@opengeni/api-router 0.15.1 → 0.15.4

package/src/mcp/server.ts

@@ -57,6 +57,8 @@ import {
   listRigVersionMonitoringSummaries,
   listSocialConnections,
   listSocialPosts,
+  recordAuditEvent,
+  recordSyncedSocialPosts,
   listVariableSets,
   MEMORY_CORRECT_TOOL_DESCRIPTION,
   MEMORY_SAVE_TOOL_DESCRIPTION,
@@ -109,6 +111,13 @@ import {
   listWorkspaceGitHubRepositories,
 } from "../github-access";
 import { githubBrowserBaseUrl, githubBrowserGrantClaims } from "../github-browser-flow";
+import {
+  socialMentionsLive,
+  socialOwnPostsLive,
+  socialPostReply,
+  socialSearchLive,
+  socialThreadLive,
+} from "../integrations/social-api";
 import {
   promoteVerifiedDefinitionEditChangeForApi,
   proposeRigChangeForApi,
@@ -228,6 +237,15 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   social_connections_list: { allOf: ["connections:read"] },
   social_posts_recent: { allOf: ["connections:read"] },
   social_daily_analysis_context: { allOf: ["connections:read"] },
+  social_search_live: { allOf: ["connections:read"] },
+  social_mentions_live: { allOf: ["connections:read"] },
+  social_thread_fetch: { allOf: ["connections:read"] },
+  // Writes the social_posts store, so it takes the write scope like the REST
+  // equivalent (POST /social/posts is workspace:admin).
+  social_posts_sync: { allOf: ["connections:write"] },
+  // Publishes under the user's identity: connections:write keeps it out of the
+  // default agent permission set, unlike the read-only social tools above.
+  social_post_reply: { allOf: ["connections:write"] },
   scheduled_tasks_list: { anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"] },
   scheduled_tasks_get: { anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"] },
   scheduled_tasks_create: { allOf: ["scheduled_tasks:manage"] },
@@ -562,6 +580,162 @@ export function buildOpenGeniMcpServer(
         });
       },
     );
+
+    // Live provider reads (X / Reddit). Tokens are resolved and used entirely
+    // host-side; the agent only ever sees normalized post payloads.
+    server.registerTool(
+      "social_search_live",
+      {
+        description:
+          "Search live conversations on a connected social account (X recent search or Reddit search). Use social_connections_list first to find the connectionId. For Reddit, pass subreddit to scope the search.",
+        inputSchema: {
+          connectionId: z4.string().uuid(),
+          query: z4.string().min(1).max(512),
+          subreddit: z4.string().min(1).max(100).optional(),
+          limit: z4.number().int().positive().optional(),
+        },
+      },
+      async ({ connectionId, query, subreddit, limit }) => {
+        const result = await socialSearchLive(
+          deps,
+          { workspaceId: grant.workspaceId, connectionId },
+          { query, subreddit, limit },
+        );
+        return json({ provider: result.connection.provider, posts: result.posts });
+      },
+    );
+
+    server.registerTool(
+      "social_mentions_live",
+      {
+        description:
+          "Fetch live mentions of the connected account (X mentions timeline, or the Reddit inbox with username mentions and comment replies).",
+        inputSchema: {
+          connectionId: z4.string().uuid(),
+          sinceId: z4.string().optional(),
+          limit: z4.number().int().positive().optional(),
+        },
+      },
+      async ({ connectionId, sinceId, limit }) => {
+        const result = await socialMentionsLive(
+          deps,
+          { workspaceId: grant.workspaceId, connectionId },
+          { sinceId, limit },
+        );
+        return json({ provider: result.connection.provider, posts: result.posts });
+      },
+    );
+
+    server.registerTool(
+      "social_thread_fetch",
+      {
+        description:
+          "Fetch a live conversation thread: for X pass a tweet id (returns the conversation), for Reddit pass a post id or t3_ fullname (returns the post plus top comments).",
+        inputSchema: {
+          connectionId: z4.string().uuid(),
+          id: z4.string().min(1).max(100),
+          limit: z4.number().int().positive().optional(),
+        },
+      },
+      async ({ connectionId, id, limit }) => {
+        const result = await socialThreadLive(
+          deps,
+          { workspaceId: grant.workspaceId, connectionId },
+          { id, limit },
+        );
+        return json({ provider: result.connection.provider, posts: result.posts });
+      },
+    );
+  }
+
+  // Writes are gated on connections:write (never in the default first-party
+  // agent permission set) so scheduled tasks must opt in, and deployments can
+  // additionally wrap posting in a requireApproval policy.
+  if (!toolspaceMode || can("connections:write")) {
+    server.registerTool(
+      "social_posts_sync",
+      {
+        description:
+          "Sync the connected account's own recent posts from the provider into OpenGeni's social_posts store (idempotent), so social_posts_recent and daily analysis see fresh data.",
+        inputSchema: {
+          connectionId: z4.string().uuid(),
+          limit: z4.number().int().positive().optional(),
+        },
+      },
+      async ({ connectionId, limit }) => {
+        const result = await socialOwnPostsLive(
+          deps,
+          { workspaceId: grant.workspaceId, connectionId },
+          { limit },
+        );
+        // A post without a provider timestamp is skipped rather than recorded
+        // at sync time: publishedAt drives analysis windows, and the dedup
+        // index would freeze a fabricated date forever.
+        const datedPosts = result.posts.filter((post) => post.createdAt !== null);
+        const synced = await recordSyncedSocialPosts(deps.db, {
+          accountId: grant.accountId,
+          workspaceId: grant.workspaceId,
+          connectionId,
+          posts: datedPosts.map((post) => ({
+            externalPostId: post.id,
+            url: post.url,
+            authorHandle: post.author,
+            text: post.text,
+            publishedAt: new Date(post.createdAt!),
+            metrics: post.metrics,
+          })),
+        });
+        return json({
+          provider: result.connection.provider,
+          fetched: result.posts.length,
+          inserted: synced.inserted,
+          skipped: synced.skipped,
+          skippedMissingDate: result.posts.length - datedPosts.length,
+        });
+      },
+    );
+
+    server.registerTool(
+      "social_post_reply",
+      {
+        description:
+          "Publish a reply from the connected social account. X: inReplyToId is the tweet id to reply to. Reddit: inReplyToId is a fullname (t3_<post> or t1_<comment>). Draft and get approval before calling this — it posts publicly and immediately.",
+        inputSchema: {
+          connectionId: z4.string().uuid(),
+          inReplyToId: z4.string().min(1).max(100),
+          text: z4.string().min(1).max(10000),
+        },
+      },
+      async ({ connectionId, inReplyToId, text }) => {
+        const result = await socialPostReply(
+          deps,
+          { workspaceId: grant.workspaceId, connectionId },
+          { inReplyToId, text },
+        );
+        // Outbound publishes leave a durable, secret-free receipt (house
+        // pattern: the Slack bot post audit), so who posted what where stays
+        // answerable after the session is gone.
+        await recordAuditEvent(deps.db, {
+          accountId: grant.accountId,
+          workspaceId: grant.workspaceId,
+          subjectId: grant.subjectId,
+          action: "social.post_reply",
+          targetType: "social_connection",
+          targetId: connectionId,
+          metadata: {
+            provider: result.connection.provider,
+            inReplyToId,
+            postedId: result.postedId,
+            url: result.url,
+          },
+        });
+        return json({
+          provider: result.connection.provider,
+          postedId: result.postedId,
+          url: result.url,
+        });
+      },
+    );
   }
 
   if (!toolspaceMode || can("scheduled_tasks:manage") || can("scheduled_tasks:run")) {

package/src/routes/social.ts

@@ -1,9 +1,15 @@
-import { CreateSocialConnectionRequest, CreateSocialPostRequest } from "@opengeni/contracts";
+import {
+  CreateSocialConnectionRequest,
+  CreateSocialPostRequest,
+  OAuthStartResponse,
+  SocialOAuthStartRequest,
+} from "@opengeni/contracts";
 import {
   createSocialConnection,
   createSocialPost,
   listSocialConnections,
   listSocialPosts,
+  updateSocialConnectionCredential,
 } from "@opengeni/db";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
@@ -11,9 +17,10 @@ import { z } from "zod";
 import { requireAccessGrant } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import { boundedLimit } from "../http/common";
+import { completeSocialOAuthCallback, startSocialOAuth } from "../integrations/social-oauth";
 
 export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
-  const { db } = deps;
+  const { db, settings, observability } = deps;
 
   app.get("/v1/workspaces/:workspaceId/social/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -47,6 +54,64 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
   });
 
+  // Disconnect: drop the stored OAuth credential and disable the connection.
+  // The row stays (posts reference it and the audit trail needs the identity);
+  // reconnecting via the OAuth flow revives it.
+  app.delete("/v1/workspaces/:workspaceId/social/connections/:connectionId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const connection = await updateSocialConnectionCredential(db, {
+      workspaceId,
+      connectionId: c.req.param("connectionId"),
+      credentialEncrypted: null,
+      status: "disabled",
+      tokenMetadata: {},
+    });
+    if (!connection) {
+      throw new HTTPException(404, { message: "social connection not found" });
+    }
+    return c.json(connection);
+  });
+
+  // First-party social OAuth (X / Reddit). Distinct from the MCP integrations
+  // flow: providers are pinned, tokens land in social_connections, and the
+  // callback is unauthenticated (browser redirect) but bound by signed state.
+  app.post("/v1/workspaces/:workspaceId/social/oauth/start", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const parsed = SocialOAuthStartRequest.safeParse(await c.req.json());
+    if (!parsed.success) {
+      throw new HTTPException(400, {
+        message: parsed.error.issues[0]?.message ?? "invalid social OAuth start request",
+      });
+    }
+    const payload = parsed.data;
+    const result = await startSocialOAuth(
+      { db, settings, observability },
+      {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        requestUrl: c.req.url,
+        payload,
+      },
+    );
+    return c.json(OAuthStartResponse.parse(result));
+  });
+
+  app.get("/v1/social/oauth/callback", async (c) => {
+    const result = await completeSocialOAuthCallback(
+      { db, settings, observability },
+      {
+        code: c.req.query("code"),
+        state: c.req.query("state"),
+        error: c.req.query("error"),
+        requestUrl: c.req.url,
+      },
+    );
+    return c.redirect(result.redirectTo, 302);
+  });
+
   app.get("/v1/workspaces/:workspaceId/social/posts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:read");