@opengeni/api-router 0.14.4 → 0.15.4

package/src/mcp/server.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import {
   CreateScheduledTaskRequest,
   DEFAULT_FIRST_PARTY_MCP_TOOLS,
@@ -24,6 +25,8 @@ import {
   type SessionAuthorizationSurface,
   type Session,
   UpdateScheduledTaskRequest,
+  normalizeWorkspaceArtifactSlug,
+  WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES,
 } from "@opengeni/contracts";
 import {
   correctWorkspaceMemory,
@@ -54,6 +57,8 @@ import {
   listRigVersionMonitoringSummaries,
   listSocialConnections,
   listSocialPosts,
+  recordAuditEvent,
+  recordSyncedSocialPosts,
   listVariableSets,
   MEMORY_CORRECT_TOOL_DESCRIPTION,
   MEMORY_SAVE_TOOL_DESCRIPTION,
@@ -70,6 +75,12 @@ import {
   upsertSessionGoalWithEvent,
   RigChangeAlreadyVerifyingError,
   RigChangeTransitionError,
+  createWorkspaceArtifact,
+  getWorkspaceArtifact,
+  getWorkspaceArtifactContentRef,
+  listWorkspaceArtifacts,
+  publishWorkspaceArtifactVersion,
+  rollbackWorkspaceArtifact,
 } from "@opengeni/db";
 import { appendAndPublishEvents, publishDurableSessionEvents } from "@opengeni/events";
 import {
@@ -100,6 +111,13 @@ import {
   listWorkspaceGitHubRepositories,
 } from "../github-access";
 import { githubBrowserBaseUrl, githubBrowserGrantClaims } from "../github-browser-flow";
+import {
+  socialMentionsLive,
+  socialOwnPostsLive,
+  socialPostReply,
+  socialSearchLive,
+  socialThreadLive,
+} from "../integrations/social-api";
 import {
   promoteVerifiedDefinitionEditChangeForApi,
   proposeRigChangeForApi,
@@ -219,6 +237,15 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   social_connections_list: { allOf: ["connections:read"] },
   social_posts_recent: { allOf: ["connections:read"] },
   social_daily_analysis_context: { allOf: ["connections:read"] },
+  social_search_live: { allOf: ["connections:read"] },
+  social_mentions_live: { allOf: ["connections:read"] },
+  social_thread_fetch: { allOf: ["connections:read"] },
+  // Writes the social_posts store, so it takes the write scope like the REST
+  // equivalent (POST /social/posts is workspace:admin).
+  social_posts_sync: { allOf: ["connections:write"] },
+  // Publishes under the user's identity: connections:write keeps it out of the
+  // default agent permission set, unlike the read-only social tools above.
+  social_post_reply: { allOf: ["connections:write"] },
   scheduled_tasks_list: { anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"] },
   scheduled_tasks_get: { anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"] },
   scheduled_tasks_create: { allOf: ["scheduled_tasks:manage"] },
@@ -237,6 +264,11 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   slack_bot_file_content: { allOf: ["connections:read"] },
   slack_bot_post_message: { allOf: ["connections:read"] },
   slack_bot_delete_message: { allOf: ["connections:read"] },
+  artifacts_list: { sessionRequired: true, allOf: ["artifacts:read"] },
+  artifacts_get_source: { sessionRequired: true, allOf: ["artifacts:read"] },
+  artifacts_create: { sessionRequired: true, allOf: ["artifacts:publish"] },
+  artifacts_publish: { sessionRequired: true, allOf: ["artifacts:publish"] },
+  artifacts_rollback: { sessionRequired: true, allOf: ["artifacts:publish"] },
 } satisfies Record<FirstPartyMcpToolName, FirstPartyToolAuthorization>;
 
 const FIRST_PARTY_MCP_TOOL_NAME_SET = new Set<string>(FIRST_PARTY_MCP_TOOL_NAMES);
@@ -378,6 +410,9 @@ export function buildOpenGeniMcpServer(
   if (!toolspaceMode && sessionId !== null && preferenceAttemptClaims(grant) !== null) {
     registerPreferenceRegistryTools(server, deps, grant, json);
   }
+  if (!toolspaceMode && sessionId !== null && preferenceAttemptClaims(grant) !== null) {
+    registerWorkspaceArtifactTools(server, deps, grant, sessionId, json);
+  }
 
   // Fleet tools (M7 bring-your-own-compute): list / attach / swap / run_on /
   // provision over the session's Modal box + the workspace's enrolled machines.
@@ -545,6 +580,162 @@ export function buildOpenGeniMcpServer(
         });
       },
     );
+
+    // Live provider reads (X / Reddit). Tokens are resolved and used entirely
+    // host-side; the agent only ever sees normalized post payloads.
+    server.registerTool(
+      "social_search_live",
+      {
+        description:
+          "Search live conversations on a connected social account (X recent search or Reddit search). Use social_connections_list first to find the connectionId. For Reddit, pass subreddit to scope the search.",
+        inputSchema: {
+          connectionId: z4.string().uuid(),
+          query: z4.string().min(1).max(512),
+          subreddit: z4.string().min(1).max(100).optional(),
+          limit: z4.number().int().positive().optional(),
+        },
+      },
+      async ({ connectionId, query, subreddit, limit }) => {
+        const result = await socialSearchLive(
+          deps,
+          { workspaceId: grant.workspaceId, connectionId },
+          { query, subreddit, limit },
+        );
+        return json({ provider: result.connection.provider, posts: result.posts });
+      },
+    );
+
+    server.registerTool(
+      "social_mentions_live",
+      {
+        description:
+          "Fetch live mentions of the connected account (X mentions timeline, or the Reddit inbox with username mentions and comment replies).",
+        inputSchema: {
+          connectionId: z4.string().uuid(),
+          sinceId: z4.string().optional(),
+          limit: z4.number().int().positive().optional(),
+        },
+      },
+      async ({ connectionId, sinceId, limit }) => {
+        const result = await socialMentionsLive(
+          deps,
+          { workspaceId: grant.workspaceId, connectionId },
+          { sinceId, limit },
+        );
+        return json({ provider: result.connection.provider, posts: result.posts });
+      },
+    );
+
+    server.registerTool(
+      "social_thread_fetch",
+      {
+        description:
+          "Fetch a live conversation thread: for X pass a tweet id (returns the conversation), for Reddit pass a post id or t3_ fullname (returns the post plus top comments).",
+        inputSchema: {
+          connectionId: z4.string().uuid(),
+          id: z4.string().min(1).max(100),
+          limit: z4.number().int().positive().optional(),
+        },
+      },
+      async ({ connectionId, id, limit }) => {
+        const result = await socialThreadLive(
+          deps,
+          { workspaceId: grant.workspaceId, connectionId },
+          { id, limit },
+        );
+        return json({ provider: result.connection.provider, posts: result.posts });
+      },
+    );
+  }
+
+  // Writes are gated on connections:write (never in the default first-party
+  // agent permission set) so scheduled tasks must opt in, and deployments can
+  // additionally wrap posting in a requireApproval policy.
+  if (!toolspaceMode || can("connections:write")) {
+    server.registerTool(
+      "social_posts_sync",
+      {
+        description:
+          "Sync the connected account's own recent posts from the provider into OpenGeni's social_posts store (idempotent), so social_posts_recent and daily analysis see fresh data.",
+        inputSchema: {
+          connectionId: z4.string().uuid(),
+          limit: z4.number().int().positive().optional(),
+        },
+      },
+      async ({ connectionId, limit }) => {
+        const result = await socialOwnPostsLive(
+          deps,
+          { workspaceId: grant.workspaceId, connectionId },
+          { limit },
+        );
+        // A post without a provider timestamp is skipped rather than recorded
+        // at sync time: publishedAt drives analysis windows, and the dedup
+        // index would freeze a fabricated date forever.
+        const datedPosts = result.posts.filter((post) => post.createdAt !== null);
+        const synced = await recordSyncedSocialPosts(deps.db, {
+          accountId: grant.accountId,
+          workspaceId: grant.workspaceId,
+          connectionId,
+          posts: datedPosts.map((post) => ({
+            externalPostId: post.id,
+            url: post.url,
+            authorHandle: post.author,
+            text: post.text,
+            publishedAt: new Date(post.createdAt!),
+            metrics: post.metrics,
+          })),
+        });
+        return json({
+          provider: result.connection.provider,
+          fetched: result.posts.length,
+          inserted: synced.inserted,
+          skipped: synced.skipped,
+          skippedMissingDate: result.posts.length - datedPosts.length,
+        });
+      },
+    );
+
+    server.registerTool(
+      "social_post_reply",
+      {
+        description:
+          "Publish a reply from the connected social account. X: inReplyToId is the tweet id to reply to. Reddit: inReplyToId is a fullname (t3_<post> or t1_<comment>). Draft and get approval before calling this — it posts publicly and immediately.",
+        inputSchema: {
+          connectionId: z4.string().uuid(),
+          inReplyToId: z4.string().min(1).max(100),
+          text: z4.string().min(1).max(10000),
+        },
+      },
+      async ({ connectionId, inReplyToId, text }) => {
+        const result = await socialPostReply(
+          deps,
+          { workspaceId: grant.workspaceId, connectionId },
+          { inReplyToId, text },
+        );
+        // Outbound publishes leave a durable, secret-free receipt (house
+        // pattern: the Slack bot post audit), so who posted what where stays
+        // answerable after the session is gone.
+        await recordAuditEvent(deps.db, {
+          accountId: grant.accountId,
+          workspaceId: grant.workspaceId,
+          subjectId: grant.subjectId,
+          action: "social.post_reply",
+          targetType: "social_connection",
+          targetId: connectionId,
+          metadata: {
+            provider: result.connection.provider,
+            inReplyToId,
+            postedId: result.postedId,
+            url: result.url,
+          },
+        });
+        return json({
+          provider: result.connection.provider,
+          postedId: result.postedId,
+          url: result.url,
+        });
+      },
+    );
   }
 
   if (!toolspaceMode || can("scheduled_tasks:manage") || can("scheduled_tasks:run")) {
@@ -1282,6 +1473,198 @@ async function authorizeFirstPartySession(
   });
 }
 
+function registerWorkspaceArtifactTools(
+  server: McpServer,
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  sessionId: string,
+  json: JsonResult,
+): void {
+  const attempt = () => {
+    const claims = preferenceAttemptClaims(grant);
+    if (!claims) throw new Error("Exact signed artifact attempt authority is required.");
+    return claims;
+  };
+  const authorize = async () => {
+    await authorizeFirstPartySession(deps, grant, sessionId, "session.first_party_mcp.call");
+  };
+  const prepare = (html: string) => {
+    if (!deps.objectStorage) throw new Error("Object storage is not configured");
+    const bytes = new TextEncoder().encode(html);
+    if (bytes.byteLength < 1 || bytes.byteLength > WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES) {
+      throw new Error(
+        `Artifact HTML must be 1-${WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES} UTF-8 bytes`,
+      );
+    }
+    const contentSha256 = createHash("sha256").update(bytes).digest("hex");
+    const contentKey = `workspaces/${grant.workspaceId}/workspace-artifacts/blobs/${contentSha256}.html`;
+    return {
+      contentKey,
+      contentSha256,
+      sizeBytes: bytes.byteLength,
+      persistContent: async () => {
+        await deps.objectStorage!.putObject({
+          key: contentKey,
+          contentType: "text/html; charset=utf-8",
+          body: bytes,
+          sha256: contentSha256,
+        });
+      },
+    };
+  };
+  const provenance = (
+    idempotencyKey: string,
+    sourceToolName: "artifacts_create" | "artifacts_publish" | "artifacts_rollback",
+  ) => {
+    const claims = attempt();
+    return {
+      accountId: grant.accountId,
+      workspaceId: grant.workspaceId,
+      operationKey: `attempt:${createHash("sha256")
+        .update(
+          `${claims.sessionId}:${claims.turnId}:${claims.attemptId}:${claims.executionGeneration}:${idempotencyKey}`,
+        )
+        .digest("hex")}`,
+      actorSubjectId: grant.subjectId,
+      sourceSessionId: claims.sessionId,
+      sourceTurnId: claims.turnId,
+      sourceAttemptId: claims.attemptId,
+      sourceExecutionGeneration: claims.executionGeneration,
+      sourceToolName,
+    };
+  };
+
+  server.registerTool(
+    "artifacts_list",
+    {
+      description:
+        "List the generic published artifacts in this workspace and their current versions.",
+      inputSchema: {},
+    },
+    async () => {
+      await authorize();
+      return json(await listWorkspaceArtifacts(deps.db, grant.workspaceId));
+    },
+  );
+
+  server.registerTool(
+    "artifacts_get_source",
+    {
+      description:
+        "Read an artifact's metadata and exact HTML source. Omit versionId for the current version.",
+      inputSchema: {
+        artifactId: z4.string().uuid(),
+        versionId: z4.string().uuid().optional(),
+      },
+    },
+    async ({ artifactId, versionId }) => {
+      await authorize();
+      if (!deps.objectStorage) throw new Error("Object storage is not configured");
+      const [detail, ref] = await Promise.all([
+        getWorkspaceArtifact(deps.db, grant.workspaceId, artifactId),
+        getWorkspaceArtifactContentRef(deps.db, grant.workspaceId, artifactId, versionId),
+      ]);
+      const object = await deps.objectStorage.getObjectBytes(ref.contentKey);
+      if (!object) throw new Error("Artifact content is unavailable");
+      const actualHash = createHash("sha256").update(object.bytes).digest("hex");
+      if (actualHash !== ref.version.contentSha256)
+        throw new Error("Artifact content failed integrity verification");
+      return json({ detail, version: ref.version, html: new TextDecoder().decode(object.bytes) });
+    },
+  );
+
+  server.registerTool(
+    "artifacts_create",
+    {
+      description:
+        "Create and publish a generic static workspace artifact from a complete, self-contained HTML document with inline CSS. JavaScript and active or navigation-capable markup do not render in the MVP.",
+      inputSchema: {
+        title: z4.string().min(1).max(120),
+        description: z4.string().max(2000).nullable().optional(),
+        slug: z4
+          .string()
+          .regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)
+          .max(96)
+          .optional(),
+        html: z4.string().min(1).max(WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES),
+        idempotencyKey: z4.string().min(1).max(200),
+      },
+    },
+    async ({ title, description, slug, html, idempotencyKey }) => {
+      await authorize();
+      const artifactId = crypto.randomUUID();
+      const slugBase = slug ?? (normalizeWorkspaceArtifactSlug(title) || "artifact");
+      const resolvedSlug = slug ?? `${slugBase.slice(0, 87)}-${artifactId.slice(0, 8)}`;
+      return json(
+        await createWorkspaceArtifact(deps.db, {
+          artifactId,
+          slug: resolvedSlug,
+          title,
+          description: description ?? null,
+          ...prepare(html),
+          ...provenance(idempotencyKey, "artifacts_create"),
+        }),
+      );
+    },
+  );
+
+  server.registerTool(
+    "artifacts_publish",
+    {
+      description:
+        "Publish a new immutable static HTML/CSS version. JavaScript and active or navigation-capable markup do not render in the MVP. First read the current source and pass its version id for optimistic concurrency.",
+      inputSchema: {
+        artifactId: z4.string().uuid(),
+        expectedCurrentVersionId: z4.string().uuid(),
+        title: z4.string().min(1).max(120).optional(),
+        description: z4.string().max(2000).nullable().optional(),
+        html: z4.string().min(1).max(WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES),
+        idempotencyKey: z4.string().min(1).max(200),
+      },
+    },
+    async ({ artifactId, expectedCurrentVersionId, title, description, html, idempotencyKey }) => {
+      await authorize();
+      return json(
+        await publishWorkspaceArtifactVersion(deps.db, {
+          artifactId,
+          expectedCurrentVersionId,
+          ...(title !== undefined ? { title } : {}),
+          ...(description !== undefined ? { description } : {}),
+          ...prepare(html),
+          ...provenance(idempotencyKey, "artifacts_publish"),
+        }),
+      );
+    },
+  );
+
+  server.registerTool(
+    "artifacts_rollback",
+    {
+      description:
+        "Promote an existing immutable artifact version back to current without rewriting history.",
+      inputSchema: {
+        artifactId: z4.string().uuid(),
+        versionId: z4.string().uuid(),
+        expectedCurrentVersionId: z4.string().uuid(),
+        reason: z4.string().min(1).max(4096),
+        idempotencyKey: z4.string().min(1).max(200),
+      },
+    },
+    async ({ artifactId, versionId, expectedCurrentVersionId, reason, idempotencyKey }) => {
+      await authorize();
+      return json(
+        await rollbackWorkspaceArtifact(deps.db, {
+          artifactId,
+          versionId,
+          expectedCurrentVersionId,
+          reason,
+          ...provenance(idempotencyKey, "artifacts_rollback"),
+        }),
+      );
+    },
+  );
+}
+
 function preferenceAttemptClaims(grant: AccessGrant): {
   sessionId: string;
   turnId: string;

package/src/routes/sessions.ts

@@ -296,16 +296,14 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     ),
   });
 
-  // A host-bound deployment has one fail-closed authorization seam for every
-  // HTTP session surface. Register it before the routes so a newly added path
-  // cannot accidentally inherit workspace access without an explicit operation
-  // classification. The long-lived event stream performs its own initial check
-  // and bounded reauthorization below.
+  // Every deployment has one fail-closed authorization seam for every HTTP
+  // session surface. The core boundary always enforces durable OpenGeni-owned
+  // private-session rules; an embedding host port can add narrower policy.
+  // Register it before the routes so a newly added path cannot accidentally
+  // inherit workspace access without an explicit operation classification. The
+  // long-lived event stream performs its own initial check and bounded
+  // reauthorization below.
   const authorizeSessionHttp: MiddlewareHandler = async (c, next) => {
-    if (!deps.sessionAuthorization) {
-      await next();
-      return;
-    }
     const workspaceId = c.req.param("workspaceId") ?? "";
     const sessionId = c.req.param("sessionId") ?? "";
     const operation = sessionAuthorizationOperationForHttp(
@@ -320,6 +318,10 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     if (!operation) {
       throw sessionAuthorizationHttpError(new SessionAuthorizationUnavailableError());
     }
+    if (operation === "session.codex_account.write" && !deps.sessionAuthorization) {
+      await next();
+      return;
+    }
     const grant = await requireAccessGrant(c, deps, workspaceId);
     try {
       const authorization = await requireSessionAuthorization(deps, grant, {
@@ -587,7 +589,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
   // account id isn't in the workspace.
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/codex-account", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "sessions:control");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
     const body = (await c.req.json()) as { target?: string };
     const target = typeof body.target === "string" ? body.target : "";
@@ -596,6 +598,17 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
         message: 'target is required ("auto" or an account id)',
       });
     }
+    if (!deps.sessionAuthorization) {
+      try {
+        await requireSessionAuthorization(deps, grant, {
+          sessionId,
+          operation: "session.codex_account.write",
+          surface: "http",
+        });
+      } catch (error) {
+        throw sessionAuthorizationHttpError(error);
+      }
+    }
     const pinned = target === "auto" ? null : target;
     const mutation = await withCodexCapacityMutation(
       db,

package/src/routes/social.ts

@@ -1,9 +1,15 @@
-import { CreateSocialConnectionRequest, CreateSocialPostRequest } from "@opengeni/contracts";
+import {
+  CreateSocialConnectionRequest,
+  CreateSocialPostRequest,
+  OAuthStartResponse,
+  SocialOAuthStartRequest,
+} from "@opengeni/contracts";
 import {
   createSocialConnection,
   createSocialPost,
   listSocialConnections,
   listSocialPosts,
+  updateSocialConnectionCredential,
 } from "@opengeni/db";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
@@ -11,9 +17,10 @@ import { z } from "zod";
 import { requireAccessGrant } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import { boundedLimit } from "../http/common";
+import { completeSocialOAuthCallback, startSocialOAuth } from "../integrations/social-oauth";
 
 export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
-  const { db } = deps;
+  const { db, settings, observability } = deps;
 
   app.get("/v1/workspaces/:workspaceId/social/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -47,6 +54,64 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
   });
 
+  // Disconnect: drop the stored OAuth credential and disable the connection.
+  // The row stays (posts reference it and the audit trail needs the identity);
+  // reconnecting via the OAuth flow revives it.
+  app.delete("/v1/workspaces/:workspaceId/social/connections/:connectionId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const connection = await updateSocialConnectionCredential(db, {
+      workspaceId,
+      connectionId: c.req.param("connectionId"),
+      credentialEncrypted: null,
+      status: "disabled",
+      tokenMetadata: {},
+    });
+    if (!connection) {
+      throw new HTTPException(404, { message: "social connection not found" });
+    }
+    return c.json(connection);
+  });
+
+  // First-party social OAuth (X / Reddit). Distinct from the MCP integrations
+  // flow: providers are pinned, tokens land in social_connections, and the
+  // callback is unauthenticated (browser redirect) but bound by signed state.
+  app.post("/v1/workspaces/:workspaceId/social/oauth/start", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const parsed = SocialOAuthStartRequest.safeParse(await c.req.json());
+    if (!parsed.success) {
+      throw new HTTPException(400, {
+        message: parsed.error.issues[0]?.message ?? "invalid social OAuth start request",
+      });
+    }
+    const payload = parsed.data;
+    const result = await startSocialOAuth(
+      { db, settings, observability },
+      {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        requestUrl: c.req.url,
+        payload,
+      },
+    );
+    return c.json(OAuthStartResponse.parse(result));
+  });
+
+  app.get("/v1/social/oauth/callback", async (c) => {
+    const result = await completeSocialOAuthCallback(
+      { db, settings, observability },
+      {
+        code: c.req.query("code"),
+        state: c.req.query("state"),
+        error: c.req.query("error"),
+        requestUrl: c.req.url,
+      },
+    );
+    return c.redirect(result.redirectTo, 302);
+  });
+
   app.get("/v1/workspaces/:workspaceId/social/posts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:read");