@opengeni/api-router 0.21.9 → 0.21.10

package/dist/app.js

@@ -22,7 +22,7 @@ import {
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession
-} from "./chunk-BESOWOUQ.js";
+} from "./chunk-J4JS2F7L.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,

package/dist/{chunk-BESOWOUQ.js → chunk-J4JS2F7L.js}

@@ -357,7 +357,6 @@ import {
   listRigs,
   listRigChangeMonitoringSummaries,
   listRigVersionMonitoringSummaries,
-  listSocialConnections,
   listSocialPosts,
   recordAuditEvent as recordAuditEvent2,
   recordSyncedSocialPosts,
@@ -397,6 +396,7 @@ import {
 import * as z4 from "zod/v4";
 import {
   hasPermission as hasPermission4,
+  authorizedSocialConnectionsForGrant,
   requireSessionAuthorization,
   requireSessionAuthorizationListScope
 } from "@opengeni/core";
@@ -2227,6 +2227,7 @@ async function startSocialOAuth(deps, context) {
     accountId: context.accountId,
     workspaceId: context.workspaceId,
     subjectId: context.subjectId,
+    ownership: context.payload.ownership,
     provider: provider.id,
     scopes,
     ...verifier && key ? { encryptedPkceVerifier: encryptEnvironmentValue2(key, verifier) } : {},
@@ -2294,7 +2295,7 @@ async function completeSocialOAuthCallback(deps, input) {
   }
   try {
     const grant = await getWorkspaceGrant2(db, state.subjectId, state.workspaceId);
-    if (!grant || grant.accountId !== state.accountId || !hasPermission3(grant.permissions, "workspace:admin")) {
+    if (!grant || grant.accountId !== state.accountId || state.ownership === "workspace" && !hasPermission3(grant.permissions, "workspace:admin")) {
       throw new HTTPException4(403, {
         message: "OAuth subject no longer has permission to connect social accounts"
       });
@@ -2329,6 +2330,7 @@ async function completeSocialOAuthCallback(deps, input) {
     const connection = await upsertSocialOAuthConnection(db, {
       accountId: state.accountId,
       workspaceId: state.workspaceId,
+      subjectId: state.ownership === "personal" ? state.subjectId : null,
       provider: provider.id,
       accountHandle: identity.handle,
       accountName: identity.name ?? null,
@@ -2355,7 +2357,12 @@ async function completeSocialOAuthCallback(deps, input) {
 }
 async function freshSocialAccessToken(deps, ref) {
   const { db, settings } = deps;
-  const loaded = await loadSocialConnectionCredential(db, ref.workspaceId, ref.connectionId);
+  const loaded = await loadSocialConnectionCredential(
+    db,
+    ref.workspaceId,
+    ref.connectionId,
+    ref.subjectId
+  );
   if (!loaded) {
     throw new Error(`Social connection not found: ${ref.connectionId}`);
   }
@@ -2396,7 +2403,12 @@ async function freshSocialAccessToken(deps, ref) {
         { cause: error }
       );
     }
-    const reloaded = await loadSocialConnectionCredential(db, ref.workspaceId, ref.connectionId);
+    const reloaded = await loadSocialConnectionCredential(
+      db,
+      ref.workspaceId,
+      ref.connectionId,
+      ref.subjectId
+    );
     if (reloaded?.credentialEncrypted && reloaded.credentialEncrypted !== loaded.credentialEncrypted) {
       const winner = parseSocialCredentialBundle(
         decryptEnvironmentValue2(key, reloaded.credentialEncrypted)
@@ -2424,6 +2436,7 @@ async function freshSocialAccessToken(deps, ref) {
   const connection = await updateSocialConnectionCredential(db, {
     workspaceId: ref.workspaceId,
     connectionId: ref.connectionId,
+    ...ref.subjectId !== void 0 ? { subjectId: ref.subjectId } : {},
     credentialEncrypted: encryptEnvironmentValue2(key, JSON.stringify(refreshed)),
     status: "connected",
     tokenMetadata: publicTokenMetadata(refreshed)
@@ -2434,6 +2447,7 @@ async function markNeedsReauth(deps, ref) {
   await updateSocialConnectionCredential(deps.db, {
     workspaceId: ref.workspaceId,
     connectionId: ref.connectionId,
+    ...ref.subjectId !== void 0 ? { subjectId: ref.subjectId } : {},
     status: "needs_reauth"
   });
 }
@@ -2616,6 +2630,7 @@ function readSocialOAuthState(raw, settings) {
     accountId: requiredStateString(payload.accountId, "accountId"),
     workspaceId: requiredStateString(payload.workspaceId, "workspaceId"),
     subjectId: requiredStateString(payload.subjectId, "subjectId"),
+    ownership: payload.ownership === "personal" ? "personal" : "workspace",
     provider,
     scopes: Array.isArray(payload.scopes) ? payload.scopes.filter((scope) => typeof scope === "string") : [],
     ...typeof payload.encryptedPkceVerifier === "string" ? { encryptedPkceVerifier: payload.encryptedPkceVerifier } : {},
@@ -6337,6 +6352,19 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
   });
   const can = (permission) => hasPermission4(grant.permissions, permission);
   const toolspaceMode = options.toolspace != null;
+  let socialConnectionsPromise;
+  const authorizedSocialConnections = () => socialConnectionsPromise ??= authorizedSocialConnectionsForGrant({
+    db: deps.db,
+    grant,
+    limit: 500
+  });
+  const requireAuthorizedSocialConnection = async (connectionId) => {
+    const authority = (await authorizedSocialConnections()).find(
+      ({ connection }) => connection.id === connectionId
+    );
+    if (!authority) throw new Error(`Unknown or unavailable social connection: ${connectionId}`);
+    return authority;
+  };
   const sessionId = typeof grant.metadata?.["sessionId"] === "string" ? grant.metadata["sessionId"] : null;
   const selectedTools = sessionId !== null && !toolspaceMode ? new Set(
     grant.metadata?.["firstPartyMcpTools"] ?? DEFAULT_FIRST_PARTY_MCP_TOOLS
@@ -6422,11 +6450,7 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
         inputSchema: { limit: z4.number().int().positive().optional() }
       },
       async ({ limit }) => json({
-        connections: await listSocialConnections(
-          deps.db,
-          grant.workspaceId,
-          boundedMcpLimit(limit)
-        )
+        connections: (await authorizedSocialConnections()).slice(0, boundedMcpLimit(limit)).map(({ connection }) => connection)
       })
     );
     server.registerTool(
@@ -6441,12 +6465,20 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
         }
       },
       async ({ connectionIds, since, windowHours, limit }) => {
+        const authorized = await authorizedSocialConnections();
+        const selected = connectionIds?.length ? connectionIds.map((id) => {
+          const match = authorized.find(({ connection }) => connection.id === id);
+          if (!match) throw new Error(`Unknown or unavailable social connection: ${id}`);
+          return match;
+        }) : authorized;
+        const personalSubjectId = selected.find(({ subjectId }) => subjectId)?.subjectId ?? null;
         const sinceDate = since ? parseMcpDate(since, "since") : new Date(Date.now() - (windowHours ?? 24) * 60 * 60 * 1e3);
         return json({
           since: sinceDate.toISOString(),
           posts: await listSocialPosts(deps.db, {
             workspaceId: grant.workspaceId,
-            ...connectionIds?.length ? { connectionIds } : {},
+            subjectId: personalSubjectId,
+            connectionIds: selected.map(({ connection }) => connection.id),
             since: sinceDate,
             limit: boundedMcpLimit(limit)
           })
@@ -6466,7 +6498,8 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
         }
       },
       async ({ connectionIds, documentBaseIds, since, windowHours, limit }) => {
-        const allConnections = await listSocialConnections(deps.db, grant.workspaceId, 500);
+        const authorized = await authorizedSocialConnections();
+        const allConnections = authorized.map(({ connection }) => connection);
         const selectedIds = connectionIds && connectionIds.length > 0 ? new Set(connectionIds) : null;
         const connections = selectedIds ? allConnections.filter((connection) => selectedIds.has(connection.id)) : allConnections.filter((connection) => connection.status === "connected");
         if (selectedIds) {
@@ -6479,6 +6512,9 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
         const sinceDate = since ? parseMcpDate(since, "since") : new Date(Date.now() - (windowHours ?? 24) * 60 * 60 * 1e3);
         const posts = connections.length > 0 ? await listSocialPosts(deps.db, {
           workspaceId: grant.workspaceId,
+          subjectId: authorized.find(
+            ({ connection, subjectId }) => subjectId && connections.some((selected) => selected.id === connection.id)
+          )?.subjectId ?? null,
           connectionIds: connections.map((connection) => connection.id),
           since: sinceDate,
           limit: boundedMcpLimit(limit)
@@ -6512,9 +6548,10 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
         }
       },
       async ({ connectionId, query, subreddit, limit }) => {
+        const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialSearchLive(
           deps,
-          { workspaceId: grant.workspaceId, connectionId },
+          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
           { query, subreddit, limit }
         );
         return json({ provider: result.connection.provider, posts: result.posts });
@@ -6531,9 +6568,10 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
         }
       },
       async ({ connectionId, sinceId, limit }) => {
+        const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialMentionsLive(
           deps,
-          { workspaceId: grant.workspaceId, connectionId },
+          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
           { sinceId, limit }
         );
         return json({ provider: result.connection.provider, posts: result.posts });
@@ -6550,9 +6588,10 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
         }
       },
       async ({ connectionId, id, limit }) => {
+        const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialThreadLive(
           deps,
-          { workspaceId: grant.workspaceId, connectionId },
+          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
           { id, limit }
         );
         return json({ provider: result.connection.provider, posts: result.posts });
@@ -6570,9 +6609,10 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
         }
       },
       async ({ connectionId, limit }) => {
+        const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialOwnPostsLive(
           deps,
-          { workspaceId: grant.workspaceId, connectionId },
+          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
           { limit }
         );
         const datedPosts = result.posts.filter((post) => post.createdAt !== null);
@@ -6580,6 +6620,7 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
           accountId: grant.accountId,
           workspaceId: grant.workspaceId,
           connectionId,
+          subjectId: authority.subjectId,
           posts: datedPosts.map((post) => ({
             externalPostId: post.id,
             url: post.url,
@@ -6609,9 +6650,10 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
         }
       },
       async ({ connectionId, inReplyToId, text }) => {
+        const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialPostReply(
           deps,
-          { workspaceId: grant.workspaceId, connectionId },
+          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
           { inReplyToId, text }
         );
         await recordAuditEvent2(deps.db, {
@@ -9950,9 +9992,11 @@ function registerCapabilityRoutes(app, deps) {
   const { db, settings } = deps;
   app.get("/v1/workspaces/:workspaceId/capabilities", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
     return c.json(
-      CapabilityCatalogResponse.parse(await buildCapabilityCatalog({ db, workspaceId, settings }))
+      CapabilityCatalogResponse.parse(
+        await buildCapabilityCatalog({ db, workspaceId, settings, subjectId: grant.subjectId })
+      )
     );
   });
   app.post("/v1/workspaces/:workspaceId/capabilities", async (c) => {
@@ -16668,7 +16712,7 @@ import {
   getWorkspacePack,
   getSocialConnection,
   listPackInstallations,
-  listSocialConnections as listSocialConnections2,
+  listSocialConnections,
   registerWorkspacePack,
   updatePackInstallationStatus
 } from "@opengeni/db";
@@ -16813,7 +16857,12 @@ function registerPackRoutes(app, deps) {
         action: "schedule:create",
         quantity: 1
       });
-      const connections = await resolveSocialConnections(db, workspaceId, payload.connectionIds);
+      const connections = await resolveSocialConnections(
+        db,
+        workspaceId,
+        payload.connectionIds,
+        grant.subjectId
+      );
       if (connections.length === 0) {
         throw new HTTPException21(422, {
           message: "at least one connected social account is required"
@@ -16866,17 +16915,17 @@ async function requirePack(db, workspaceId, packId) {
   }
   return pack;
 }
-async function resolveSocialConnections(db, workspaceId, connectionIds) {
+async function resolveSocialConnections(db, workspaceId, connectionIds, subjectId) {
   const ids = [...new Set(connectionIds)];
   const connections = ids.length > 0 ? await Promise.all(
     ids.map(async (id) => {
-      const connection = await getSocialConnection(db, workspaceId, id);
+      const connection = await getSocialConnection(db, workspaceId, id, subjectId);
       if (!connection) {
         throw new HTTPException21(422, { message: `unknown social connection: ${id}` });
       }
       return connection;
     })
-  ) : (await listSocialConnections2(db, workspaceId, 500)).filter(
+  ) : (await listSocialConnections(db, workspaceId, 500, subjectId)).filter(
     (connection) => connection.status === "connected"
   );
   const inactive = connections.find((connection) => connection.status !== "connected");
@@ -21471,7 +21520,8 @@ import {
 import {
   createSocialConnection,
   createSocialPost,
-  listSocialConnections as listSocialConnections3,
+  getSocialConnection as getSocialConnection2,
+  listSocialConnections as listSocialConnections2,
   listSocialPosts as listSocialPosts2,
   updateSocialConnectionCredential as updateSocialConnectionCredential2
 } from "@opengeni/db";
@@ -21482,8 +21532,15 @@ function registerSocialRoutes(app, deps) {
   const { db, settings, observability } = deps;
   app.get("/v1/workspaces/:workspaceId/social/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant15(c, deps, workspaceId, "workspace:read");
-    return c.json(await listSocialConnections3(db, workspaceId, boundedLimit(c.req.query("limit"))));
+    const grant = await requireAccessGrant15(c, deps, workspaceId, "workspace:read");
+    return c.json(
+      await listSocialConnections2(
+        db,
+        workspaceId,
+        boundedLimit(c.req.query("limit")),
+        grant.subjectId
+      )
+    );
   });
   app.post("/v1/workspaces/:workspaceId/social/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -21512,10 +21569,16 @@ function registerSocialRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/social/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant15(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant15(c, deps, workspaceId, "workspace:read");
+    const connectionId = c.req.param("connectionId");
+    const existing = await getSocialConnection2(db, workspaceId, connectionId, grant.subjectId);
+    if (!existing) throw new HTTPException26(404, { message: "social connection not found" });
+    if (existing.ownership === "workspace")
+      await requireAccessGrant15(c, deps, workspaceId, "workspace:admin");
     const connection = await updateSocialConnectionCredential2(db, {
       workspaceId,
-      connectionId: c.req.param("connectionId"),
+      connectionId,
+      subjectId: existing.ownership === "personal" ? grant.subjectId : null,
       credentialEncrypted: null,
       status: "disabled",
       tokenMetadata: {}
@@ -21527,7 +21590,6 @@ function registerSocialRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/social/oauth/start", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant15(c, deps, workspaceId, "workspace:admin");
     const parsed = SocialOAuthStartRequest.safeParse(await c.req.json());
     if (!parsed.success) {
       throw new HTTPException26(400, {
@@ -21535,6 +21597,12 @@ function registerSocialRoutes(app, deps) {
       });
     }
     const payload = parsed.data;
+    const grant = await requireAccessGrant15(
+      c,
+      deps,
+      workspaceId,
+      payload.ownership === "workspace" ? "workspace:admin" : "workspace:read"
+    );
     const result = await startSocialOAuth(
       { db, settings, observability },
       {
@@ -21561,7 +21629,7 @@ function registerSocialRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/social/posts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant15(c, deps, workspaceId, "workspace:read");
+    const grant = await requireAccessGrant15(c, deps, workspaceId, "workspace:read");
     const since = parseSince(c.req.query("since"));
     const connectionIds = parseConnectionIds(
       c.req.query("connectionIds") ?? c.req.query("connectionId")
@@ -21569,6 +21637,7 @@ function registerSocialRoutes(app, deps) {
     return c.json(
       await listSocialPosts2(db, {
         workspaceId,
+        subjectId: grant.subjectId,
         ...connectionIds?.length ? { connectionIds } : {},
         ...since ? { since } : {},
         limit: boundedLimit(c.req.query("limit"))
@@ -21584,6 +21653,7 @@ function registerSocialRoutes(app, deps) {
         await createSocialPost(db, {
           accountId: grant.accountId,
           workspaceId,
+          subjectId: grant.subjectId,
           connectionId: payload.connectionId,
           externalPostId: payload.externalPostId ?? null,
           url: payload.url ?? null,
@@ -26547,4 +26617,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession2 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-BESOWOUQ.js.map
+//# sourceMappingURL=chunk-J4JS2F7L.js.map