@opengeni/api-router 0.20.0 → 0.21.3

package/dist/app.js

@@ -22,7 +22,7 @@ import {
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession
-} from "./chunk-AEVD7E2F.js";
+} from "./chunk-AMMQI2D3.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,

package/dist/{chunk-AEVD7E2F.js → chunk-AMMQI2D3.js}

@@ -10960,6 +10960,7 @@ import {
   isOpenGeniSlackBotConnection as isOpenGeniSlackBotConnection2,
   openGeniSlackBotMetadata as openGeniSlackBotMetadata2,
   requireAccessGrant as requireAccessGrant3,
+  requireAccessGrantAuthorization,
   requireEnvironmentEncryption as requireEnvironmentEncryption4
 } from "@opengeni/core";
 import {
@@ -10981,6 +10982,9 @@ import { HTTPException as HTTPException11 } from "hono/http-exception";
 
 // src/integrations/google-drive.ts
 import { createHash as createHash6, randomBytes as randomBytes3 } from "crypto";
+import {
+  bindConnectorDocumentDestination
+} from "@opengeni/contracts/connector-destinations";
 import {
   GOOGLE_DRIVE_CREDENTIAL_LABEL,
   GOOGLE_DRIVE_CREDENTIAL_ROLE,
@@ -11171,6 +11175,7 @@ async function completeGoogleDriveOAuthCallback(deps, input) {
       verifiedAt: (/* @__PURE__ */ new Date()).toISOString(),
       accessMode: scopeDecision.accessMode,
       lifecycle: googleDriveLifecycle("active"),
+      ...previousMetadata?.documentDestination ? { documentDestination: previousMetadata.documentDestination } : {},
       ...previousMetadata?.selectedSources ? { selectedSources: previousMetadata.selectedSources } : previousMetadata?.selectedSource ? { selectedSources: [previousMetadata.selectedSource] } : {}
     });
     const connection = existing ? await updateConnection2(deps.db, {
@@ -11382,7 +11387,28 @@ async function saveGoogleDriveSource(deps, input) {
   if (!existing) {
     throw new HTTPException10(404, { message: "Google Drive connection not found" });
   }
+  if (existing.accountId !== input.accountId || existing.workspaceId !== input.workspaceId) {
+    throw new HTTPException10(403, { message: "Google Drive connection authority mismatch" });
+  }
   await requireGoogleDriveSourceConnection(deps, existing, input.subjectId);
+  const destinationSelection = payload.destination ?? {
+    authorityKind: "workspace",
+    collectionId: null
+  };
+  if (destinationSelection.authorityKind === "organization" && !input.canManageOrganizationDestination) {
+    throw new HTTPException10(403, { message: "missing permission: account:admin" });
+  }
+  if (destinationSelection.authorityKind === "workspace" && !input.canManageWorkspaceDestination) {
+    throw new HTTPException10(403, { message: "missing permission: workspace:admin" });
+  }
+  if (destinationSelection.authorityKind === "personal" && !input.canManagePersonalDestination) {
+    throw new HTTPException10(403, { message: "personal destination requires the exact actor" });
+  }
+  const documentDestination = bindConnectorDocumentDestination(destinationSelection, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    initiatingSubjectId: input.subjectId
+  });
   const verifiedSources = [];
   for (const source of payload.sources) {
     const sourceId = validDriveId(source.id, "source.id");
@@ -11413,13 +11439,14 @@ async function saveGoogleDriveSource(deps, input) {
     expectedVersion: latest.version,
     metadata: GoogleDriveConnectionMetadata.parse({
       ...latestMetadata,
+      documentDestination,
       selectedSource: null,
       selectedSources: verifiedSources.map((verified) => ({
         id: verified.id,
         name: verified.name,
         mimeType: verified.mimeType,
         driveId: verified.driveId,
-        targetScope: payload.targetScope,
+        destination: documentDestination,
         syncCadence: payload.syncCadence,
         readPolicy: payload.readPolicy,
         selectedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -12205,12 +12232,22 @@ function registerConnectionRoutes(app, deps) {
     async (c) => {
       assertIntegrationsEnabled();
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
+      const authorization = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "connections:write"
+      );
+      const { grant } = authorization;
       const connection = await saveGoogleDriveSource(deps, {
+        accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
         connectionId: c.req.param("connectionId"),
-        payload: await c.req.json()
+        payload: await c.req.json(),
+        canManageOrganizationDestination: authorization.accountGrant?.permissions.includes("account:admin") === true,
+        canManageWorkspaceDestination: hasPermission8(grant.permissions, "workspace:admin"),
+        canManagePersonalDestination: authorization.contextIntegrity && authorization.authenticatedSubjectId === grant.subjectId
       });
       return c.json(ConnectionResponse.parse({ connection }));
     }
@@ -12693,7 +12730,7 @@ import {
 } from "@opengeni/documents";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { HTTPException as HTTPException13 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant5, requireAccessGrantAuthorization } from "@opengeni/core";
+import { requireAccessGrant as requireAccessGrant5, requireAccessGrantAuthorization as requireAccessGrantAuthorization2 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage3, requireLimit as requireLimit3 } from "@opengeni/core";
 
 // src/mcp/documents.ts
@@ -13400,7 +13437,7 @@ function registerDocumentRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/document-bases/:baseId/documents", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "documents:manage");
+    const access = await requireAccessGrantAuthorization2(c, deps, workspaceId, "documents:manage");
     const { grant } = access;
     if (!objectStorage) {
       throw new HTTPException13(503, { message: "object storage is not configured" });
@@ -13467,7 +13504,7 @@ function registerDocumentRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/document-bases/:baseId/documents/:documentId",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const authorization = await requireAccessGrantAuthorization(
+      const authorization = await requireAccessGrantAuthorization2(
         c,
         deps,
         workspaceId,
@@ -13504,7 +13541,7 @@ function registerDocumentRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/document-bases/:baseId/documents/:documentId/reindex",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const authorization = await requireAccessGrantAuthorization(
+      const authorization = await requireAccessGrantAuthorization2(
         c,
         deps,
         workspaceId,
@@ -13630,7 +13667,7 @@ function registerDocumentRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/knowledge/drops", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "documents:manage");
+    const access = await requireAccessGrantAuthorization2(c, deps, workspaceId, "documents:manage");
     const { grant } = access;
     if (!objectStorage) {
       throw new HTTPException13(503, { message: "object storage is not configured" });
@@ -13750,7 +13787,7 @@ function registerDocumentRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/documents/:documentId/move", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization(
+    const authorization = await requireAccessGrantAuthorization2(
       c,
       deps,
       workspaceId,
@@ -21868,6 +21905,7 @@ import { randomUUID } from "crypto";
 import {
   ActivateWorkspaceInstructionPolicyRequest,
   CreateWorkspaceInstructionPolicyDraftRequest,
+  CreateWorkspaceInstructionPolicyOnboardingProposalRequest,
   ImportLegacyWorkspaceInstructionPolicyDraftRequest,
   RollbackWorkspaceInstructionPolicyRequest,
   WorkspaceInstructionPolicyActivationResponse,
@@ -21876,22 +21914,34 @@ import {
   WorkspaceInstructionPolicyDiffResponse,
   WorkspaceInstructionPolicyListQuery,
   WorkspaceInstructionPolicyListResponse,
+  WorkspaceInstructionPolicyOnboardingProposal,
+  WorkspaceInstructionPolicyOnboardingProposalConflictResponse,
+  WorkspaceInstructionPolicyOnboardingProposalContentErrorResponse,
+  WorkspaceInstructionPolicyOnboardingProposalListQuery,
+  WorkspaceInstructionPolicyOnboardingProposalListResponse,
+  WorkspaceInstructionPolicyOnboardingProposalStaleResponse,
   WorkspaceInstructionPolicyOperationReuseResponse,
-  WorkspaceInstructionPolicyRevision
+  WorkspaceInstructionPolicyRevision,
+  WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS
 } from "@opengeni/contracts";
 import { requireAccessGrant as requireAccessGrant17 } from "@opengeni/core";
 import {
   activateWorkspaceInstructionPolicyRevision,
   createWorkspaceInstructionPolicyDraft,
+  createWorkspaceInstructionPolicyOnboardingProposal,
   diffWorkspaceInstructionPolicyRevisions,
   getWorkspaceInstructionPolicyRevision,
   importLegacyWorkspaceInstructionPolicyDraft,
   listWorkspaceInstructionPolicyRevisions,
+  listWorkspaceInstructionPolicyOnboardingProposals,
   rollbackWorkspaceInstructionPolicyRevision,
   WorkspaceInstructionPolicyConflictError,
   WorkspaceInstructionPolicyInvalidOperationError,
   WorkspaceInstructionPolicyLegacyUnavailableError,
   WorkspaceInstructionPolicyNotFoundError,
+  WorkspaceInstructionPolicyOnboardingProposalConflictError,
+  WorkspaceInstructionPolicyOnboardingProposalContentError,
+  WorkspaceInstructionPolicyOnboardingProposalStaleError,
   WorkspaceInstructionPolicyOperationReuseError
 } from "@opengeni/db";
 import { HTTPException as HTTPException27 } from "hono/http-exception";
@@ -21924,6 +21974,37 @@ function policyErrorResponse(context, error) {
       409
     );
   }
+  if (error instanceof WorkspaceInstructionPolicyOnboardingProposalContentError) {
+    return context.json(
+      WorkspaceInstructionPolicyOnboardingProposalContentErrorResponse.parse({
+        code: error.code,
+        message: error.message,
+        maxChars: WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS
+      }),
+      422
+    );
+  }
+  if (error instanceof WorkspaceInstructionPolicyOnboardingProposalStaleError) {
+    return context.json(
+      WorkspaceInstructionPolicyOnboardingProposalStaleResponse.parse({
+        code: error.code,
+        message: error.message,
+        currentHead: error.currentHead
+      }),
+      409
+    );
+  }
+  if (error instanceof WorkspaceInstructionPolicyOnboardingProposalConflictError) {
+    return context.json(
+      WorkspaceInstructionPolicyOnboardingProposalConflictResponse.parse({
+        code: error.code,
+        message: error.message,
+        existingProposalId: error.existingProposalId,
+        existingDraftRevisionId: error.existingDraftRevisionId
+      }),
+      409
+    );
+  }
   if (error instanceof WorkspaceInstructionPolicyNotFoundError) {
     return context.json(
       { code: "WORKSPACE_INSTRUCTION_POLICY_NOT_FOUND", message: error.message },
@@ -22027,6 +22108,56 @@ function registerWorkspaceInstructionPolicyRoutes(app, deps) {
       return policyErrorResponse(context, error);
     }
   });
+  app.get(`${base}/onboarding-proposals`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant17(context, deps, workspaceId, "workspace:read");
+    const parsed = WorkspaceInstructionPolicyOnboardingProposalListQuery.safeParse({
+      limit: context.req.query("limit")
+    });
+    if (!parsed.success) {
+      throw new HTTPException27(422, {
+        message: "Invalid workspace instruction-policy onboarding-proposal query"
+      });
+    }
+    return context.json(
+      WorkspaceInstructionPolicyOnboardingProposalListResponse.parse(
+        await listWorkspaceInstructionPolicyOnboardingProposals(deps.db, workspaceId, parsed.data)
+      )
+    );
+  });
+  app.post(`${base}/onboarding-proposals`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant17(context, deps, workspaceId, "workspace:admin");
+    assertBoundedActor(grant.subjectId);
+    const request = await parseBody(
+      context,
+      CreateWorkspaceInstructionPolicyOnboardingProposalRequest
+    );
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyOnboardingProposal.parse(
+          await createWorkspaceInstructionPolicyOnboardingProposal(deps.db, {
+            operationId: request.operationId ?? randomUUID(),
+            accountId: grant.accountId,
+            workspaceId,
+            createdBySubjectId: grant.subjectId,
+            kind: request.kind,
+            scope: request.scope,
+            roleKey: request.roleKey,
+            content: request.content,
+            sourceId: request.sourceId,
+            sourceVersion: request.sourceVersion,
+            confidenceBps: request.confidenceBps,
+            expectedCurrentRevisionId: request.expectedCurrentRevisionId,
+            expectedActivationVersion: request.expectedActivationVersion
+          })
+        ),
+        201
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
   app.get(`${base}/diff`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant17(context, deps, workspaceId, "workspace:read");
@@ -22821,7 +22952,7 @@ import {
 import {
   hasPermission as hasPermission13,
   requireAccessGrant as requireAccessGrant20,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization2
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization3
 } from "@opengeni/core";
 import {
   activatePreferenceRegistryRevision,
@@ -22969,7 +23100,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/proposals`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -23049,7 +23180,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/activate`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -23078,7 +23209,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/correct`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -23107,7 +23238,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/scope`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -23136,7 +23267,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/deactivate`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -23165,7 +23296,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/supersede`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -23194,7 +23325,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/reject`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -25996,4 +26127,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession2 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-AEVD7E2F.js.map
+//# sourceMappingURL=chunk-AMMQI2D3.js.map