@opengeni/api-router 0.11.8 → 0.12.0

package/src/mcp/server.ts

@@ -144,6 +144,10 @@ import {
 } from "./session-view";
 import type { ToolspaceMcpSurface } from "./toolspace";
 import { ensureSessionGroupReady as ensureViewerSessionGroupReady } from "../sandbox/viewer";
+import {
+  createOpenGeniSlackBotClient,
+  resolveSlackBotConnectionForTool,
+} from "../integrations/slack-bot";
 
 export type McpServerOptions = {
   // Origin of the HTTP request that reached the MCP route. Browser-oriented
@@ -219,6 +223,7 @@ export function buildOpenGeniMcpServer(
   }
   if (!toolspaceMode) {
     registerRigTools(server, deps, grant, can, sessionId, json);
+    registerSlackBotTools(server, deps, grant, sessionId, json);
   }
 
   // Orchestration, variableSet, and GitHub status/token tools are permission-gated
@@ -652,6 +657,121 @@ export function buildOpenGeniMcpServer(
   return server;
 }
 
+function registerSlackBotTools(
+  server: McpServer,
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  sessionId: string | null,
+  json: JsonResult,
+): void {
+  const clientFor = async (connectionId?: string) => {
+    const resolved = await resolveSlackBotConnectionForTool({
+      db: deps.db,
+      grant,
+      sessionId,
+      ...(connectionId ? { requestedConnectionId: connectionId } : {}),
+    });
+    return createOpenGeniSlackBotClient(deps, resolved);
+  };
+
+  server.registerTool(
+    "slack_bot_list_channels",
+    {
+      description:
+        "List public and bot-visible private Slack channels through the workspace-shared OpenGeni bot. isMember identifies channels the bot may read/post in; the bot never joins channels automatically.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        cursor: z4.string().max(1024).optional(),
+        limit: z4.number().int().min(1).max(200).optional(),
+      },
+    },
+    async ({ connectionId, cursor, limit }) =>
+      json(
+        await (
+          await clientFor(connectionId)
+        ).listChannels({
+          ...(cursor ? { cursor } : {}),
+          ...(limit !== undefined ? { limit } : {}),
+        }),
+      ),
+  );
+
+  server.registerTool(
+    "slack_bot_channel_history",
+    {
+      description:
+        "Read Slack channel history as the workspace-shared OpenGeni bot. Public and private channels both require bot membership; invite the bot to private channels first.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        channelId: z4.string().min(1).max(64),
+        cursor: z4.string().max(1024).optional(),
+        limit: z4.number().int().min(1).max(100).optional(),
+      },
+    },
+    async ({ connectionId, channelId, cursor, limit }) =>
+      json(
+        await (
+          await clientFor(connectionId)
+        ).channelHistory({
+          channelId,
+          ...(cursor ? { cursor } : {}),
+          ...(limit !== undefined ? { limit } : {}),
+        }),
+      ),
+  );
+
+  server.registerTool(
+    "slack_bot_list_users",
+    {
+      description: "List Slack workspace users through the workspace-shared OpenGeni bot.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        cursor: z4.string().max(1024).optional(),
+        limit: z4.number().int().min(1).max(200).optional(),
+      },
+    },
+    async ({ connectionId, cursor, limit }) =>
+      json(
+        await (
+          await clientFor(connectionId)
+        ).listUsers({
+          ...(cursor ? { cursor } : {}),
+          ...(limit !== undefined ? { limit } : {}),
+        }),
+      ),
+  );
+
+  server.registerTool(
+    "slack_bot_post_message",
+    {
+      description:
+        "Post as the workspace-shared OpenGeni bot. Pass channelId for a channel where the bot is already a member, or userId to open/post a DM; pass exactly one. Generate one operationId UUID per intended message and reuse that same UUID on every retry.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        operationId: z4.string().uuid(),
+        channelId: z4.string().min(1).max(64).optional(),
+        userId: z4.string().min(1).max(64).optional(),
+        text: z4.string().min(1).max(40_000),
+      },
+    },
+    async ({ connectionId, operationId, channelId, userId, text }) => {
+      if (Boolean(channelId) === Boolean(userId)) {
+        throw new Error("exactly one of channelId or userId is required");
+      }
+      return json(
+        await (
+          await clientFor(connectionId)
+        ).postMessage({
+          operationId,
+          ...(channelId ? { channelId } : {}),
+          ...(userId ? { userId } : {}),
+          text,
+        }),
+      );
+    },
+  );
+}
+
 function registerToolspaceProxyTools(server: McpServer, surface: ToolspaceMcpSurface | null): void {
   if (!surface) {
     return;

package/src/routes/connections.ts

@@ -1,4 +1,5 @@
 import {
+  ConnectOpenGeniSlackBotRequest,
   ConnectionResponse,
   CreateConnectionRequest,
   IntegrationClientMetadata,
@@ -7,12 +8,19 @@ import {
   OAuthStartResponse,
   UpdateConnectionRequest,
 } from "@opengeni/contracts";
-import { requireAccessGrant, requireEnvironmentEncryption } from "@opengeni/core";
+import {
+  hasReservedOpenGeniSlackBotMetadata,
+  isOpenGeniSlackBotConnection,
+  openGeniSlackBotMetadata,
+  requireAccessGrant,
+  requireEnvironmentEncryption,
+} from "@opengeni/core";
 import {
   createConnection,
   encryptEnvironmentValue,
   getConnectionMetadata,
   listConnectionsMetadata,
+  recordAuditEvent,
   revokeConnection,
   updateConnection,
 } from "@opengeni/db";
@@ -25,6 +33,11 @@ import {
   startMcpOAuth,
 } from "../integrations/oauth-client";
 import { canonicalProviderDomain } from "../integrations/provider-domain";
+import { verifyOpenGeniSlackBotCredential } from "../integrations/slack-bot";
+import {
+  OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
+  OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
+} from "@opengeni/contracts";
 
 export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, settings, observability } = deps;
@@ -49,6 +62,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
     const payload = CreateConnectionRequest.parse(await c.req.json());
+    assertNotReservedSlackBotMetadata(payload.metadata);
     const key = requireEnvironmentEncryption(settings);
     const subjectId = writableSubjectId(payload.subjectId, grant.subjectId);
     const connection = await createConnection(db, {
@@ -66,6 +80,102 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.json(ConnectionResponse.parse({ connection }), 201);
   });
 
+  app.post("/v1/workspaces/:workspaceId/connections/slack-bot", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    const payload = ConnectOpenGeniSlackBotRequest.parse(await c.req.json());
+    const verified = await verifyOpenGeniSlackBotCredential(
+      payload.token,
+      deps.slackFetch ?? fetch,
+    );
+    const key = requireEnvironmentEncryption(settings);
+    const credentialEncrypted = encryptCredentialBundle(
+      key,
+      slackBotCredentialBundle(payload.token),
+    );
+    const existing = payload.connectionId
+      ? await getConnectionMetadata(db, workspaceId, payload.connectionId, grant.subjectId)
+      : null;
+    if (payload.connectionId && !existing) {
+      throw new HTTPException(404, { message: "connection not found" });
+    }
+    if (existing && !isOpenGeniSlackBotConnection(existing)) {
+      throw new HTTPException(422, {
+        message: "connectionId is not an OpenGeni Slack bot connection",
+      });
+    }
+    const existingMetadata = existing ? openGeniSlackBotMetadata(existing.metadata) : null;
+    if (existingMetadata && existingMetadata.slackTeamId !== verified.metadata.slackTeamId) {
+      throw new HTTPException(409, {
+        message: "a Slack bot connection can only be reinstalled for its original Slack workspace",
+      });
+    }
+    if (
+      existingMetadata &&
+      (existingMetadata.botId !== verified.metadata.botId ||
+        existingMetadata.botUserId !== verified.metadata.botUserId)
+    ) {
+      throw new HTTPException(409, {
+        message:
+          "a different Slack bot requires a new connection and explicit scheduled-task rebinding",
+      });
+    }
+    const verifiedInstallAt = new Date(verified.metadata.verifiedAt);
+    const connection = existing
+      ? await updateConnection(db, {
+          workspaceId,
+          connectionId: existing.id,
+          visibleToSubjectId: grant.subjectId,
+          expectedVersion: existing.version,
+          subjectId: null,
+          providerDomain: "slack.com",
+          kind: "app_install",
+          status: "active",
+          credentialEncrypted,
+          grantedScopes: verified.grantedScopes,
+          expiresAt: null,
+          verifiedInstallAt,
+          verifiedInstallVersion: existing.version + 1,
+          metadata: verified.metadata,
+          updatedBySubjectId: grant.subjectId,
+        })
+      : await createConnection(db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: null,
+          providerDomain: "slack.com",
+          kind: "app_install",
+          credentialEncrypted,
+          grantedScopes: verified.grantedScopes,
+          expiresAt: null,
+          verifiedInstallAt,
+          verifiedInstallVersion: 1,
+          metadata: verified.metadata,
+          createdBySubjectId: grant.subjectId,
+        });
+    if (!connection) {
+      throw new HTTPException(409, {
+        message: "Slack bot connection changed during reinstall; retry with the current connection",
+      });
+    }
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: existing ? "slack_bot.reinstalled" : "slack_bot.connected",
+      targetType: "connection",
+      targetId: connection.id,
+      metadata: {
+        credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
+        credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
+        connectionId: connection.id,
+        slackTeamId: verified.metadata.slackTeamId,
+        outcome: "succeeded",
+      },
+    });
+    return c.json(ConnectionResponse.parse({ connection }), existing ? 200 : 201);
+  });
+
   app.get("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
@@ -85,6 +195,18 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
     const payload = UpdateConnectionRequest.parse(await c.req.json());
+    assertNotReservedSlackBotMetadata(payload.metadata);
+    const existing = await getConnectionMetadata(
+      db,
+      workspaceId,
+      c.req.param("connectionId"),
+      grant.subjectId,
+    );
+    if (existing && isOpenGeniSlackBotConnection(existing)) {
+      throw new HTTPException(422, {
+        message: "use the dedicated OpenGeni Slack bot reinstall flow to update this connection",
+      });
+    }
     // Status is not a free-form field: revocation goes through DELETE, and the
     // broker owns needs_reauth/error. Reactivating a connection is only
     // meaningful together with a fresh credential bundle — otherwise a PATCH
@@ -144,6 +266,24 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!connection) {
       throw new HTTPException(404, { message: "connection not found" });
     }
+    if (isOpenGeniSlackBotConnection(connection)) {
+      const metadata = openGeniSlackBotMetadata(connection.metadata)!;
+      await recordAuditEvent(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        action: "slack_bot.disconnected",
+        targetType: "connection",
+        targetId: connection.id,
+        metadata: {
+          credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
+          credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
+          connectionId: connection.id,
+          slackTeamId: metadata.slackTeamId,
+          outcome: "succeeded",
+        },
+      });
+    }
     return c.json(ConnectionResponse.parse({ connection }));
   });
 
@@ -200,6 +340,14 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 }
 
+function assertNotReservedSlackBotMetadata(metadata: Record<string, unknown> | undefined): void {
+  if (hasReservedOpenGeniSlackBotMetadata(metadata)) {
+    throw new HTTPException(422, {
+      message: "OpenGeni Slack bot metadata is reserved for the dedicated connection flow",
+    });
+  }
+}
+
 function writableSubjectId(
   requested: string | null | undefined,
   grantSubjectId: string,
@@ -216,3 +364,9 @@ function writableSubjectId(
 function encryptCredentialBundle(key: Uint8Array, credential: Record<string, unknown>): string {
   return encryptEnvironmentValue(key, JSON.stringify(credential));
 }
+
+function slackBotCredentialBundle(token: string): Record<string, unknown> {
+  const headerName = ["author", "ization"].join("");
+  const scheme = ["Bear", "er"].join("");
+  return { headers: { [headerName]: `${scheme} ${token}` } };
+}

package/src/routes/sessions.ts

@@ -191,6 +191,11 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     handle: ChannelAHandle,
     pty: SandboxOpenPtySessionRow,
   ): Promise<SandboxRetainedProcess> => {
+    if (!handle.lease) {
+      throw new HTTPException(409, {
+        message: "durable interactive terminals require a session-home provider lease",
+      });
+    }
     const process = await getRetainedProcess(db, {
       workspaceId: ctx.workspaceId,
       sessionId: ctx.session.id,
@@ -2183,6 +2188,11 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     }
     const ptyId = crypto.randomUUID();
     const out = await withChannelA({ db, settings, bus }, ctx, async (handle) => {
+      if (!handle.lease) {
+        throw new HTTPException(409, {
+          message: "durable interactive terminals require a session-home provider lease",
+        });
+      }
       const { service } = handle;
       const opened = await service.ptyOpen(req, ptyId);
       const execSessionId = opened.execSessionId;

package/src/routes/workspace-instruction-policies.ts

@@ -0,0 +1,243 @@
+import {
+  ActivateWorkspaceInstructionPolicyRequest,
+  CreateWorkspaceInstructionPolicyDraftRequest,
+  ImportLegacyWorkspaceInstructionPolicyDraftRequest,
+  RollbackWorkspaceInstructionPolicyRequest,
+  WorkspaceInstructionPolicyActivationResponse,
+  WorkspaceInstructionPolicyConflictResponse,
+  WorkspaceInstructionPolicyDiffRequest,
+  WorkspaceInstructionPolicyDiffResponse,
+  WorkspaceInstructionPolicyListQuery,
+  WorkspaceInstructionPolicyListResponse,
+  WorkspaceInstructionPolicyRevision,
+} from "@opengeni/contracts";
+import { requireAccessGrant, type ApiRouteDeps } from "@opengeni/core";
+import {
+  activateWorkspaceInstructionPolicyRevision,
+  createWorkspaceInstructionPolicyDraft,
+  diffWorkspaceInstructionPolicyRevisions,
+  getWorkspaceInstructionPolicyRevision,
+  importLegacyWorkspaceInstructionPolicyDraft,
+  listWorkspaceInstructionPolicyRevisions,
+  rollbackWorkspaceInstructionPolicyRevision,
+  WorkspaceInstructionPolicyConflictError,
+  WorkspaceInstructionPolicyInvalidOperationError,
+  WorkspaceInstructionPolicyLegacyUnavailableError,
+  WorkspaceInstructionPolicyNotFoundError,
+} from "@opengeni/db";
+import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+
+const WorkspaceInstructionPolicyRevisionId = z.string().uuid();
+
+async function parseBody<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
+  const parsed = schema.safeParse(await context.req.json().catch(() => null));
+  if (!parsed.success) {
+    throw new HTTPException(422, { message: "Invalid workspace instruction-policy request" });
+  }
+  return parsed.data;
+}
+
+function policyErrorResponse(context: Context, error: unknown): Response {
+  if (error instanceof WorkspaceInstructionPolicyConflictError) {
+    return context.json(
+      WorkspaceInstructionPolicyConflictResponse.parse({
+        code: error.code,
+        message: error.message,
+        currentHead: error.currentHead,
+      }),
+      409,
+    );
+  }
+  if (error instanceof WorkspaceInstructionPolicyNotFoundError) {
+    return context.json(
+      { code: "WORKSPACE_INSTRUCTION_POLICY_NOT_FOUND", message: error.message },
+      404,
+    );
+  }
+  if (error instanceof WorkspaceInstructionPolicyLegacyUnavailableError) {
+    return context.json(
+      { code: "WORKSPACE_INSTRUCTION_POLICY_LEGACY_UNAVAILABLE", message: error.message },
+      409,
+    );
+  }
+  if (error instanceof WorkspaceInstructionPolicyInvalidOperationError) {
+    return context.json(
+      { code: "INVALID_WORKSPACE_INSTRUCTION_POLICY_OPERATION", message: error.message },
+      422,
+    );
+  }
+  throw error;
+}
+
+function assertBoundedActor(subjectId: string): void {
+  if (subjectId.trim().length < 1 || subjectId.length > 1_024) {
+    throw new HTTPException(400, { message: "Workspace instruction-policy actor is invalid" });
+  }
+}
+
+function parseRevisionId(context: Context): string {
+  const parsed = WorkspaceInstructionPolicyRevisionId.safeParse(context.req.param("revisionId"));
+  if (!parsed.success) {
+    throw new HTTPException(422, { message: "Invalid workspace instruction-policy revision id" });
+  }
+  return parsed.data;
+}
+
+export function registerWorkspaceInstructionPolicyRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const base = "/v1/workspaces/:workspaceId/instruction-policies";
+
+  app.get(base, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant(context, deps, workspaceId, "workspace:read");
+    const parsed = WorkspaceInstructionPolicyListQuery.safeParse({
+      kind: context.req.query("kind"),
+      scope: context.req.query("scope"),
+      roleKey: context.req.query("roleKey"),
+      afterRevision: context.req.query("afterRevision"),
+      limit: context.req.query("limit"),
+    });
+    if (!parsed.success) {
+      throw new HTTPException(422, { message: "Invalid workspace instruction-policy query" });
+    }
+    return context.json(
+      WorkspaceInstructionPolicyListResponse.parse(
+        await listWorkspaceInstructionPolicyRevisions(deps.db, workspaceId, parsed.data),
+      ),
+    );
+  });
+
+  app.post(`${base}/drafts`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:admin");
+    assertBoundedActor(grant.subjectId);
+    const request = await parseBody(context, CreateWorkspaceInstructionPolicyDraftRequest);
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyRevision.parse(
+          await createWorkspaceInstructionPolicyDraft(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            createdBySubjectId: grant.subjectId,
+            kind: request.kind,
+            scope: request.scope,
+            roleKey: request.roleKey,
+            content: request.content,
+            provenanceSource: request.provenanceSource,
+            provenanceSourceId: request.provenanceSourceId,
+            supersedesRevisionId: request.supersedesRevisionId,
+          }),
+        ),
+        201,
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
+
+  app.post(`${base}/import-legacy`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:admin");
+    assertBoundedActor(grant.subjectId);
+    const request = await parseBody(context, ImportLegacyWorkspaceInstructionPolicyDraftRequest);
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyRevision.parse(
+          await importLegacyWorkspaceInstructionPolicyDraft(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            createdBySubjectId: grant.subjectId,
+            supersedesRevisionId: request.supersedesRevisionId,
+          }),
+        ),
+        201,
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
+
+  app.get(`${base}/diff`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant(context, deps, workspaceId, "workspace:read");
+    const parsed = WorkspaceInstructionPolicyDiffRequest.safeParse({
+      fromRevisionId: context.req.query("fromRevisionId"),
+      toRevisionId: context.req.query("toRevisionId"),
+    });
+    if (!parsed.success) {
+      throw new HTTPException(422, { message: "Invalid workspace instruction-policy diff query" });
+    }
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyDiffResponse.parse(
+          await diffWorkspaceInstructionPolicyRevisions(deps.db, workspaceId, parsed.data),
+        ),
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
+
+  app.post(`${base}/rollback`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:admin");
+    assertBoundedActor(grant.subjectId);
+    const request = await parseBody(context, RollbackWorkspaceInstructionPolicyRequest);
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyActivationResponse.parse(
+          await rollbackWorkspaceInstructionPolicyRevision(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            targetRevisionId: request.targetRevisionId,
+            expectedCurrentRevisionId: request.expectedCurrentRevisionId,
+            actorSubjectId: grant.subjectId,
+            reason: request.reason,
+          }),
+        ),
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
+
+  app.get(`${base}/:revisionId`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant(context, deps, workspaceId, "workspace:read");
+    const revisionId = parseRevisionId(context);
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyRevision.parse(
+          await getWorkspaceInstructionPolicyRevision(deps.db, workspaceId, revisionId),
+        ),
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
+
+  app.post(`${base}/:revisionId/activate`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:admin");
+    assertBoundedActor(grant.subjectId);
+    const revisionId = parseRevisionId(context);
+    const request = await parseBody(context, ActivateWorkspaceInstructionPolicyRequest);
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyActivationResponse.parse(
+          await activateWorkspaceInstructionPolicyRevision(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            revisionId,
+            expectedCurrentRevisionId: request.expectedCurrentRevisionId,
+            actorSubjectId: grant.subjectId,
+            reason: request.reason,
+          }),
+        ),
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
+}