@opengeni/api-router 0.22.2 → 0.26.1

package/src/routes/connections.ts

@@ -1,8 +1,19 @@
 import { createHash } from "node:crypto";
 import {
+  ATLASSIAN_PROVIDER_DOMAIN,
+  AtlassianConnectionMetadata,
+  AtlassianDisconnectRequest,
+  AtlassianLifecycleActionRequest,
+  AtlassianOAuthStartRequest,
+  AtlassianOAuthStartResponse,
+} from "@opengeni/contracts/atlassian";
+import {
+  API_INTEGRATION_OAUTH_CREDENTIAL_ROLE,
+  ApiIntegrationOAuthStartRequest,
   ConnectionResponse,
   CreateConnectionRequest,
   IntegrationClientMetadata,
+  ListSlackInstallationBindingsResponse,
   ListConnectionsResponse,
   OpenGeniSlackBotInstallRequest,
   OpenGeniSlackBotInstallStart,
@@ -10,6 +21,10 @@ import {
   OAuthStartResponse,
   UpdateConnectionRequest,
 } from "@opengeni/contracts";
+import {
+  bindConnectorDocumentDestination,
+  ConnectorDocumentDestinationSelection,
+} from "@opengeni/contracts/connector-destinations";
 import {
   GOOGLE_DRIVE_PROVIDER_DOMAIN,
   GoogleDriveConnectionMetadata,
@@ -30,17 +45,19 @@ import {
 import {
   consumeIntegrationOAuthStateNonce,
   createConnection,
-  createConnectionWithSlackBotSuccessAudit,
   encryptEnvironmentValue,
   getConnectionMetadata,
   getWorkspaceGrant,
   listConnectionsMetadata,
+  listSlackInstallationBindings,
+  persistSlackBotInstallationWithSuccessAudit,
   recordSlackBotInstallCallbackFailure,
   revokeConnection,
   revokeConnectionWithSlackBotSuccessAudit,
   SlackBotLifecycleSuccessAuditError,
+  SlackInstallationBindingConflictError,
   updateConnection,
-  updateConnectionWithSlackBotSuccessAudit,
+  updateSlackBotDocumentDestination,
   type SlackBotInstallCallbackFailureReason,
   type SlackBotInstallCallbackFailureStage,
 } from "@opengeni/db";
@@ -55,6 +72,19 @@ import {
   startGoogleDriveOAuth,
   transitionGoogleDriveLifecycle,
 } from "../integrations/google-drive";
+import {
+  completeApiIntegrationProviderOAuth,
+  isApiIntegrationProviderOAuthState,
+  startApiIntegrationProviderOAuth,
+} from "../integrations/provider-oauth";
+import {
+  browseAtlassianSources,
+  completeAtlassianOAuthCallback,
+  disconnectAtlassian,
+  saveAtlassianSources,
+  startAtlassianOAuth,
+  transitionAtlassianLifecycle,
+} from "../integrations/atlassian";
 import {
   completeMcpOAuthCallback,
   integrationBaseUrl,
@@ -104,16 +134,31 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
   });
 
+  app.get("/v1/workspaces/:workspaceId/connections/slack-bot/bindings", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
+    return c.json(
+      ListSlackInstallationBindingsResponse.parse({
+        bindings: await listSlackInstallationBindings(db, {
+          accountId: grant.accountId,
+          workspaceId,
+        }),
+      }),
+    );
+  });
+
   app.post("/v1/workspaces/:workspaceId/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
     const payload = CreateConnectionRequest.parse(await c.req.json());
     assertNotReservedSlackBotMetadata(payload.metadata);
+    assertNotReservedApiIntegrationOAuthMetadata(payload.metadata);
     const key = requireEnvironmentEncryption(settings);
     const subjectId = createConnectionSubjectId(payload, grant.subjectId);
     const providerDomain = canonicalProviderDomain(payload.providerDomain);
     assertNotDirectPersonalSlackOAuth(providerDomain, payload.kind);
     assertNotDirectGoogleDriveOAuth(providerDomain, payload.kind, payload.metadata);
+    assertNotDirectAtlassianOAuth(providerDomain, payload.kind, payload.metadata);
     const connection = await createConnection(db, {
       accountId: grant.accountId,
       workspaceId,
@@ -282,9 +327,30 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
   });
 
-  app.get("/v1/integrations/google-drive/callback", async (c) => {
+  app.post("/v1/workspaces/:workspaceId/connections/atlassian/install", async (c) => {
     assertIntegrationsEnabled();
-    const result = await completeGoogleDriveOAuthCallback(deps, {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    const parsed = AtlassianOAuthStartRequest.safeParse(await c.req.json());
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: "invalid Atlassian install request" });
+    }
+    return c.json(
+      AtlassianOAuthStartResponse.parse(
+        await startAtlassianOAuth(deps, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          requestUrl: c.req.url,
+          payload: parsed.data,
+        }),
+      ),
+    );
+  });
+
+  app.get("/v1/integrations/atlassian/callback", async (c) => {
+    assertIntegrationsEnabled();
+    const result = await completeAtlassianOAuthCallback(deps, {
       ...(c.req.query("code") ? { code: c.req.query("code") } : {}),
       ...(c.req.query("state") ? { state: c.req.query("state") } : {}),
       ...(c.req.query("error") ? { error: c.req.query("error") } : {}),
@@ -293,6 +359,82 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.redirect(result.redirectTo, 302);
   });
 
+  app.patch(
+    "/v1/workspaces/:workspaceId/connections/atlassian/:connectionId/lifecycle",
+    async (c) => {
+      assertIntegrationsEnabled();
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+      const parsed = AtlassianLifecycleActionRequest.safeParse(await c.req.json());
+      if (!parsed.success) {
+        throw new HTTPException(400, { message: "invalid Atlassian lifecycle request" });
+      }
+      return c.json(
+        ConnectionResponse.parse({
+          connection: await transitionAtlassianLifecycle(deps, {
+            workspaceId,
+            subjectId: grant.subjectId,
+            connectionId: c.req.param("connectionId"),
+            payload: parsed.data,
+          }),
+        }),
+      );
+    },
+  );
+
+  app.get("/v1/workspaces/:workspaceId/connections/atlassian/:connectionId/browse", async (c) => {
+    assertIntegrationsEnabled();
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
+    return c.json(
+      await browseAtlassianSources(deps, {
+        workspaceId,
+        subjectId: grant.subjectId,
+        connectionId: c.req.param("connectionId"),
+      }),
+    );
+  });
+
+  app.post("/v1/workspaces/:workspaceId/connections/atlassian/:connectionId/source", async (c) => {
+    assertIntegrationsEnabled();
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "connections:write",
+    );
+    const { grant } = authorization;
+    const connection = await saveAtlassianSources(deps, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      grant,
+      connectionId: c.req.param("connectionId"),
+      payload: await c.req.json(),
+      canManageOrganizationDestination:
+        authorization.accountGrant?.permissions.includes("account:admin") === true,
+      canManageWorkspaceDestination: hasPermission(grant.permissions, "workspace:admin"),
+      canManagePersonalDestination:
+        authorization.contextIntegrity && authorization.authenticatedSubjectId === grant.subjectId,
+    });
+    return c.json(ConnectionResponse.parse({ connection }));
+  });
+
+  app.get("/v1/integrations/google-drive/callback", async (c) => {
+    assertIntegrationsEnabled();
+    const input = {
+      ...(c.req.query("code") ? { code: c.req.query("code") } : {}),
+      ...(c.req.query("state") ? { state: c.req.query("state") } : {}),
+      ...(c.req.query("error") ? { error: c.req.query("error") } : {}),
+      requestUrl: c.req.url,
+    };
+    const result = isApiIntegrationProviderOAuthState(input.state, deps.settings)
+      ? await completeApiIntegrationProviderOAuth(deps, input)
+      : await completeGoogleDriveOAuthCallback(deps, input);
+    return c.redirect(result.redirectTo, 302);
+  });
+
   app.patch(
     "/v1/workspaces/:workspaceId/connections/google-drive/:connectionId/lifecycle",
     async (c) => {
@@ -350,6 +492,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
         accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
+        grant,
         connectionId: c.req.param("connectionId"),
         payload: await c.req.json(),
         canManageOrganizationDestination:
@@ -380,9 +523,16 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.patch("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "connections:write",
+    );
+    const { grant } = authorization;
     const payload = UpdateConnectionRequest.parse(await c.req.json());
     assertNotReservedSlackBotMetadata(payload.metadata);
+    assertNotReservedApiIntegrationOAuthMetadata(payload.metadata);
     const existing = await getConnectionMetadata(
       db,
       workspaceId,
@@ -390,15 +540,85 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       grant.subjectId,
     );
     if (existing && isOpenGeniSlackBotConnection(existing)) {
-      throw new HTTPException(422, {
-        message: "use the dedicated OpenGeni Slack bot reinstall flow to update this connection",
+      const destination = ConnectorDocumentDestinationSelection.safeParse(
+        payload.metadata?.documentDestination,
+      );
+      const destinationOnlyUpdate =
+        payload.metadata !== undefined &&
+        Object.keys(payload.metadata).length === 1 &&
+        payload.providerDomain === undefined &&
+        payload.subjectId === undefined &&
+        payload.kind === undefined &&
+        payload.status === undefined &&
+        payload.credential === undefined &&
+        payload.grantedScopes === undefined &&
+        payload.expiresAt === undefined;
+      if (!destination.success || !destinationOnlyUpdate) {
+        throw new HTTPException(422, {
+          message: "use the dedicated OpenGeni Slack bot reinstall flow to update this connection",
+        });
+      }
+      const destinationSelection = destination.data;
+      if (
+        destinationSelection.authorityKind === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") !== true
+      ) {
+        throw new HTTPException(403, { message: "missing permission: account:admin" });
+      }
+      if (
+        destinationSelection.authorityKind === "workspace" &&
+        !hasPermission(grant.permissions, "workspace:admin")
+      ) {
+        throw new HTTPException(403, { message: "missing permission: workspace:admin" });
+      }
+      if (
+        destinationSelection.authorityKind === "personal" &&
+        (!authorization.contextIntegrity ||
+          authorization.authenticatedSubjectId !== grant.subjectId)
+      ) {
+        throw new HTTPException(403, {
+          message: "personal destination requires the exact actor",
+        });
+      }
+      const metadata = {
+        ...existing.metadata,
+        documentDestination: bindConnectorDocumentDestination(destinationSelection, {
+          accountId: grant.accountId,
+          workspaceId,
+          initiatingSubjectId: grant.subjectId,
+        }),
+      };
+      const connection = await updateSlackBotDocumentDestination(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        connectionId: existing.id,
+        visibleToSubjectId: grant.subjectId,
+        expectedVersion: existing.version,
+        metadata,
+        updatedBySubjectId: grant.subjectId,
       });
+      if (!connection) {
+        throw new HTTPException(409, {
+          message: "Slack bot connection changed; reload before saving its destination",
+        });
+      }
+      return c.json(ConnectionResponse.parse({ connection }));
     }
     if (existing && GoogleDriveConnectionMetadata.safeParse(existing.metadata).success) {
       throw new HTTPException(422, {
         message: "use the dedicated Google Drive reconnect or source-selection flow",
       });
     }
+    if (existing?.metadata.credentialRole === API_INTEGRATION_OAUTH_CREDENTIAL_ROLE) {
+      throw new HTTPException(422, {
+        message: "use the dedicated Integration provider OAuth flow to update this connection",
+      });
+    }
+    if (existing && AtlassianConnectionMetadata.safeParse(existing.metadata).success) {
+      throw new HTTPException(422, {
+        message: "use the dedicated Atlassian reconnect or source-selection flow",
+      });
+    }
     if (existing) {
       const providerDomain = canonicalProviderDomain(
         payload.providerDomain ?? existing.providerDomain,
@@ -406,6 +626,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       const kind = payload.kind ?? existing.kind;
       assertNotDirectPersonalSlackOAuth(providerDomain, kind);
       assertNotDirectGoogleDriveOAuth(providerDomain, kind, payload.metadata ?? existing.metadata);
+      assertNotDirectAtlassianOAuth(providerDomain, kind, payload.metadata ?? existing.metadata);
     }
     // Status is not a free-form field: revocation goes through DELETE, and the
     // broker owns needs_reauth/error. Reactivating a connection is only
@@ -467,8 +688,14 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       existing.providerDomain === GOOGLE_DRIVE_PROVIDER_DOMAIN &&
       existing.kind === "oauth2" &&
       GoogleDriveConnectionMetadata.safeParse(existing.metadata).success;
+    const isAtlassian =
+      existing.subjectId === grant.subjectId &&
+      existing.providerDomain === ATLASSIAN_PROVIDER_DOMAIN &&
+      existing.kind === "oauth2" &&
+      AtlassianConnectionMetadata.safeParse(existing.metadata).success;
+    const disconnectPayload = await c.req.json().catch(() => null);
     const googleDriveDisconnect = isGoogleDrive
-      ? GoogleDriveDisconnectRequest.safeParse(await c.req.json().catch(() => null))
+      ? GoogleDriveDisconnectRequest.safeParse(disconnectPayload)
       : null;
     if (googleDriveDisconnect && !googleDriveDisconnect.success) {
       throw new HTTPException(400, {
@@ -477,7 +704,16 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
           "invalid Google Drive disconnect request",
       });
     }
-    if (existing.status === "revoked" && !isGoogleDrive) {
+    const atlassianDisconnect = isAtlassian
+      ? AtlassianDisconnectRequest.safeParse(disconnectPayload)
+      : null;
+    if (atlassianDisconnect && !atlassianDisconnect.success) {
+      throw new HTTPException(400, {
+        message:
+          atlassianDisconnect.error.issues[0]?.message ?? "invalid Atlassian disconnect request",
+      });
+    }
+    if (existing.status === "revoked" && !isGoogleDrive && !isAtlassian) {
       return c.json(ConnectionResponse.parse({ connection: existing }));
     }
     const connection = isGoogleDrive
@@ -487,18 +723,31 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
           connection: existing,
           payload: googleDriveDisconnect!.data,
         })
-      : isOpenGeniSlackBotConnection(existing)
-        ? await revokeConnectionWithSlackBotSuccessAudit(db, {
-            accountId: grant.accountId,
+      : isAtlassian
+        ? await disconnectAtlassian(deps, {
             workspaceId,
             subjectId: grant.subjectId,
-            connectionId,
-            expectedVersion: existing.version,
-            credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
-            credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
-            slackTeamId: openGeniSlackBotMetadata(existing.metadata)!.slackTeamId,
+            connection: existing,
+            payload: atlassianDisconnect!.data,
           })
-        : await revokeConnection(db, workspaceId, connectionId, grant.subjectId, existing.version);
+        : isOpenGeniSlackBotConnection(existing)
+          ? await revokeConnectionWithSlackBotSuccessAudit(db, {
+              accountId: grant.accountId,
+              workspaceId,
+              subjectId: grant.subjectId,
+              connectionId,
+              expectedVersion: existing.version,
+              credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
+              credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
+              slackTeamId: openGeniSlackBotMetadata(existing.metadata)!.slackTeamId,
+            })
+          : await revokeConnection(
+              db,
+              workspaceId,
+              connectionId,
+              grant.subjectId,
+              existing.version,
+            );
     if (!connection) {
       throw new HTTPException(409, { message: "connection changed during disconnect; try again" });
     }
@@ -529,6 +778,29 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.json(OAuthStartResponse.parse(result));
   });
 
+  app.post("/v1/workspaces/:workspaceId/integrations/oauth/start", async (c) => {
+    assertIntegrationsEnabled();
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    const parsed = ApiIntegrationOAuthStartRequest.safeParse(await c.req.json());
+    if (!parsed.success) {
+      throw new HTTPException(400, {
+        message: parsed.error.issues[0]?.message ?? "invalid Integration OAuth start request",
+      });
+    }
+    return c.json(
+      OAuthStartResponse.parse(
+        await startApiIntegrationProviderOAuth(deps, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          requestUrl: c.req.url,
+          payload: parsed.data,
+        }),
+      ),
+    );
+  });
+
   app.get("/v1/integrations/oauth/callback", async (c) => {
     assertIntegrationsEnabled();
     const result = await completeMcpOAuthCallback(
@@ -542,6 +814,17 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.redirect(result.redirectTo, 302);
   });
 
+  app.get("/v1/integrations/provider-oauth/callback", async (c) => {
+    assertIntegrationsEnabled();
+    const result = await completeApiIntegrationProviderOAuth(deps, {
+      ...(c.req.query("code") ? { code: c.req.query("code") } : {}),
+      ...(c.req.query("state") ? { state: c.req.query("state") } : {}),
+      ...(c.req.query("error") ? { error: c.req.query("error") } : {}),
+      requestUrl: c.req.url,
+    });
+    return c.redirect(result.redirectTo, 302);
+  });
+
   app.get("/v1/integrations/oauth/client-metadata.json", (c) => {
     const baseUrl = integrationBaseUrl(settings.publicBaseUrl, c.req.url);
     const metadataUrl = `${baseUrl}/v1/integrations/oauth/client-metadata.json`;
@@ -599,14 +882,9 @@ async function persistOpenGeniSlackBotConnection(input: {
       "principal_validation",
     );
   }
-  const existing =
-    requestedExisting ??
-    (await findMatchingOpenGeniSlackBotConnection(
-      db,
-      input.state.workspaceId,
-      input.verified.metadata,
-    ));
-  const existingMetadata = existing ? openGeniSlackBotMetadata(existing.metadata) : null;
+  const existingMetadata = requestedExisting
+    ? openGeniSlackBotMetadata(requestedExisting.metadata)
+    : null;
   if (existingMetadata && existingMetadata.slackTeamId !== input.verified.metadata.slackTeamId) {
     throw new SlackInstallCallbackError(
       409,
@@ -628,83 +906,36 @@ async function persistOpenGeniSlackBotConnection(input: {
     );
   }
   const verifiedInstallAt = new Date(input.verified.metadata.verifiedAt);
-  const lifecycleAudit = {
-    accountId: input.state.accountId,
-    workspaceId: input.state.workspaceId,
-    subjectId: input.state.subjectId,
-    credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
-    credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
-    slackTeamId: input.verified.metadata.slackTeamId,
-  };
-  const connection = existing
-    ? await updateConnectionWithSlackBotSuccessAudit(db, {
-        ...lifecycleAudit,
-        connection: {
-          workspaceId: input.state.workspaceId,
-          connectionId: existing.id,
-          visibleToSubjectId: input.state.subjectId,
-          expectedVersion: existing.version,
-          subjectId: null,
-          providerDomain: "slack.com",
-          kind: "app_install",
-          status: "active",
-          credentialEncrypted,
-          grantedScopes: input.verified.grantedScopes,
-          expiresAt: null,
-          verifiedInstallAt,
-          verifiedInstallVersion: existing.version + 1,
-          metadata: input.verified.metadata,
-          updatedBySubjectId: input.state.subjectId,
-        },
-      })
-    : await createConnectionWithSlackBotSuccessAudit(db, {
-        ...lifecycleAudit,
-        connection: {
-          accountId: input.state.accountId,
-          workspaceId: input.state.workspaceId,
-          subjectId: null,
-          providerDomain: "slack.com",
-          kind: "app_install",
-          credentialEncrypted,
-          grantedScopes: input.verified.grantedScopes,
-          expiresAt: null,
-          verifiedInstallAt,
-          verifiedInstallVersion: 1,
-          metadata: input.verified.metadata,
-          createdBySubjectId: input.state.subjectId,
-        },
-      });
-  if (!connection) {
-    throw new SlackInstallCallbackError(
-      409,
-      "connection_conflict",
-      "Slack bot connection changed during reinstall; start again",
-      "principal_validation",
-    );
-  }
-  return connection;
-}
-
-async function findMatchingOpenGeniSlackBotConnection(
-  db: ApiRouteDeps["db"],
-  workspaceId: string,
-  verified: Awaited<ReturnType<typeof verifyOpenGeniSlackBotCredential>>["metadata"],
-) {
-  const connections = await listConnectionsMetadata(db, workspaceId, null);
-  return (
-    connections.find((connection) => {
-      const metadata = openGeniSlackBotMetadata(connection.metadata);
-      return (
-        connection.subjectId === null &&
-        connection.providerDomain === "slack.com" &&
-        connection.kind === "app_install" &&
-        metadata?.credentialRole === OPENGENI_SLACK_BOT_CREDENTIAL_ROLE &&
-        metadata.slackTeamId === verified.slackTeamId &&
-        metadata.botId === verified.botId &&
-        metadata.botUserId === verified.botUserId
+  try {
+    return await persistSlackBotInstallationWithSuccessAudit(db, {
+      accountId: input.state.accountId,
+      workspaceId: input.state.workspaceId,
+      subjectId: input.state.subjectId,
+      credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
+      credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
+      slackTeamId: input.verified.metadata.slackTeamId,
+      ...(input.state.connectionId
+        ? {
+            requestedConnectionId: input.state.connectionId,
+            requestedConnectionVersion: input.state.connectionVersion,
+          }
+        : {}),
+      credentialEncrypted,
+      grantedScopes: input.verified.grantedScopes,
+      verifiedInstallAt,
+      metadata: input.verified.metadata,
+    });
+  } catch (error) {
+    if (error instanceof SlackInstallationBindingConflictError) {
+      throw new SlackInstallCallbackError(
+        409,
+        "connection_conflict",
+        error.message,
+        "principal_validation",
       );
-    }) ?? null
-  );
+    }
+    throw error;
+  }
 }
 
 function requireOpenGeniSlackOAuthSettings(settings: ApiRouteDeps["settings"]): {
@@ -881,6 +1112,21 @@ function assertNotDirectGoogleDriveOAuth(
   }
 }
 
+function assertNotDirectAtlassianOAuth(
+  providerDomain: string,
+  kind: string,
+  metadata: Record<string, unknown> | undefined,
+): void {
+  if (
+    (providerDomain === ATLASSIAN_PROVIDER_DOMAIN && kind === "oauth2") ||
+    AtlassianConnectionMetadata.safeParse(metadata).success
+  ) {
+    throw new HTTPException(422, {
+      message: "Atlassian credentials must use the dedicated OAuth connection flow",
+    });
+  }
+}
+
 function assertNotReservedSlackBotMetadata(metadata: Record<string, unknown> | undefined): void {
   if (hasReservedOpenGeniSlackBotMetadata(metadata)) {
     throw new HTTPException(422, {
@@ -889,6 +1135,16 @@ function assertNotReservedSlackBotMetadata(metadata: Record<string, unknown> | u
   }
 }
 
+function assertNotReservedApiIntegrationOAuthMetadata(
+  metadata: Record<string, unknown> | undefined,
+): void {
+  if (metadata?.credentialRole === API_INTEGRATION_OAUTH_CREDENTIAL_ROLE) {
+    throw new HTTPException(422, {
+      message: "API Integration OAuth metadata is reserved for the dedicated provider flow",
+    });
+  }
+}
+
 function writableSubjectId(
   requested: string | null | undefined,
   grantSubjectId: string,

package/src/routes/documents.ts

@@ -21,7 +21,6 @@ import {
   getKnowledgeMemory,
   listKnowledgeMemories,
   updateKnowledgeMemory,
-  saveWorkspaceMemory,
   searchWorkspaceMemories,
 } from "@opengeni/db";
 import {
@@ -40,7 +39,11 @@ import {
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { requireAccessGrant, requireAccessGrantAuthorization } from "@opengeni/core";
+import {
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  saveWorkspaceMemoryWithSlackPublication,
+} from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import { buildDocumentsMcpServer } from "../mcp/documents";
@@ -561,12 +564,17 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw new HTTPException(400, { message: "invalid knowledge memory request" });
     }
     const payload = parsedBody.data;
+    if (payload.status !== "active" && payload.slackPublication) {
+      throw new HTTPException(400, {
+        message: "Slack publication is available only for active Workspace Memory writes",
+      });
+    }
     // status `active` (the default) is a memory write → route through the single
     // gate (sanitize + embed + dedup). Explicit proposed/approved/rejected keeps
     // the legacy curated create.
     if (payload.status === "active") {
       try {
-        const result = await saveWorkspaceMemory(
+        const result = await saveWorkspaceMemoryWithSlackPublication(
           db,
           {
             accountId: grant.accountId,
@@ -579,6 +587,17 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
             metadata: payload.metadata,
             origin: "human",
           },
+          payload.slackPublication
+            ? {
+                distribution: payload.slackPublication,
+                actor: {
+                  kind: "human",
+                  subjectId: grant.subjectId,
+                  initiatingHumanSubjectId: grant.subjectId,
+                },
+                ownerLabel: grant.subjectLabel ?? null,
+              }
+            : null,
           getDocumentServices().embedder,
         );
         return c.json(KnowledgeMemory.parse(result.memory), 201);