@opengeni/api-router 0.12.7 → 0.14.3

package/src/routes/connections.ts

@@ -10,6 +10,12 @@ import {
   OAuthStartResponse,
   UpdateConnectionRequest,
 } from "@opengeni/contracts";
+import {
+  GOOGLE_DRIVE_PROVIDER_DOMAIN,
+  GoogleDriveConnectionMetadata,
+  GoogleDriveOAuthStartRequest,
+  GoogleDriveOAuthStartResponse,
+} from "@opengeni/contracts/google-drive";
 import {
   hasPermission,
   hasReservedOpenGeniSlackBotMetadata,
@@ -38,6 +44,12 @@ import {
 import type { ApiRouteDeps } from "@opengeni/core";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
+import {
+  browseGoogleDrive,
+  completeGoogleDriveOAuthCallback,
+  saveGoogleDriveSource,
+  startGoogleDriveOAuth,
+} from "../integrations/google-drive";
 import {
   completeMcpOAuthCallback,
   integrationBaseUrl,
@@ -96,6 +108,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     const subjectId = writableSubjectId(payload.subjectId, grant.subjectId);
     const providerDomain = canonicalProviderDomain(payload.providerDomain);
     assertNotDirectPersonalSlackOAuth(providerDomain, payload.kind);
+    assertNotDirectGoogleDriveOAuth(providerDomain, payload.kind, payload.metadata);
     const connection = await createConnection(db, {
       accountId: grant.accountId,
       workspaceId,
@@ -243,6 +256,72 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
   });
 
+  app.post("/v1/workspaces/:workspaceId/connections/google-drive/install", async (c) => {
+    assertIntegrationsEnabled();
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    const parsed = GoogleDriveOAuthStartRequest.safeParse(await c.req.json());
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: "invalid Google Drive install request" });
+    }
+    return c.json(
+      GoogleDriveOAuthStartResponse.parse(
+        await startGoogleDriveOAuth(deps, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          requestUrl: c.req.url,
+          payload: parsed.data,
+        }),
+      ),
+    );
+  });
+
+  app.get("/v1/integrations/google-drive/callback", async (c) => {
+    assertIntegrationsEnabled();
+    const result = await completeGoogleDriveOAuthCallback(deps, {
+      ...(c.req.query("code") ? { code: c.req.query("code") } : {}),
+      ...(c.req.query("state") ? { state: c.req.query("state") } : {}),
+      ...(c.req.query("error") ? { error: c.req.query("error") } : {}),
+      requestUrl: c.req.url,
+    });
+    return c.redirect(result.redirectTo, 302);
+  });
+
+  app.get(
+    "/v1/workspaces/:workspaceId/connections/google-drive/:connectionId/browse",
+    async (c) => {
+      assertIntegrationsEnabled();
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
+      return c.json(
+        await browseGoogleDrive(deps, {
+          workspaceId,
+          subjectId: grant.subjectId,
+          connectionId: c.req.param("connectionId"),
+          parentId: c.req.query("parentId") ?? "root",
+          ...(c.req.query("pageToken") ? { pageToken: c.req.query("pageToken") } : {}),
+        }),
+      );
+    },
+  );
+
+  app.post(
+    "/v1/workspaces/:workspaceId/connections/google-drive/:connectionId/source",
+    async (c) => {
+      assertIntegrationsEnabled();
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+      const connection = await saveGoogleDriveSource(deps, {
+        workspaceId,
+        subjectId: grant.subjectId,
+        connectionId: c.req.param("connectionId"),
+        payload: await c.req.json(),
+      });
+      return c.json(ConnectionResponse.parse({ connection }));
+    },
+  );
+
   app.get("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
@@ -274,11 +353,18 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "use the dedicated OpenGeni Slack bot reinstall flow to update this connection",
       });
     }
+    if (existing && GoogleDriveConnectionMetadata.safeParse(existing.metadata).success) {
+      throw new HTTPException(422, {
+        message: "use the dedicated Google Drive reconnect or source-selection flow",
+      });
+    }
     if (existing) {
-      assertNotDirectPersonalSlackOAuth(
-        canonicalProviderDomain(payload.providerDomain ?? existing.providerDomain),
-        payload.kind ?? existing.kind,
+      const providerDomain = canonicalProviderDomain(
+        payload.providerDomain ?? existing.providerDomain,
       );
+      const kind = payload.kind ?? existing.kind;
+      assertNotDirectPersonalSlackOAuth(providerDomain, kind);
+      assertNotDirectGoogleDriveOAuth(providerDomain, kind, payload.metadata ?? existing.metadata);
     }
     // Status is not a free-form field: revocation goes through DELETE, and the
     // broker owns needs_reauth/error. Reactivating a connection is only
@@ -415,7 +501,7 @@ async function persistOpenGeniSlackBotConnection(input: {
   const { db, settings } = input.deps;
   const key = requireEnvironmentEncryption(settings);
   const credentialEncrypted = encryptCredentialBundle(key, slackBotCredentialBundle(input.token));
-  const existing = input.state.connectionId
+  const requestedExisting = input.state.connectionId
     ? await getConnectionMetadata(
         db,
         input.state.workspaceId,
@@ -423,7 +509,7 @@ async function persistOpenGeniSlackBotConnection(input: {
         input.state.subjectId,
       )
     : null;
-  if (input.state.connectionId && !existing) {
+  if (input.state.connectionId && !requestedExisting) {
     throw new SlackInstallCallbackError(
       404,
       "connection_conflict",
@@ -431,7 +517,7 @@ async function persistOpenGeniSlackBotConnection(input: {
       "principal_validation",
     );
   }
-  if (existing && !isOpenGeniSlackBotConnection(existing)) {
+  if (requestedExisting && !isOpenGeniSlackBotConnection(requestedExisting)) {
     throw new SlackInstallCallbackError(
       422,
       "connection_conflict",
@@ -439,7 +525,7 @@ async function persistOpenGeniSlackBotConnection(input: {
       "principal_validation",
     );
   }
-  if (existing?.version !== input.state.connectionVersion) {
+  if (requestedExisting && requestedExisting.version !== input.state.connectionVersion) {
     throw new SlackInstallCallbackError(
       409,
       "connection_conflict",
@@ -447,6 +533,13 @@ async function persistOpenGeniSlackBotConnection(input: {
       "principal_validation",
     );
   }
+  const existing =
+    requestedExisting ??
+    (await findMatchingOpenGeniSlackBotConnection(
+      db,
+      input.state.workspaceId,
+      input.verified.metadata,
+    ));
   const existingMetadata = existing ? openGeniSlackBotMetadata(existing.metadata) : null;
   if (existingMetadata && existingMetadata.slackTeamId !== input.verified.metadata.slackTeamId) {
     throw new SlackInstallCallbackError(
@@ -526,6 +619,28 @@ async function persistOpenGeniSlackBotConnection(input: {
   return connection;
 }
 
+async function findMatchingOpenGeniSlackBotConnection(
+  db: ApiRouteDeps["db"],
+  workspaceId: string,
+  verified: Awaited<ReturnType<typeof verifyOpenGeniSlackBotCredential>>["metadata"],
+) {
+  const connections = await listConnectionsMetadata(db, workspaceId, null);
+  return (
+    connections.find((connection) => {
+      const metadata = openGeniSlackBotMetadata(connection.metadata);
+      return (
+        connection.subjectId === null &&
+        connection.providerDomain === "slack.com" &&
+        connection.kind === "app_install" &&
+        metadata?.credentialRole === OPENGENI_SLACK_BOT_CREDENTIAL_ROLE &&
+        metadata.slackTeamId === verified.slackTeamId &&
+        metadata.botId === verified.botId &&
+        metadata.botUserId === verified.botUserId
+      );
+    }) ?? null
+  );
+}
+
 function requireOpenGeniSlackOAuthSettings(settings: ApiRouteDeps["settings"]): {
   clientId: string;
   clientSecret: string;
@@ -685,6 +800,21 @@ function assertNotDirectPersonalSlackOAuth(providerDomain: string, kind: string)
   }
 }
 
+function assertNotDirectGoogleDriveOAuth(
+  providerDomain: string,
+  kind: string,
+  metadata: Record<string, unknown> | undefined,
+): void {
+  if (
+    (providerDomain === GOOGLE_DRIVE_PROVIDER_DOMAIN && kind === "oauth2") ||
+    GoogleDriveConnectionMetadata.safeParse(metadata).success
+  ) {
+    throw new HTTPException(422, {
+      message: "Google Drive credentials must use the dedicated OAuth connection flow",
+    });
+  }
+}
+
 function assertNotReservedSlackBotMetadata(metadata: Record<string, unknown> | undefined): void {
   if (hasReservedOpenGeniSlackBotMetadata(metadata)) {
     throw new HTTPException(422, {

package/src/routes/documents.ts

@@ -37,7 +37,7 @@ import {
   searchDocuments,
 } from "@opengeni/documents";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import type { Hono } from "hono";
+import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { requireAccessGrant } from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
@@ -252,7 +252,7 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/knowledge/search", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "documents:search");
-    const payload = DocumentSearchRequest.parse(await c.req.json());
+    const payload = await parseDocumentSearchRequest(c, "invalid knowledge search request");
     return c.json({
       results: await searchDocuments(
         db,
@@ -567,6 +567,17 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 }
 
+async function parseDocumentSearchRequest(
+  context: Context,
+  message: string,
+): Promise<DocumentSearchRequest> {
+  const parsed = DocumentSearchRequest.safeParse(await context.req.json().catch(() => null));
+  if (!parsed.success) {
+    throw new HTTPException(422, { message });
+  }
+  return parsed.data;
+}
+
 /** Derive a .txt filename for a raw-text drop from its optional title/filename. */
 function dropFilename(preferred: string | undefined): string {
   const stem = (preferred ?? "").trim() || `note-${new Date().toISOString().slice(0, 10)}`;