@opengeni/api-router 0.21.0 → 0.21.7

package/src/model-catalog.ts

@@ -50,6 +50,7 @@ export function projectClientModel(model: ConfiguredModel): ClientModel {
   return ClientModel.parse({
     id: model.id,
     label: model.label,
+    ...(model.shortLabel ? { shortLabel: model.shortLabel } : {}),
     ...publicProvider,
     source,
     api: model.api,

package/src/routes/connections.ts

@@ -24,6 +24,7 @@ import {
   isOpenGeniSlackBotConnection,
   openGeniSlackBotMetadata,
   requireAccessGrant,
+  requireAccessGrantAuthorization,
   requireEnvironmentEncryption,
 } from "@opengeni/core";
 import {
@@ -338,12 +339,25 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     async (c) => {
       assertIntegrationsEnabled();
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+      const authorization = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "connections:write",
+      );
+      const { grant } = authorization;
       const connection = await saveGoogleDriveSource(deps, {
+        accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
         connectionId: c.req.param("connectionId"),
         payload: await c.req.json(),
+        canManageOrganizationDestination:
+          authorization.accountGrant?.permissions.includes("account:admin") === true,
+        canManageWorkspaceDestination: hasPermission(grant.permissions, "workspace:admin"),
+        canManagePersonalDestination:
+          authorization.contextIntegrity &&
+          authorization.authenticatedSubjectId === grant.subjectId,
       });
       return c.json(ConnectionResponse.parse({ connection }));
     },
@@ -503,7 +517,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
     const payload = parsed.data;
     const result = await startMcpOAuth(
-      { db, settings, observability },
+      { db, settings, observability, oauthStartDeadlineMs: deps.oauthStartDeadlineMs },
       {
         accountId: grant.accountId,
         workspaceId,
@@ -518,7 +532,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/integrations/oauth/callback", async (c) => {
     assertIntegrationsEnabled();
     const result = await completeMcpOAuthCallback(
-      { db, settings, observability },
+      { db, settings, observability, oauthCallbackDeadlineMs: deps.oauthCallbackDeadlineMs },
       {
         code: c.req.query("code"),
         state: c.req.query("state"),

package/src/routes/workspace-state.ts

@@ -4,6 +4,8 @@ import {
   WORKSPACE_STATE_TOPIC_MAX_CHARS,
   WorkspaceStateQuery,
   WorkspaceStateResponse,
+  type AccessGrant,
+  type WorkspaceStateQuery as WorkspaceStateQueryType,
 } from "@opengeni/contracts";
 import { hasPermission, requireAccessGrant, type ApiRouteDeps } from "@opengeni/core";
 import {
@@ -17,90 +19,113 @@ import { getDocumentInventory } from "@opengeni/documents";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 
+import { serializeWorkspaceStateExport } from "../workspace-state-export";
 import { projectWorkspaceState } from "../workspace-state-projection";
 
+async function readWorkspaceState(
+  deps: ApiRouteDeps,
+  input: { workspaceId: string; query: WorkspaceStateQueryType; grant: AccessGrant },
+) {
+  const { workspaceId, query, grant } = input;
+  const generatedAt = new Date().toISOString();
+  const canInspectKnowledge = hasPermission(grant.permissions, "documents:search");
+
+  const [workspace, policies, knowledge, currentPreferences, acceptedAttempt] = await Promise.all([
+    getWorkspace(deps.db, workspaceId),
+    listWorkspaceInstructionPolicyRevisions(deps.db, workspaceId, { limit: 1 }),
+    canInspectKnowledge
+      ? (async () => {
+          const [documents, memories] = await Promise.all([
+            getDocumentInventory(deps.db, workspaceId, {
+              baseLimit: WORKSPACE_STATE_MAX_BASES,
+              topicLimit: WORKSPACE_STATE_MAX_TOPICS,
+              topicMaxChars: WORKSPACE_STATE_TOPIC_MAX_CHARS,
+              access: { viewerSubjectId: grant.subjectId },
+            }),
+            listWorkspaceStateMemoryRecords(deps.db, workspaceId),
+          ]);
+          return { documents, memories };
+        })()
+      : Promise.resolve(null),
+    getCurrentPreferenceRegistryGovernanceMetadata(deps.db, {
+      workspaceId,
+      subjectId: grant.subjectId,
+    }),
+    query.attemptId
+      ? getWorkspaceStateAcceptedAttemptGovernance(deps.db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          attemptId: query.attemptId,
+        })
+      : Promise.resolve(null),
+  ]);
+
+  if (!workspace) throw new HTTPException(404, { message: "workspace not found" });
+  const attemptGovernance = query.attemptId
+    ? acceptedAttempt
+      ? {
+          status: "available" as const,
+          attemptId: acceptedAttempt.attemptId,
+          executionGeneration: acceptedAttempt.executionGeneration,
+          acceptedAt: acceptedAttempt.acceptedAt,
+          policySnapshot: acceptedAttempt.policySnapshot,
+          preferenceSnapshot: acceptedAttempt.preferenceSnapshot
+            ? {
+                id: acceptedAttempt.preferenceSnapshot.id,
+                descriptorHash: acceptedAttempt.preferenceSnapshot.descriptorHash,
+                descriptors: acceptedAttempt.preferenceSnapshot.descriptors.map((descriptor) => ({
+                  id: descriptor.id,
+                  revisionId: descriptor.revisionId,
+                  contentHash: descriptor.contentHash,
+                  activeVersion: descriptor.activeVersion,
+                  scope: descriptor.scope,
+                })),
+                truncated: acceptedAttempt.preferenceSnapshot.truncated,
+                createdAt: acceptedAttempt.preferenceSnapshot.createdAt,
+              }
+            : null,
+          currentPreferences,
+        }
+      : { status: "unavailable" as const }
+    : null;
+
+  return WorkspaceStateResponse.parse(
+    projectWorkspaceState({
+      workspaceId,
+      generatedAt,
+      workspaceAgentInstructions: workspace.agentInstructions,
+      policies,
+      preferences: currentPreferences,
+      knowledge,
+      attemptGovernance,
+    }),
+  );
+}
+
 export function registerWorkspaceStateRoutes(app: Hono, deps: ApiRouteDeps): void {
-  app.get("/v1/workspaces/:workspaceId/workspace-state", async (context) => {
+  const base = "/v1/workspaces/:workspaceId/workspace-state";
+
+  app.get(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     const query = WorkspaceStateQuery.parse(context.req.query());
     const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:read");
-    const generatedAt = new Date().toISOString();
-    const canInspectKnowledge = hasPermission(grant.permissions, "documents:search");
-
-    const [workspace, policies, knowledge, attemptGovernance] = await Promise.all([
-      getWorkspace(deps.db, workspaceId),
-      listWorkspaceInstructionPolicyRevisions(deps.db, workspaceId, { limit: 1 }),
-      canInspectKnowledge
-        ? (async () => {
-            const [documents, memories] = await Promise.all([
-              getDocumentInventory(deps.db, workspaceId, {
-                baseLimit: WORKSPACE_STATE_MAX_BASES,
-                topicLimit: WORKSPACE_STATE_MAX_TOPICS,
-                topicMaxChars: WORKSPACE_STATE_TOPIC_MAX_CHARS,
-                access: { viewerSubjectId: grant.subjectId },
-              }),
-              listWorkspaceStateMemoryRecords(deps.db, workspaceId),
-            ]);
-            return { documents, memories };
-          })()
-        : Promise.resolve(null),
-      query.attemptId
-        ? getWorkspaceStateAcceptedAttemptGovernance(deps.db, {
-            accountId: grant.accountId,
-            workspaceId,
-            subjectId: grant.subjectId,
-            attemptId: query.attemptId,
-          }).then(async (snapshot) => {
-            if (!snapshot) return { status: "unavailable" as const };
-            const currentPreferences = await getCurrentPreferenceRegistryGovernanceMetadata(
-              deps.db,
-              {
-                workspaceId,
-                subjectId: grant.subjectId,
-              },
-            );
-            return {
-              status: "available" as const,
-              attemptId: snapshot.attemptId,
-              executionGeneration: snapshot.executionGeneration,
-              acceptedAt: snapshot.acceptedAt,
-              policySnapshot: snapshot.policySnapshot,
-              preferenceSnapshot: snapshot.preferenceSnapshot
-                ? {
-                    id: snapshot.preferenceSnapshot.id,
-                    descriptorHash: snapshot.preferenceSnapshot.descriptorHash,
-                    descriptors: snapshot.preferenceSnapshot.descriptors.map((descriptor) => ({
-                      id: descriptor.id,
-                      revisionId: descriptor.revisionId,
-                      contentHash: descriptor.contentHash,
-                      activeVersion: descriptor.activeVersion,
-                      scope: descriptor.scope,
-                    })),
-                    truncated: snapshot.preferenceSnapshot.truncated,
-                    createdAt: snapshot.preferenceSnapshot.createdAt,
-                  }
-                : null,
-              currentPreferences,
-            };
-          })
-        : Promise.resolve(null),
-    ]);
+    const state = await readWorkspaceState(deps, { workspaceId, query, grant });
+    context.header("cache-control", "private, no-store");
+    return context.json(state);
+  });
 
-    if (!workspace) {
-      throw new HTTPException(404, { message: "workspace not found" });
-    }
+  app.get(`${base}/export`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const query = WorkspaceStateQuery.parse(context.req.query());
+    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:read");
+    const state = await readWorkspaceState(deps, { workspaceId, query, grant });
     context.header("cache-control", "private, no-store");
-    return context.json(
-      WorkspaceStateResponse.parse(
-        projectWorkspaceState({
-          workspaceId,
-          generatedAt,
-          workspaceAgentInstructions: workspace.agentInstructions,
-          policies,
-          knowledge,
-          attemptGovernance,
-        }),
-      ),
+    context.header("content-type", "application/json; charset=utf-8");
+    context.header(
+      "content-disposition",
+      `attachment; filename="workspace-state-${workspaceId}-sanitized.json"`,
     );
+    return context.body(serializeWorkspaceStateExport(state));
   });
 }

package/src/workspace-state-export.ts

@@ -0,0 +1,49 @@
+import { createHash } from "node:crypto";
+import {
+  WORKSPACE_STATE_EXPORT_SCHEMA_VERSION,
+  WorkspaceStateExportResponse,
+  type WorkspaceStateExportResponse as WorkspaceStateExportResponseType,
+  type WorkspaceStateResponse,
+} from "@opengeni/contracts";
+
+const WORKSPACE_STATE_EXPORT_OMISSIONS = [
+  "hidden_platform_prompts",
+  "policy_bodies",
+  "preference_content",
+  "document_content_and_private_metadata",
+  "memory_content_and_provenance",
+  "secret_values_and_credentials",
+  "session_messages_and_tool_outputs",
+] as const;
+
+function canonicalize(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value === null || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value as Record<string, unknown>)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, nested]) => [key, canonicalize(nested)]),
+  );
+}
+
+export function canonicalWorkspaceStateJson(value: unknown): string {
+  return `${JSON.stringify(canonicalize(value), null, 2)}\n`;
+}
+
+export function createWorkspaceStateExport(
+  state: WorkspaceStateResponse,
+): WorkspaceStateExportResponseType {
+  const canonicalState = canonicalWorkspaceStateJson(state);
+  return WorkspaceStateExportResponse.parse({
+    kind: "opengeni.workspace_state.sanitized_export",
+    schemaVersion: WORKSPACE_STATE_EXPORT_SCHEMA_VERSION,
+    generatedAt: state.generatedAt,
+    stateSha256: createHash("sha256").update(canonicalState, "utf8").digest("hex"),
+    omissions: WORKSPACE_STATE_EXPORT_OMISSIONS,
+    state,
+  });
+}
+
+export function serializeWorkspaceStateExport(state: WorkspaceStateResponse): string {
+  return canonicalWorkspaceStateJson(createWorkspaceStateExport(state));
+}

package/src/workspace-state-projection.ts

@@ -34,6 +34,11 @@ type PreferenceGovernanceIdentity = {
   scope: "organization" | "workspace" | "user";
 };
 
+type CurrentPreferenceProjectionInput = {
+  descriptors: PreferenceGovernanceIdentity[];
+  truncated: boolean;
+};
+
 type AttemptGovernanceProjectionInput =
   | { status: "unavailable" }
   | {
@@ -60,6 +65,7 @@ export type WorkspaceStateProjectionInput = {
   generatedAt: string;
   workspaceAgentInstructions: string | null;
   policies: WorkspaceInstructionPolicyListResponse;
+  preferences: CurrentPreferenceProjectionInput;
   knowledge: KnowledgeProjectionInput | null;
   attemptGovernance?: AttemptGovernanceProjectionInput | null;
 };
@@ -308,6 +314,21 @@ function policyProjection(input: WorkspaceStateProjectionInput) {
   };
 }
 
+function preferenceProjection(input: CurrentPreferenceProjectionInput) {
+  const descriptors = [...input.descriptors].sort((left, right) =>
+    preferenceIdentity(left).localeCompare(preferenceIdentity(right)),
+  );
+  const scopeCounts = { organization: 0, workspace: 0, user: 0 };
+  for (const descriptor of descriptors) scopeCounts[descriptor.scope] += 1;
+  return {
+    authority: "preference_registry_preferences" as const,
+    activeDescriptorCount: descriptors.length,
+    activeDescriptorHash: hashIdentities(descriptors.map(preferenceIdentity)),
+    scopeCounts,
+    truncated: input.truncated,
+  };
+}
+
 function availableKnowledgeProjection(knowledge: KnowledgeProjectionInput) {
   const inventory = knowledge.documents;
   const selectedBases = inventory.bases.slice(0, WORKSPACE_STATE_MAX_BASES);
@@ -402,6 +423,7 @@ function availableKnowledgeProjection(knowledge: KnowledgeProjectionInput) {
     inspectedVisibleDocumentCount,
     documentStatusCounts: aggregateStatuses,
     sourceKindCounts: aggregateSources,
+    authorityKindCounts: { ...inventory.authorityKindCounts },
     topics,
     topicsTruncated: inventory.topicsTruncated || sortedTopics.length > topics.length,
     latestDocumentUpdatedAt: inventory.latestUpdatedAt,
@@ -432,6 +454,7 @@ export function projectWorkspaceState(
       attemptGovernance: attemptGovernanceProjection(input),
     },
     policy: policyProjection(input),
+    preferences: preferenceProjection(input.preferences),
     knowledge: input.knowledge
       ? availableKnowledgeProjection(input.knowledge)
       : {