@opengeni/api-router 0.22.2 → 0.26.1

package/src/routes/integration-features.ts

@@ -0,0 +1,258 @@
+import {
+  IntegrationFeatureMutationResult,
+  IntegrationFeatureRemovalResult,
+  IntegrationInstanceFeaturesResponse,
+  MutateIntegrationFeatureRequest,
+  UpsertIntegrationFeatureRequest,
+} from "@opengeni/contracts";
+import {
+  hasPermission,
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import {
+  configureIntegrationFeature,
+  IntegrationFeatureBindingOwnershipConflictError,
+  IntegrationFeatureBindingVersionConflictError,
+  IntegrationFeatureBindingVersionRequiredError,
+  IntegrationFeatureConfigError,
+  IntegrationFeatureConnectionError,
+  IntegrationFeatureNotFoundError,
+  IntegrationFeatureOperationIdempotencyError,
+  listIntegrationInstanceFeatures,
+  removeIntegrationFeature,
+  setIntegrationFeatureLifecycle,
+} from "@opengeni/db";
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+
+import {
+  browseGoogleDriveIntegrationSource,
+  saveGoogleDriveIntegrationSource,
+} from "../integrations/google-drive";
+
+export function registerIntegrationFeatureRoutes(app: Hono, deps: ApiRouteDeps): void {
+  app.get(
+    "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/features/:featureKey/browse",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
+      try {
+        return c.json(
+          await browseGoogleDriveIntegrationSource(deps, {
+            workspaceId,
+            subjectId: grant.subjectId,
+            capabilityId: decoded(c.req.param("capabilityId")),
+            instanceKey: decoded(c.req.param("instanceKey")),
+            featureKey: decoded(c.req.param("featureKey")),
+            parentId: c.req.query("parentId") ?? "root",
+            ...(c.req.query("pageToken") ? { pageToken: c.req.query("pageToken") } : {}),
+          }),
+        );
+      } catch (error) {
+        throw featureHttpError(error);
+      }
+    },
+  );
+
+  app.put(
+    "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/features/:featureKey/source",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const authorization = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "workspace:admin",
+      );
+      const { grant } = authorization;
+      try {
+        return c.json(
+          IntegrationFeatureMutationResult.parse(
+            await saveGoogleDriveIntegrationSource(deps, {
+              accountId: grant.accountId,
+              workspaceId,
+              subjectId: grant.subjectId,
+              capabilityId: decoded(c.req.param("capabilityId")),
+              instanceKey: decoded(c.req.param("instanceKey")),
+              featureKey: decoded(c.req.param("featureKey")),
+              payload: await c.req.json(),
+              canManageOrganizationDestination:
+                authorization.accountGrant?.permissions.includes("account:admin") === true,
+              canManageWorkspaceDestination: hasPermission(grant.permissions, "workspace:admin"),
+              canManagePersonalDestination:
+                authorization.contextIntegrity &&
+                authorization.authenticatedSubjectId === grant.subjectId,
+            }),
+          ),
+        );
+      } catch (error) {
+        throw featureHttpError(error);
+      }
+    },
+  );
+
+  app.get(
+    "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/features",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+      try {
+        return c.json(
+          IntegrationInstanceFeaturesResponse.parse(
+            await listIntegrationInstanceFeatures(
+              deps.db,
+              workspaceId,
+              grant.subjectId,
+              decoded(c.req.param("capabilityId")),
+              decoded(c.req.param("instanceKey")),
+            ),
+          ),
+        );
+      } catch (error) {
+        throw featureHttpError(error);
+      }
+    },
+  );
+
+  app.put(
+    "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/features/:featureKey",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+      const payload = UpsertIntegrationFeatureRequest.parse(await c.req.json());
+      const capabilityId = decoded(c.req.param("capabilityId"));
+      const instanceKey = decoded(c.req.param("instanceKey"));
+      const featureKey = decoded(c.req.param("featureKey"));
+      try {
+        const instance = await listIntegrationInstanceFeatures(
+          deps.db,
+          workspaceId,
+          grant.subjectId,
+          capabilityId,
+          instanceKey,
+        );
+        const definition = instance.features.find(
+          (feature) => feature.definition.featureKey === featureKey,
+        )?.definition;
+        if (
+          definition?.kind === "knowledge_source" &&
+          definition.capabilities.provider === "google-drive"
+        ) {
+          throw new HTTPException(422, {
+            message:
+              "Google Drive source configuration requires the provider-specific source route",
+          });
+        }
+        return c.json(
+          IntegrationFeatureMutationResult.parse(
+            await configureIntegrationFeature(deps.db, {
+              accountId: grant.accountId,
+              workspaceId,
+              subjectId: grant.subjectId,
+              capabilityId,
+              instanceKey,
+              featureKey,
+              displayName: payload.displayName,
+              config: payload.config,
+              ...(payload.expectedVersion !== undefined
+                ? { expectedVersion: payload.expectedVersion }
+                : {}),
+              idempotencyKey: payload.idempotencyKey,
+            }),
+          ),
+          payload.expectedVersion === undefined ? 201 : 200,
+        );
+      } catch (error) {
+        throw featureHttpError(error);
+      }
+    },
+  );
+
+  for (const action of ["pause", "resume"] as const) {
+    app.post(
+      `/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/features/:featureKey/${action}`,
+      async (c) => {
+        const workspaceId = c.req.param("workspaceId");
+        const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+        const payload = MutateIntegrationFeatureRequest.parse(await c.req.json());
+        try {
+          return c.json(
+            IntegrationFeatureMutationResult.parse(
+              await setIntegrationFeatureLifecycle(deps.db, {
+                accountId: grant.accountId,
+                workspaceId,
+                subjectId: grant.subjectId,
+                capabilityId: decoded(c.req.param("capabilityId")),
+                instanceKey: decoded(c.req.param("instanceKey")),
+                featureKey: decoded(c.req.param("featureKey")),
+                action,
+                expectedVersion: payload.expectedVersion,
+                idempotencyKey: payload.idempotencyKey,
+              }),
+            ),
+          );
+        } catch (error) {
+          throw featureHttpError(error);
+        }
+      },
+    );
+  }
+
+  app.delete(
+    "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/features/:featureKey",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+      const payload = MutateIntegrationFeatureRequest.parse(await c.req.json());
+      try {
+        return c.json(
+          IntegrationFeatureRemovalResult.parse(
+            await removeIntegrationFeature(deps.db, {
+              accountId: grant.accountId,
+              workspaceId,
+              subjectId: grant.subjectId,
+              capabilityId: decoded(c.req.param("capabilityId")),
+              instanceKey: decoded(c.req.param("instanceKey")),
+              featureKey: decoded(c.req.param("featureKey")),
+              expectedVersion: payload.expectedVersion,
+              idempotencyKey: payload.idempotencyKey,
+            }),
+          ),
+        );
+      } catch (error) {
+        throw featureHttpError(error);
+      }
+    },
+  );
+}
+
+function decoded(value: string): string {
+  return decodeURIComponent(value);
+}
+
+function featureHttpError(error: unknown): HTTPException {
+  if (error instanceof HTTPException) return error;
+  if (error instanceof IntegrationFeatureNotFoundError) {
+    return new HTTPException(404, { message: error.message });
+  }
+  if (
+    error instanceof IntegrationFeatureBindingVersionConflictError ||
+    error instanceof IntegrationFeatureBindingVersionRequiredError ||
+    error instanceof IntegrationFeatureBindingOwnershipConflictError ||
+    error instanceof IntegrationFeatureOperationIdempotencyError
+  ) {
+    return new HTTPException(409, {
+      message:
+        "The Integration feature changed, is shared, or reused an idempotency key. Refresh before retrying.",
+    });
+  }
+  if (
+    error instanceof IntegrationFeatureConfigError ||
+    error instanceof IntegrationFeatureConnectionError
+  ) {
+    return new HTTPException(422, { message: error.message });
+  }
+  throw error;
+}

package/src/routes/machines.ts

@@ -73,7 +73,7 @@ export function registerMachineRoutes(app: Hono, deps: ApiRouteDeps): void {
     // Validate the machine belongs to this workspace (RLS already scopes the read,
     // but a clear 404 beats an empty series for an unknown/cross-workspace id).
     const enrollment = await getEnrollment(db, workspaceId, enrollmentId);
-    if (!enrollment) {
+    if (!enrollment || enrollment.status !== "active") {
       throw new HTTPException(404, { message: "machine not found in this workspace" });
     }
     const windowMs = SERIES_WINDOWS_MS[c.req.query("window") ?? ""] ?? DEFAULT_SERIES_WINDOW_MS;

package/src/routes/memory-slack-publications.ts

@@ -0,0 +1,216 @@
+import {
+  MemorySlackPublication,
+  MemorySlackPublicationActionRequest,
+  MemorySlackPublicationConfigurationResponse,
+  MemorySlackPublicationHistoryResponse,
+  SlackPublicationChannelListResponse,
+  UpdateMemorySlackPublicationConfigurationRequest,
+  type MemorySlackPublication as MemorySlackPublicationRecord,
+} from "@opengeni/contracts";
+import {
+  actOnMemorySlackPublication,
+  createMemorySlackPublicationConfiguration,
+  listMemorySlackPublicationConfigurations,
+  listMemorySlackPublications,
+  MemorySlackPublicationRevisionConflictError,
+  recordAuditEvent,
+} from "@opengeni/db";
+import {
+  openGeniSlackBotMetadata,
+  requireAccessGrant,
+  sanitizeSlackPublicationText,
+  validateOpenGeniSlackBotConnectionSelection,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { createOpenGeniSlackBotInteractionClient } from "../integrations/slack-bot";
+
+export function registerMemorySlackPublicationRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const base = "/v1/workspaces/:workspaceId/memory-slack-publications";
+
+  app.get(`${base}/configuration`, async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const history = await listMemorySlackPublicationConfigurations(deps.db, workspaceId, 25);
+    c.header("cache-control", "private, no-store");
+    return c.json(
+      MemorySlackPublicationConfigurationResponse.parse({
+        current: history[0] ?? null,
+        history,
+      }),
+    );
+  });
+
+  app.put(`${base}/configuration`, async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const payload = UpdateMemorySlackPublicationConfigurationRequest.parse(await c.req.json());
+    let slackTeamId: string | null = null;
+    let channelName = payload.slackChannelName;
+    if (payload.connectionId || payload.slackChannelId) {
+      if (!payload.connectionId || !payload.slackChannelId) {
+        throw new HTTPException(400, {
+          message: "connectionId and slackChannelId must be configured together",
+        });
+      }
+      const connection = await validateOpenGeniSlackBotConnectionSelection(
+        deps.db,
+        grant,
+        workspaceId,
+        payload.connectionId,
+      );
+      const metadata = openGeniSlackBotMetadata(connection.metadata);
+      if (!metadata) {
+        throw new HTTPException(422, { message: "Slack bot installation metadata is invalid" });
+      }
+      const client = await createOpenGeniSlackBotInteractionClient(deps, {
+        accountId: grant.accountId,
+        workspaceId,
+        connectionId: connection.id,
+        subjectId: grant.subjectId,
+      });
+      const channel = await client.verifyChannelAccess(payload.slackChannelId);
+      if (
+        channel.isShared ||
+        channel.isExternallyShared ||
+        channel.isOrgShared ||
+        channel.isArchived
+      ) {
+        throw new HTTPException(422, {
+          message: "Slack publication requires an active, non-shared bot-member channel",
+        });
+      }
+      slackTeamId = metadata.slackTeamId;
+      channelName = channel.name ?? payload.slackChannelName;
+    }
+    try {
+      const configuration = await createMemorySlackPublicationConfiguration(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        expectedRevision: payload.expectedRevision,
+        enabled: payload.enabled,
+        connectionId: payload.connectionId,
+        slackTeamId,
+        slackChannelId: payload.slackChannelId,
+        slackChannelName: channelName,
+        autoImportances: payload.autoImportances,
+        reviewImportances: payload.reviewImportances,
+        subjectId: grant.subjectId,
+      });
+      await recordAuditEvent(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        action: "memory_slack_publication.configuration.created",
+        targetType: "memory_slack_publication_configuration",
+        targetId: configuration.id,
+        metadata: {
+          revision: configuration.revision,
+          enabled: configuration.enabled,
+          connectionId: configuration.connectionId,
+          slackTeamId: configuration.slackTeamId,
+          slackChannelId: configuration.slackChannelId,
+          autoImportances: configuration.autoImportances,
+          reviewImportances: configuration.reviewImportances,
+        },
+      });
+      return c.json(configuration);
+    } catch (error) {
+      if (error instanceof MemorySlackPublicationRevisionConflictError) {
+        throw new HTTPException(409, {
+          message: `configuration revision conflict; current revision is ${error.currentRevision}`,
+        });
+      }
+      throw error;
+    }
+  });
+
+  app.get(`${base}/channels`, async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const connectionId = c.req.query("connectionId");
+    if (!connectionId) throw new HTTPException(400, { message: "connectionId is required" });
+    await validateOpenGeniSlackBotConnectionSelection(deps.db, grant, workspaceId, connectionId);
+    const client = await createOpenGeniSlackBotInteractionClient(deps, {
+      accountId: grant.accountId,
+      workspaceId,
+      connectionId,
+      subjectId: grant.subjectId,
+    });
+    const result = await client.listChannels({
+      limit: 200,
+      ...(c.req.query("cursor") ? { cursor: c.req.query("cursor")! } : {}),
+    });
+    return c.json(
+      SlackPublicationChannelListResponse.parse({
+        channels: result.channels
+          .filter(
+            (channel) =>
+              channel.isMember &&
+              !channel.isArchived &&
+              !channel.isShared &&
+              !channel.isExternallyShared &&
+              !channel.isOrgShared,
+          )
+          .map((channel) => ({
+            id: channel.id,
+            name: channel.name,
+            isPrivate: channel.isPrivate,
+          })),
+        nextCursor: result.nextCursor || null,
+      }),
+    );
+  });
+
+  app.get(base, async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const publications = await listMemorySlackPublications(deps.db, workspaceId, { limit: 50 });
+    c.header("cache-control", "private, no-store");
+    return c.json(
+      MemorySlackPublicationHistoryResponse.parse({
+        publications: publications.map(sanitizeMemorySlackPublicationHistory),
+        nextCursor: null,
+      }),
+    );
+  });
+
+  app.post(`${base}/:publicationId/action`, async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const payload = MemorySlackPublicationActionRequest.parse(await c.req.json());
+    const publication = await actOnMemorySlackPublication(deps.db, {
+      workspaceId,
+      publicationId: c.req.param("publicationId"),
+      expectedState: payload.expectedState,
+      action: payload.action,
+      subjectId: grant.subjectId,
+    });
+    if (!publication) {
+      throw new HTTPException(409, { message: "publication state changed or action is invalid" });
+    }
+    await recordAuditEvent(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: `memory_slack_publication.${payload.action}`,
+      targetType: "memory_slack_publication",
+      targetId: publication.id,
+      metadata: {
+        expectedState: payload.expectedState,
+        resultState: publication.state,
+        operationId: publication.receipts.at(-1)?.operationId ?? null,
+      },
+    });
+    return c.json(MemorySlackPublication.parse(sanitizeMemorySlackPublicationHistory(publication)));
+  });
+}
+
+/** Defensively protects legacy rows without rewriting their durable projection. */
+export function sanitizeMemorySlackPublicationHistory(
+  publication: MemorySlackPublicationRecord,
+): MemorySlackPublicationRecord {
+  const summary = sanitizeSlackPublicationText(publication.summary);
+  return summary === publication.summary ? publication : { ...publication, summary };
+}