
-      description: 'Device ID to authorize',
+      description: 'Device nodeId (preferred) or legacy device ID',
     },
     authorized: {
       type: 'boolean',
       required: true,
       visibility: 'user-or-llm',
-      description: 'Whether to authorize (true) or deauthorize (false) the device',
+      description: 'Whether to authorize or deauthorize the device',
     },
   },
-
   request: {
     url: (params) =>
-      `https://api.tailscale.com/api/v2/device/${encodeURIComponent(params.deviceId.trim())}/authorized`,
+      `https://api.tailscale.com/api/v2/device/${safeUrlPathSegment(params.deviceId, 'deviceId')}/authorized`,
     method: 'POST',
     headers: (params) => ({
       Authorization: `Bearer ${params.apiKey.trim()}`,
       'Content-Type': 'application/json',
     }),
-    body: (params) => ({
-      authorized: params.authorized,
-    }),
+    body: (params) => ({ authorized: params.authorized }),
   },
-
-  transformResponse: async (response: Response, params?: TailscaleAuthorizeDeviceParams) => {
-    if (!response.ok) {
-      const data = await response.json().catch(() => ({}))
-      return {
-        success: false,
-        output: { success: false, deviceId: '', authorized: false },
-        error: (data as Record<string, string>).message ?? 'Failed to authorize device',
-      }
-    }
-
+  transformResponse: async (response, params) => {
+    await assertTailscaleResponse(response)
     return {
       success: true,
       output: {
         success: true,
         deviceId: params?.deviceId ?? '',
-        authorized: params?.authorized ?? true,
+        authorized: params?.authorized ?? false,
       },
     }
   },
-
   outputs: {
-    success: { type: 'boolean', description: 'Whether the operation succeeded' },
-    deviceId: { type: 'string', description: 'Device ID' },
-    authorized: { type: 'boolean', description: 'Authorization status after the operation' },
+    success: {
+      type: 'boolean',
+      description: 'Whether the operation succeeded',
+    },
+    deviceId: {
+      type: 'string',
+      description: 'ID of the affected device',
+    },
+    authorized: {
+      type: 'boolean',
+      description: 'Requested device authorization state',
+    },
   },
 }