Restrict apps to specific integration surfaces (#1298) - #2058

Summary

Closes #1298. Lets an admin declare which integration surfaces an app should be visible on (e.g. outlook), instead of maintaining near-duplicate app configs for web vs. Outlook. Absent/empty means "visible everywhere" — no behavior change for any existing app.

• Schema: server/validators/appConfigSchema.js — new optional restrictToIntegrations: string[] field on the app config.
• Enforcement: new isAppVisibleForSurface/filterAppsBySurface helpers in server/utils/authorization.js. configCache.getAppsForUser(user, platformConfig, { surface }) filters the app list by surface. GET /api/apps and GET /api/apps/:appId (server/routes/generalRoutes.js) accept a ?surface= query param (defaults to web); the single-app route hard-404s when the app is restricted away from the requesting surface, matching the "only accessible there" framing in the issue. Callers that don't pass a surface (e.g. the MCP permissions check) are unaffected — filtering is skipped entirely without one.
• Client: fetchApps/fetchAppDetails (client/src/api/endpoints/apps.js) accept a surface option. The Outlook add-in (OfficeChatPanel.jsx, OfficeApp.jsx via AppListPanel.jsx) now requests surface: 'outlook'.
• Admin UI: new "Visible On" checkbox group in the App Editor (AppFormEditor.jsx), next to Category.
• Docs: docs/apps.md (new field + dedicated section) and docs/outlook-add-in.md (relationship to the existing OAuth-client allowedApps allow-list — both must pass, composing as an intersection).
• Changelog entry added under docs/releases/5.5.0/features.md.

Scope decisions (per the issue's own open questions)

• Surface vocabulary kept open (z.array(z.string()), not a hard enum) with web/outlook as the only surfaces the admin UI currently offers — matches what actually exists in this codebase today (no live Teams/browser-extension app list wiring found to hook up yet).
• Surface detection is an explicit ?surface= query param, not OAuth-client inference — simpler and works for both OAuth and session-based access.
• Hard exclusion (404 on direct single-app fetch), not just hidden from the list grid, per the issue's "only accessible there" framing.
• Composes with the existing OAuth-client allowedApps allow-list as an intersection (both must permit).

Test plan

• npx eslint --fix / npx prettier --write on all changed files — no new errors, only pre-existing warnings.
• Validated the new Zod field accepts/rejects the right shapes (safeParse with no field, ["outlook"], and an invalid non-array value).
• Unit-style checks of isAppVisibleForSurface/filterAppsBySurface (default surface, explicit surface, undefined surface skips filtering).
• End-to-end against a running dev server: temporarily set restrictToIntegrations: ["outlook"] on the bundled chat app and confirmed GET /api/apps excludes it by default, includes it with ?surface=outlook, and GET /api/apps/:appId 404s / 200s accordingly. Reverted the test config afterward.
• Manual admin-UI verification of the new "Visible On" checkboxes in a browser (not run in this session — no browser available here).

🤖 Generated with Claude Code

https://claude.ai/code/session_01B6zxUynZdtEebP15P54aQB

Generated by Claude Code