@opengeni/api-router 0.21.9 → 0.21.11

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createAppComposition,
   startSlackInteractionPump
-} from "./chunk-BESOWOUQ.js";
+} from "./chunk-J4JS2F7L.js";
 
 // src/index.ts
 import {

package/dist/integrations/social-api.d.ts

@@ -22,6 +22,7 @@ type SocialApiDeps = {
 type ConnectionRef = {
     workspaceId: string;
     connectionId: string;
+    subjectId?: string | null;
 };
 export declare function socialSearchLive(deps: SocialApiDeps, ref: ConnectionRef, input: {
     query: string;

package/dist/integrations/social-oauth.d.ts

@@ -71,6 +71,7 @@ export declare function completeSocialOAuthCallback(deps: SocialOAuthDeps, input
 export declare function freshSocialAccessToken(deps: SocialOAuthDeps, ref: {
     workspaceId: string;
     connectionId: string;
+    subjectId?: string | null;
 }): Promise<{
     connection: SocialConnection;
     bundle: SocialCredentialBundle;
@@ -78,6 +79,7 @@ export declare function freshSocialAccessToken(deps: SocialOAuthDeps, ref: {
 export declare function markNeedsReauth(deps: SocialOAuthDeps, ref: {
     workspaceId: string;
     connectionId: string;
+    subjectId?: string | null;
 }): Promise<void>;
 export declare function parseSocialCredentialBundle(raw: string): SocialCredentialBundle;
 export declare function socialTokenNeedsRefresh(bundle: SocialCredentialBundle, now: Date): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "0.21.9",
+  "version": "0.21.11",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,17 +44,17 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opengeni/agent-proto": "^0.3.0",
     "@opengeni/codex": "^0.2.10",
-    "@opengeni/config": "^0.10.11",
-    "@opengeni/contracts": "^0.38.1",
-    "@opengeni/core": "^0.20.11",
-    "@opengeni/db": "^0.27.8",
-    "@opengeni/documents": "^0.5.4",
-    "@opengeni/events": "^0.3.74",
-    "@opengeni/github": "^0.4.27",
+    "@opengeni/config": "^0.10.12",
+    "@opengeni/contracts": "^0.38.2",
+    "@opengeni/core": "^0.20.13",
+    "@opengeni/db": "^0.27.9",
+    "@opengeni/documents": "^0.5.5",
+    "@opengeni/events": "^0.3.75",
+    "@opengeni/github": "^0.4.28",
     "@opengeni/network": "^0.2.0",
-    "@opengeni/observability": "^0.4.14",
-    "@opengeni/runtime": "^0.18.10",
-    "@opengeni/storage": "^0.2.64",
+    "@opengeni/observability": "^0.4.15",
+    "@opengeni/runtime": "^0.18.12",
+    "@opengeni/storage": "^0.2.65",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/integrations/social-api.ts

@@ -35,7 +35,7 @@ type SocialApiDeps = {
   providerFetch?: SocialProviderFetch | undefined;
 };
 
-type ConnectionRef = { workspaceId: string; connectionId: string };
+type ConnectionRef = { workspaceId: string; connectionId: string; subjectId?: string | null };
 
 const MAX_LIVE_RESULTS = 50;
 

package/src/integrations/social-oauth.ts

@@ -141,6 +141,7 @@ type SocialOAuthStatePayload = {
   accountId: string;
   workspaceId: string;
   subjectId: string;
+  ownership: "workspace" | "personal";
   provider: SocialOAuthProviderId;
   scopes: string[];
   encryptedPkceVerifier?: string;
@@ -190,6 +191,7 @@ export async function startSocialOAuth(
     accountId: context.accountId,
     workspaceId: context.workspaceId,
     subjectId: context.subjectId,
+    ownership: context.payload.ownership,
     provider: provider.id,
     scopes,
     ...(verifier && key ? { encryptedPkceVerifier: encryptEnvironmentValue(key, verifier) } : {}),
@@ -276,7 +278,7 @@ export async function completeSocialOAuthCallback(
     if (
       !grant ||
       grant.accountId !== state.accountId ||
-      !hasPermission(grant.permissions, "workspace:admin")
+      (state.ownership === "workspace" && !hasPermission(grant.permissions, "workspace:admin"))
     ) {
       throw new HTTPException(403, {
         message: "OAuth subject no longer has permission to connect social accounts",
@@ -314,6 +316,7 @@ export async function completeSocialOAuthCallback(
     const connection = await upsertSocialOAuthConnection(db, {
       accountId: state.accountId,
       workspaceId: state.workspaceId,
+      subjectId: state.ownership === "personal" ? state.subjectId : null,
       provider: provider.id,
       accountHandle: identity.handle,
       accountName: identity.name ?? null,
@@ -347,10 +350,15 @@ export async function completeSocialOAuthCallback(
  */
 export async function freshSocialAccessToken(
   deps: SocialOAuthDeps,
-  ref: { workspaceId: string; connectionId: string },
+  ref: { workspaceId: string; connectionId: string; subjectId?: string | null },
 ): Promise<{ connection: SocialConnection; bundle: SocialCredentialBundle }> {
   const { db, settings } = deps;
-  const loaded = await loadSocialConnectionCredential(db, ref.workspaceId, ref.connectionId);
+  const loaded = await loadSocialConnectionCredential(
+    db,
+    ref.workspaceId,
+    ref.connectionId,
+    ref.subjectId,
+  );
   if (!loaded) {
     throw new Error(`Social connection not found: ${ref.connectionId}`);
   }
@@ -397,7 +405,12 @@ export async function freshSocialAccessToken(
     // rotates refresh tokens per use, so the loser's token is already spent.
     // Re-read before declaring the connection dead — if another writer
     // persisted a newer bundle, use that instead of flipping needs_reauth.
-    const reloaded = await loadSocialConnectionCredential(db, ref.workspaceId, ref.connectionId);
+    const reloaded = await loadSocialConnectionCredential(
+      db,
+      ref.workspaceId,
+      ref.connectionId,
+      ref.subjectId,
+    );
     if (
       reloaded?.credentialEncrypted &&
       reloaded.credentialEncrypted !== loaded.credentialEncrypted
@@ -429,6 +442,7 @@ export async function freshSocialAccessToken(
     (await updateSocialConnectionCredential(db, {
       workspaceId: ref.workspaceId,
       connectionId: ref.connectionId,
+      ...(ref.subjectId !== undefined ? { subjectId: ref.subjectId } : {}),
       credentialEncrypted: encryptEnvironmentValue(key, JSON.stringify(refreshed)),
       status: "connected",
       tokenMetadata: publicTokenMetadata(refreshed),
@@ -438,11 +452,12 @@ export async function freshSocialAccessToken(
 
 export async function markNeedsReauth(
   deps: SocialOAuthDeps,
-  ref: { workspaceId: string; connectionId: string },
+  ref: { workspaceId: string; connectionId: string; subjectId?: string | null },
 ): Promise<void> {
   await updateSocialConnectionCredential(deps.db, {
     workspaceId: ref.workspaceId,
     connectionId: ref.connectionId,
+    ...(ref.subjectId !== undefined ? { subjectId: ref.subjectId } : {}),
     status: "needs_reauth",
   });
 }
@@ -671,6 +686,7 @@ function readSocialOAuthState(
     accountId: requiredStateString(payload.accountId, "accountId"),
     workspaceId: requiredStateString(payload.workspaceId, "workspaceId"),
     subjectId: requiredStateString(payload.subjectId, "subjectId"),
+    ownership: payload.ownership === "personal" ? "personal" : "workspace",
     provider,
     scopes: Array.isArray(payload.scopes)
       ? payload.scopes.filter((scope): scope is string => typeof scope === "string")

package/src/mcp/server.ts

@@ -55,7 +55,6 @@ import {
   listRigs,
   listRigChangeMonitoringSummaries,
   listRigVersionMonitoringSummaries,
-  listSocialConnections,
   listSocialPosts,
   recordAuditEvent,
   recordSyncedSocialPosts,
@@ -99,6 +98,7 @@ import type { ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
 import * as z4 from "zod/v4";
 import {
   hasPermission,
+  authorizedSocialConnectionsForGrant,
   requireSessionAuthorization,
   requireSessionAuthorizationListScope,
   type ResolvedSessionAuthorization,
@@ -360,6 +360,20 @@ export function buildOpenGeniMcpServer(
   });
   const can = (permission: Permission) => hasPermission(grant.permissions, permission);
   const toolspaceMode = options.toolspace != null;
+  let socialConnectionsPromise: ReturnType<typeof authorizedSocialConnectionsForGrant> | undefined;
+  const authorizedSocialConnections = () =>
+    (socialConnectionsPromise ??= authorizedSocialConnectionsForGrant({
+      db: deps.db,
+      grant,
+      limit: 500,
+    }));
+  const requireAuthorizedSocialConnection = async (connectionId: string) => {
+    const authority = (await authorizedSocialConnections()).find(
+      ({ connection }) => connection.id === connectionId,
+    );
+    if (!authority) throw new Error(`Unknown or unavailable social connection: ${connectionId}`);
+    return authority;
+  };
 
   // Session-scoped tools key off the worker-asserted sessionId claim (signed
   // into the delegated token by the worker, never agent-controlled).
@@ -490,11 +504,9 @@ export function buildOpenGeniMcpServer(
       },
       async ({ limit }) =>
         json({
-          connections: await listSocialConnections(
-            deps.db,
-            grant.workspaceId,
-            boundedMcpLimit(limit),
-          ),
+          connections: (await authorizedSocialConnections())
+            .slice(0, boundedMcpLimit(limit))
+            .map(({ connection }) => connection),
         }),
     );
 
@@ -510,6 +522,15 @@ export function buildOpenGeniMcpServer(
         },
       },
       async ({ connectionIds, since, windowHours, limit }) => {
+        const authorized = await authorizedSocialConnections();
+        const selected = connectionIds?.length
+          ? connectionIds.map((id) => {
+              const match = authorized.find(({ connection }) => connection.id === id);
+              if (!match) throw new Error(`Unknown or unavailable social connection: ${id}`);
+              return match;
+            })
+          : authorized;
+        const personalSubjectId = selected.find(({ subjectId }) => subjectId)?.subjectId ?? null;
         const sinceDate = since
           ? parseMcpDate(since, "since")
           : new Date(Date.now() - (windowHours ?? 24) * 60 * 60 * 1000);
@@ -517,7 +538,8 @@ export function buildOpenGeniMcpServer(
           since: sinceDate.toISOString(),
           posts: await listSocialPosts(deps.db, {
             workspaceId: grant.workspaceId,
-            ...(connectionIds?.length ? { connectionIds } : {}),
+            subjectId: personalSubjectId,
+            connectionIds: selected.map(({ connection }) => connection.id),
             since: sinceDate,
             limit: boundedMcpLimit(limit),
           }),
@@ -539,7 +561,8 @@ export function buildOpenGeniMcpServer(
         },
       },
       async ({ connectionIds, documentBaseIds, since, windowHours, limit }) => {
-        const allConnections = await listSocialConnections(deps.db, grant.workspaceId, 500);
+        const authorized = await authorizedSocialConnections();
+        const allConnections = authorized.map(({ connection }) => connection);
         const selectedIds =
           connectionIds && connectionIds.length > 0 ? new Set(connectionIds) : null;
         const connections = selectedIds
@@ -559,6 +582,11 @@ export function buildOpenGeniMcpServer(
           connections.length > 0
             ? await listSocialPosts(deps.db, {
                 workspaceId: grant.workspaceId,
+                subjectId:
+                  authorized.find(
+                    ({ connection, subjectId }) =>
+                      subjectId && connections.some((selected) => selected.id === connection.id),
+                  )?.subjectId ?? null,
                 connectionIds: connections.map((connection) => connection.id),
                 since: sinceDate,
                 limit: boundedMcpLimit(limit),
@@ -597,9 +625,10 @@ export function buildOpenGeniMcpServer(
         },
       },
       async ({ connectionId, query, subreddit, limit }) => {
+        const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialSearchLive(
           deps,
-          { workspaceId: grant.workspaceId, connectionId },
+          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
           { query, subreddit, limit },
         );
         return json({ provider: result.connection.provider, posts: result.posts });
@@ -618,9 +647,10 @@ export function buildOpenGeniMcpServer(
         },
       },
       async ({ connectionId, sinceId, limit }) => {
+        const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialMentionsLive(
           deps,
-          { workspaceId: grant.workspaceId, connectionId },
+          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
           { sinceId, limit },
         );
         return json({ provider: result.connection.provider, posts: result.posts });
@@ -639,9 +669,10 @@ export function buildOpenGeniMcpServer(
         },
       },
       async ({ connectionId, id, limit }) => {
+        const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialThreadLive(
           deps,
-          { workspaceId: grant.workspaceId, connectionId },
+          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
           { id, limit },
         );
         return json({ provider: result.connection.provider, posts: result.posts });
@@ -664,9 +695,10 @@ export function buildOpenGeniMcpServer(
         },
       },
       async ({ connectionId, limit }) => {
+        const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialOwnPostsLive(
           deps,
-          { workspaceId: grant.workspaceId, connectionId },
+          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
           { limit },
         );
         // A post without a provider timestamp is skipped rather than recorded
@@ -677,6 +709,7 @@ export function buildOpenGeniMcpServer(
           accountId: grant.accountId,
           workspaceId: grant.workspaceId,
           connectionId,
+          subjectId: authority.subjectId,
           posts: datedPosts.map((post) => ({
             externalPostId: post.id,
             url: post.url,
@@ -708,9 +741,10 @@ export function buildOpenGeniMcpServer(
         },
       },
       async ({ connectionId, inReplyToId, text }) => {
+        const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialPostReply(
           deps,
-          { workspaceId: grant.workspaceId, connectionId },
+          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
           { inReplyToId, text },
         );
         // Outbound publishes leave a durable, secret-free receipt (house

package/src/routes/capabilities.ts

@@ -22,9 +22,11 @@ export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/capabilities", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
     return c.json(
-      CapabilityCatalogResponse.parse(await buildCapabilityCatalog({ db, workspaceId, settings })),
+      CapabilityCatalogResponse.parse(
+        await buildCapabilityCatalog({ db, workspaceId, settings, subjectId: grant.subjectId }),
+      ),
     );
   });
 

package/src/routes/packs.ts

@@ -187,7 +187,12 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
         action: "schedule:create",
         quantity: 1,
       });
-      const connections = await resolveSocialConnections(db, workspaceId, payload.connectionIds);
+      const connections = await resolveSocialConnections(
+        db,
+        workspaceId,
+        payload.connectionIds,
+        grant.subjectId,
+      );
       if (connections.length === 0) {
         throw new HTTPException(422, {
           message: "at least one connected social account is required",
@@ -254,20 +259,21 @@ async function resolveSocialConnections(
   db: ApiRouteDeps["db"],
   workspaceId: string,
   connectionIds: string[],
+  subjectId: string,
 ): Promise<SocialConnection[]> {
   const ids = [...new Set(connectionIds)];
   const connections =
     ids.length > 0
       ? await Promise.all(
           ids.map(async (id) => {
-            const connection = await getSocialConnection(db, workspaceId, id);
+            const connection = await getSocialConnection(db, workspaceId, id, subjectId);
             if (!connection) {
               throw new HTTPException(422, { message: `unknown social connection: ${id}` });
             }
             return connection;
           }),
         )
-      : (await listSocialConnections(db, workspaceId, 500)).filter(
+      : (await listSocialConnections(db, workspaceId, 500, subjectId)).filter(
           (connection) => connection.status === "connected",
         );
   const inactive = connections.find((connection) => connection.status !== "connected");

package/src/routes/social.ts

@@ -7,6 +7,7 @@ import {
 import {
   createSocialConnection,
   createSocialPost,
+  getSocialConnection,
   listSocialConnections,
   listSocialPosts,
   updateSocialConnectionCredential,
@@ -24,8 +25,15 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/social/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    return c.json(await listSocialConnections(db, workspaceId, boundedLimit(c.req.query("limit"))));
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    return c.json(
+      await listSocialConnections(
+        db,
+        workspaceId,
+        boundedLimit(c.req.query("limit")),
+        grant.subjectId,
+      ),
+    );
   });
 
   app.post("/v1/workspaces/:workspaceId/social/connections", async (c) => {
@@ -59,10 +67,16 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
   // reconnecting via the OAuth flow revives it.
   app.delete("/v1/workspaces/:workspaceId/social/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const connectionId = c.req.param("connectionId");
+    const existing = await getSocialConnection(db, workspaceId, connectionId, grant.subjectId);
+    if (!existing) throw new HTTPException(404, { message: "social connection not found" });
+    if (existing.ownership === "workspace")
+      await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     const connection = await updateSocialConnectionCredential(db, {
       workspaceId,
-      connectionId: c.req.param("connectionId"),
+      connectionId,
+      subjectId: existing.ownership === "personal" ? grant.subjectId : null,
       credentialEncrypted: null,
       status: "disabled",
       tokenMetadata: {},
@@ -78,7 +92,6 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
   // callback is unauthenticated (browser redirect) but bound by signed state.
   app.post("/v1/workspaces/:workspaceId/social/oauth/start", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     const parsed = SocialOAuthStartRequest.safeParse(await c.req.json());
     if (!parsed.success) {
       throw new HTTPException(400, {
@@ -86,6 +99,12 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
       });
     }
     const payload = parsed.data;
+    const grant = await requireAccessGrant(
+      c,
+      deps,
+      workspaceId,
+      payload.ownership === "workspace" ? "workspace:admin" : "workspace:read",
+    );
     const result = await startSocialOAuth(
       { db, settings, observability },
       {
@@ -114,7 +133,7 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/social/posts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
     const since = parseSince(c.req.query("since"));
     const connectionIds = parseConnectionIds(
       c.req.query("connectionIds") ?? c.req.query("connectionId"),
@@ -122,6 +141,7 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.json(
       await listSocialPosts(db, {
         workspaceId,
+        subjectId: grant.subjectId,
         ...(connectionIds?.length ? { connectionIds } : {}),
         ...(since ? { since } : {}),
         limit: boundedLimit(c.req.query("limit")),
@@ -138,6 +158,7 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
         await createSocialPost(db, {
           accountId: grant.accountId,
           workspaceId,
+          subjectId: grant.subjectId,
           connectionId: payload.connectionId,
           externalPostId: payload.externalPostId ?? null,
           url: payload.url ?? null,