@opengeni/api-router 0.21.0 → 0.21.3

package/dist/app.js

@@ -22,7 +22,7 @@ import {
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession
-} from "./chunk-5EEC7Q6C.js";
+} from "./chunk-AMMQI2D3.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,

package/dist/{chunk-5EEC7Q6C.js → chunk-AMMQI2D3.js}

@@ -10960,6 +10960,7 @@ import {
   isOpenGeniSlackBotConnection as isOpenGeniSlackBotConnection2,
   openGeniSlackBotMetadata as openGeniSlackBotMetadata2,
   requireAccessGrant as requireAccessGrant3,
+  requireAccessGrantAuthorization,
   requireEnvironmentEncryption as requireEnvironmentEncryption4
 } from "@opengeni/core";
 import {
@@ -10981,6 +10982,9 @@ import { HTTPException as HTTPException11 } from "hono/http-exception";
 
 // src/integrations/google-drive.ts
 import { createHash as createHash6, randomBytes as randomBytes3 } from "crypto";
+import {
+  bindConnectorDocumentDestination
+} from "@opengeni/contracts/connector-destinations";
 import {
   GOOGLE_DRIVE_CREDENTIAL_LABEL,
   GOOGLE_DRIVE_CREDENTIAL_ROLE,
@@ -11171,6 +11175,7 @@ async function completeGoogleDriveOAuthCallback(deps, input) {
       verifiedAt: (/* @__PURE__ */ new Date()).toISOString(),
       accessMode: scopeDecision.accessMode,
       lifecycle: googleDriveLifecycle("active"),
+      ...previousMetadata?.documentDestination ? { documentDestination: previousMetadata.documentDestination } : {},
       ...previousMetadata?.selectedSources ? { selectedSources: previousMetadata.selectedSources } : previousMetadata?.selectedSource ? { selectedSources: [previousMetadata.selectedSource] } : {}
     });
     const connection = existing ? await updateConnection2(deps.db, {
@@ -11382,7 +11387,28 @@ async function saveGoogleDriveSource(deps, input) {
   if (!existing) {
     throw new HTTPException10(404, { message: "Google Drive connection not found" });
   }
+  if (existing.accountId !== input.accountId || existing.workspaceId !== input.workspaceId) {
+    throw new HTTPException10(403, { message: "Google Drive connection authority mismatch" });
+  }
   await requireGoogleDriveSourceConnection(deps, existing, input.subjectId);
+  const destinationSelection = payload.destination ?? {
+    authorityKind: "workspace",
+    collectionId: null
+  };
+  if (destinationSelection.authorityKind === "organization" && !input.canManageOrganizationDestination) {
+    throw new HTTPException10(403, { message: "missing permission: account:admin" });
+  }
+  if (destinationSelection.authorityKind === "workspace" && !input.canManageWorkspaceDestination) {
+    throw new HTTPException10(403, { message: "missing permission: workspace:admin" });
+  }
+  if (destinationSelection.authorityKind === "personal" && !input.canManagePersonalDestination) {
+    throw new HTTPException10(403, { message: "personal destination requires the exact actor" });
+  }
+  const documentDestination = bindConnectorDocumentDestination(destinationSelection, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    initiatingSubjectId: input.subjectId
+  });
   const verifiedSources = [];
   for (const source of payload.sources) {
     const sourceId = validDriveId(source.id, "source.id");
@@ -11413,13 +11439,14 @@ async function saveGoogleDriveSource(deps, input) {
     expectedVersion: latest.version,
     metadata: GoogleDriveConnectionMetadata.parse({
       ...latestMetadata,
+      documentDestination,
       selectedSource: null,
       selectedSources: verifiedSources.map((verified) => ({
         id: verified.id,
         name: verified.name,
         mimeType: verified.mimeType,
         driveId: verified.driveId,
-        targetScope: payload.targetScope,
+        destination: documentDestination,
         syncCadence: payload.syncCadence,
         readPolicy: payload.readPolicy,
         selectedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -12205,12 +12232,22 @@ function registerConnectionRoutes(app, deps) {
     async (c) => {
       assertIntegrationsEnabled();
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
+      const authorization = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "connections:write"
+      );
+      const { grant } = authorization;
       const connection = await saveGoogleDriveSource(deps, {
+        accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
         connectionId: c.req.param("connectionId"),
-        payload: await c.req.json()
+        payload: await c.req.json(),
+        canManageOrganizationDestination: authorization.accountGrant?.permissions.includes("account:admin") === true,
+        canManageWorkspaceDestination: hasPermission8(grant.permissions, "workspace:admin"),
+        canManagePersonalDestination: authorization.contextIntegrity && authorization.authenticatedSubjectId === grant.subjectId
       });
       return c.json(ConnectionResponse.parse({ connection }));
     }
@@ -12693,7 +12730,7 @@ import {
 } from "@opengeni/documents";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { HTTPException as HTTPException13 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant5, requireAccessGrantAuthorization } from "@opengeni/core";
+import { requireAccessGrant as requireAccessGrant5, requireAccessGrantAuthorization as requireAccessGrantAuthorization2 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage3, requireLimit as requireLimit3 } from "@opengeni/core";
 
 // src/mcp/documents.ts
@@ -13400,7 +13437,7 @@ function registerDocumentRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/document-bases/:baseId/documents", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "documents:manage");
+    const access = await requireAccessGrantAuthorization2(c, deps, workspaceId, "documents:manage");
     const { grant } = access;
     if (!objectStorage) {
       throw new HTTPException13(503, { message: "object storage is not configured" });
@@ -13467,7 +13504,7 @@ function registerDocumentRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/document-bases/:baseId/documents/:documentId",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const authorization = await requireAccessGrantAuthorization(
+      const authorization = await requireAccessGrantAuthorization2(
         c,
         deps,
         workspaceId,
@@ -13504,7 +13541,7 @@ function registerDocumentRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/document-bases/:baseId/documents/:documentId/reindex",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const authorization = await requireAccessGrantAuthorization(
+      const authorization = await requireAccessGrantAuthorization2(
         c,
         deps,
         workspaceId,
@@ -13630,7 +13667,7 @@ function registerDocumentRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/knowledge/drops", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "documents:manage");
+    const access = await requireAccessGrantAuthorization2(c, deps, workspaceId, "documents:manage");
     const { grant } = access;
     if (!objectStorage) {
       throw new HTTPException13(503, { message: "object storage is not configured" });
@@ -13750,7 +13787,7 @@ function registerDocumentRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/documents/:documentId/move", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization(
+    const authorization = await requireAccessGrantAuthorization2(
       c,
       deps,
       workspaceId,
@@ -22915,7 +22952,7 @@ import {
 import {
   hasPermission as hasPermission13,
   requireAccessGrant as requireAccessGrant20,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization2
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization3
 } from "@opengeni/core";
 import {
   activatePreferenceRegistryRevision,
@@ -23063,7 +23100,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/proposals`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -23143,7 +23180,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/activate`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -23172,7 +23209,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/correct`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -23201,7 +23238,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/scope`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -23230,7 +23267,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/deactivate`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -23259,7 +23296,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/supersede`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -23288,7 +23325,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/reject`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization2(
+    const access = await requireAccessGrantAuthorization3(
       context,
       deps,
       workspaceId,
@@ -26090,4 +26127,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession2 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-5EEC7Q6C.js.map
+//# sourceMappingURL=chunk-AMMQI2D3.js.map