Files Plugin: OBO Gateway + Dev Playground

[atilafassina]

This PR implements an OBO Gateway and prevents the Files Plugin from using the Service Principal in production.

• Adds a gateway in Files Plugin injectRoutes()
• Injects user context on every handler
• Throws a 401 when user token isn't found
• Adds resolveUserContext(req) to Plugin
• Updates docs and tests accordingly
• Fixes upload URL
• Bubbles up token and scope errors to the user with 403
• Other errors are 401

---

dev playground

• Adds a Files route to dev-playground
• Updates app.yml to setup UC resource

---

files-api-playground.mp4

[Copilot]

Pull request overview

This PR introduces an OBO (on-behalf-of) gateway for the Files plugin so that all Files routes run under user context when a user token is present, and production requests without a user token are rejected. It also adjusts error propagation for auth-related SDK errors, fixes Files upload URL construction, and adds a dev-playground file browser route.

Changes:

• Add router-level middleware in Files plugin to establish user context via resolveUserContext(req) + runInUserContext() for all downstream handlers.
• Add resolveUserContext(req) to the base Plugin, and allow execute() to rethrow ApiError 401/403 so handlers can return those statuses.
• Fix FilesConnector upload URL host normalization and add dev-playground UI/routes for browsing files.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/appkit/src/plugins/files/tests/plugin.test.ts	Updates router mock to include use() for new gateway middleware registration.
packages/appkit/src/plugins/files/plugin.ts	Adds OBO gateway middleware and refactors handlers to rely on context + bubble 401/403 ApiErrors.
packages/appkit/src/plugin/plugin.ts	Adds resolveUserContext() and changes execute() to rethrow ApiError 401/403.
packages/appkit/src/connectors/files/client.ts	Normalizes host to include scheme when building REST upload URL.
docs/docs/plugins.md	Documents OBO gateway and new user-context resolution approach.
docs/docs/api/appkit/Class.Plugin.md	Adds API docs for resolveUserContext() and updates asUser() throws section.
apps/dev-playground/client/src/routes/index.tsx	Adds “File Browser” card to the dev-playground index.
apps/dev-playground/client/src/routes/files.route.tsx	New file browser route UI backed by /api/files/* endpoints.
apps/dev-playground/client/src/routes/__root.tsx	Adds a nav link to the new Files route.
apps/dev-playground/client/src/routeTree.gen.ts	Updates generated route tree to include /files.
apps/dev-playground/app.yaml	Adds DATABRICKS_DEFAULT_VOLUME env binding for the dev-playground.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.