@opengeni/api-router 0.21.0 → 0.21.3

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createAppComposition,
   startSlackInteractionPump
-} from "./chunk-5EEC7Q6C.js";
+} from "./chunk-AMMQI2D3.js";
 
 // src/index.ts
 import {

package/dist/integrations/google-drive.d.ts

@@ -83,9 +83,13 @@ export declare function browseGoogleDrive(deps: ApiRouteDeps, input: {
     incompleteSearch: boolean;
 }>;
 export declare function saveGoogleDriveSource(deps: ApiRouteDeps, input: {
+    accountId: string;
     workspaceId: string;
     subjectId: string;
     connectionId: string;
     payload: unknown;
+    canManageOrganizationDestination: boolean;
+    canManageWorkspaceDestination: boolean;
+    canManagePersonalDestination: boolean;
 }): Promise<import("@opengeni/db").ConnectionMetadataWithVerification>;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "0.21.0",
+  "version": "0.21.3",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,17 +44,17 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opengeni/agent-proto": "^0.3.0",
     "@opengeni/codex": "^0.2.10",
-    "@opengeni/config": "^0.10.7",
-    "@opengeni/contracts": "^0.36.0",
-    "@opengeni/core": "^0.20.3",
-    "@opengeni/db": "^0.27.0",
-    "@opengeni/documents": "^0.3.3",
-    "@opengeni/events": "^0.3.66",
-    "@opengeni/github": "^0.4.23",
-    "@opengeni/network": "^0.1.1",
-    "@opengeni/observability": "^0.4.10",
-    "@opengeni/runtime": "^0.18.4",
-    "@opengeni/storage": "^0.2.60",
+    "@opengeni/config": "^0.10.9",
+    "@opengeni/contracts": "^0.37.0",
+    "@opengeni/core": "^0.20.6",
+    "@opengeni/db": "^0.27.3",
+    "@opengeni/documents": "^0.4.1",
+    "@opengeni/events": "^0.3.69",
+    "@opengeni/github": "^0.4.25",
+    "@opengeni/network": "^0.1.2",
+    "@opengeni/observability": "^0.4.12",
+    "@opengeni/runtime": "^0.18.7",
+    "@opengeni/storage": "^0.2.62",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/integrations/google-drive.ts

@@ -1,5 +1,9 @@
 import { createHash, randomBytes } from "node:crypto";
 import type { Settings } from "@opengeni/config";
+import {
+  bindConnectorDocumentDestination,
+  type ConnectorDocumentDestinationSelection,
+} from "@opengeni/contracts/connector-destinations";
 import {
   GOOGLE_DRIVE_CREDENTIAL_LABEL,
   GOOGLE_DRIVE_CREDENTIAL_ROLE,
@@ -253,6 +257,9 @@ export async function completeGoogleDriveOAuthCallback(
       verifiedAt: new Date().toISOString(),
       accessMode: scopeDecision.accessMode,
       lifecycle: googleDriveLifecycle("active"),
+      ...(previousMetadata?.documentDestination
+        ? { documentDestination: previousMetadata.documentDestination }
+        : {}),
       ...(previousMetadata?.selectedSources
         ? { selectedSources: previousMetadata.selectedSources }
         : previousMetadata?.selectedSource
@@ -496,10 +503,14 @@ export async function browseGoogleDrive(
 export async function saveGoogleDriveSource(
   deps: ApiRouteDeps,
   input: {
+    accountId: string;
     workspaceId: string;
     subjectId: string;
     connectionId: string;
     payload: unknown;
+    canManageOrganizationDestination: boolean;
+    canManageWorkspaceDestination: boolean;
+    canManagePersonalDestination: boolean;
   },
 ) {
   const parsedPayload = SaveGoogleDriveSourceRequest.safeParse(input.payload);
@@ -516,7 +527,31 @@ export async function saveGoogleDriveSource(
   if (!existing) {
     throw new HTTPException(404, { message: "Google Drive connection not found" });
   }
+  if (existing.accountId !== input.accountId || existing.workspaceId !== input.workspaceId) {
+    throw new HTTPException(403, { message: "Google Drive connection authority mismatch" });
+  }
   await requireGoogleDriveSourceConnection(deps, existing, input.subjectId);
+  const destinationSelection: ConnectorDocumentDestinationSelection = payload.destination ?? {
+    authorityKind: "workspace",
+    collectionId: null,
+  };
+  if (
+    destinationSelection.authorityKind === "organization" &&
+    !input.canManageOrganizationDestination
+  ) {
+    throw new HTTPException(403, { message: "missing permission: account:admin" });
+  }
+  if (destinationSelection.authorityKind === "workspace" && !input.canManageWorkspaceDestination) {
+    throw new HTTPException(403, { message: "missing permission: workspace:admin" });
+  }
+  if (destinationSelection.authorityKind === "personal" && !input.canManagePersonalDestination) {
+    throw new HTTPException(403, { message: "personal destination requires the exact actor" });
+  }
+  const documentDestination = bindConnectorDocumentDestination(destinationSelection, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    initiatingSubjectId: input.subjectId,
+  });
   const verifiedSources = [];
   for (const source of payload.sources) {
     const sourceId = validDriveId(source.id, "source.id");
@@ -552,13 +587,14 @@ export async function saveGoogleDriveSource(
     expectedVersion: latest.version,
     metadata: GoogleDriveConnectionMetadata.parse({
       ...latestMetadata,
+      documentDestination,
       selectedSource: null,
       selectedSources: verifiedSources.map((verified) => ({
         id: verified.id,
         name: verified.name,
         mimeType: verified.mimeType,
         driveId: verified.driveId,
-        targetScope: payload.targetScope,
+        destination: documentDestination,
         syncCadence: payload.syncCadence,
         readPolicy: payload.readPolicy,
         selectedAt: new Date().toISOString(),

package/src/routes/connections.ts

@@ -24,6 +24,7 @@ import {
   isOpenGeniSlackBotConnection,
   openGeniSlackBotMetadata,
   requireAccessGrant,
+  requireAccessGrantAuthorization,
   requireEnvironmentEncryption,
 } from "@opengeni/core";
 import {
@@ -338,12 +339,25 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     async (c) => {
       assertIntegrationsEnabled();
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+      const authorization = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "connections:write",
+      );
+      const { grant } = authorization;
       const connection = await saveGoogleDriveSource(deps, {
+        accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
         connectionId: c.req.param("connectionId"),
         payload: await c.req.json(),
+        canManageOrganizationDestination:
+          authorization.accountGrant?.permissions.includes("account:admin") === true,
+        canManageWorkspaceDestination: hasPermission(grant.permissions, "workspace:admin"),
+        canManagePersonalDestination:
+          authorization.contextIntegrity &&
+          authorization.authenticatedSubjectId === grant.subjectId,
       });
       return c.json(ConnectionResponse.parse({ connection }));
     },