From feaba710b9d4e3e437db945bdca5c109eae5fd19 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Burak=20Emre=20Kabakc=C4=B1?= <emrekabakci@gmail.com>
Date: Wed, 22 Apr 2026 01:47:32 +0100
Subject: [PATCH] fix(owletto-backend): add missing memberRole to internal
 ToolContext literals

#309 added the required memberRole field to ToolContext but missed three
non-MCP callers that build the context manually: public REST endpoints,
connection provisioning, and watcher reaction executor. The Docker build
runs a package-local tsc and caught these; main has been failing the
build-app image since #309 merged.
---
 packages/owletto-backend/src/rest-api.ts                   | 1 +
 .../owletto-backend/src/utils/provisioned-connection.ts    | 1 +
 packages/owletto-backend/src/watchers/reaction-executor.ts | 7 ++++++-
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/packages/owletto-backend/src/rest-api.ts b/packages/owletto-backend/src/rest-api.ts
index 63b241e5e..35284cf65 100644
--- a/packages/owletto-backend/src/rest-api.ts
+++ b/packages/owletto-backend/src/rest-api.ts
@@ -71,6 +71,7 @@ function publicToolContext(requestUrl: string, organizationId: string) {
   return {
     organizationId,
     userId: null,
+    memberRole: null,
     isAuthenticated: false,
     clientId: null,
     requestUrl,
diff --git a/packages/owletto-backend/src/utils/provisioned-connection.ts b/packages/owletto-backend/src/utils/provisioned-connection.ts
index 5a98ed330..291da204a 100644
--- a/packages/owletto-backend/src/utils/provisioned-connection.ts
+++ b/packages/owletto-backend/src/utils/provisioned-connection.ts
@@ -43,6 +43,7 @@ export async function createProvisionedConnection(
       {
         organizationId: params.organizationId,
         userId: params.userId,
+        memberRole: null,
         isAuthenticated: true,
         requestUrl: params.requestUrl,
         baseUrl: getConfiguredPublicOrigin() ?? undefined,
diff --git a/packages/owletto-backend/src/watchers/reaction-executor.ts b/packages/owletto-backend/src/watchers/reaction-executor.ts
index e81ff68b8..f911de345 100644
--- a/packages/owletto-backend/src/watchers/reaction-executor.ts
+++ b/packages/owletto-backend/src/watchers/reaction-executor.ts
@@ -35,7 +35,12 @@ function buildReactionSDK(
   const windowId = window.id;
   // userId=null + isAuthenticated=true signals a system/internal call (e.g. reaction scripts).
   // canWriteEntity() in organization-access.ts grants write access on org match alone for this case.
-  const toolCtx = { organizationId: organization_id, userId: null, isAuthenticated: true };
+  const toolCtx = {
+    organizationId: organization_id,
+    userId: null,
+    memberRole: null,
+    isAuthenticated: true,
+  };
   const entityIds = context.entities.map((e) => e.id);
 
   function track(