@opengeni/api-router 0.22.2 → 0.26.1

package/src/routes/rigs.ts

@@ -7,7 +7,6 @@ import {
 import {
   beginRigChangeVerificationAttempt,
   listRigs,
-  RigChangeAlreadyVerifyingError,
   RigChangeTransitionError,
 } from "@opengeni/db";
 import type { Hono } from "hono";
@@ -32,38 +31,87 @@ import { boundedLimit } from "../http/common";
 export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, workflowClient } = deps;
 
-  async function startChangeVerification(workspaceId: string, changeId: string): Promise<unknown> {
+  async function startChangeVerification(
+    workspaceId: string,
+    changeId: string,
+  ): Promise<{
+    change: Awaited<ReturnType<typeof beginRigChangeVerificationAttempt>>;
+    started: boolean;
+  }> {
     const startedAt = new Date().toISOString();
     let change;
     try {
-      change = await beginRigChangeVerificationAttempt(db, workspaceId, changeId, { startedAt });
+      change = await beginRigChangeVerificationAttempt(db, workspaceId, changeId, {
+        startedAt,
+        // Reuse the existing attempt after an ambiguous Temporal start. Its
+        // deterministic workflow id turns this into an idempotent recovery.
+        allowAlreadyVerifying: true,
+      });
     } catch (error) {
-      if (
-        error instanceof RigChangeAlreadyVerifyingError ||
-        error instanceof RigChangeTransitionError
-      ) {
+      if (error instanceof RigChangeTransitionError) {
         throw new HTTPException(409, { message: error.message });
       }
       throw error;
     }
     const attempt =
       typeof change.verification?.attempt === "number" ? change.verification.attempt : Date.now();
-    await workflowClient.startRigVerification({
-      workspaceId,
-      changeId,
-      workflowId: `rig-verification-change-${changeId}-attempt-${attempt}`,
-    });
-    return change;
+    try {
+      await workflowClient.startRigVerification({
+        workspaceId,
+        changeId,
+        workflowId: `rig-verification-change-${changeId}-attempt-${attempt}`,
+      });
+      return { change, started: true };
+    } catch (error) {
+      // The verifying transition already committed. Keep its deterministic
+      // attempt identity retryable instead of reporting an opaque 5xx after a
+      // durable mutation or inventing a second attempt after an ambiguous start.
+      deps.observability?.warn("rig change verification start failed", {
+        workspaceId,
+        changeId,
+        attempt,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      return { change, started: false };
+    }
   }
 
-  async function startVersionVerification(workspaceId: string, versionId: string): Promise<void> {
+  async function startVersionVerification(
+    workspaceId: string,
+    versionId: string,
+    workflowId = `rig-verification-version-${versionId}-${crypto.randomUUID()}`,
+  ): Promise<void> {
     await workflowClient.startRigVerification({
       workspaceId,
       versionId,
-      workflowId: `rig-verification-version-${versionId}-${crypto.randomUUID()}`,
+      workflowId,
     });
   }
 
+  async function tryStartInitialVersionVerification(
+    workspaceId: string,
+    versionId: string,
+  ): Promise<boolean> {
+    try {
+      await startVersionVerification(
+        workspaceId,
+        versionId,
+        `rig-verification-version-${versionId}-initial`,
+      );
+      return true;
+    } catch (error) {
+      // Creation already committed. The rig remains fully usable through its
+      // runtime setup fallback and can be re-verified explicitly; never turn a
+      // successful create into an unretryable 5xx because Temporal was down.
+      deps.observability?.warn("initial rig provider-image verification start failed", {
+        workspaceId,
+        versionId,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      return false;
+    }
+  }
+
   app.get("/v1/workspaces/:workspaceId/rigs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "rigs:use");
@@ -75,6 +123,10 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
     const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
     const payload = CreateRigRequest.parse(await c.req.json());
     const rig = await createRigForApi({ db }, grant, payload);
+    if (rig.activeVersion) {
+      const started = await tryStartInitialVersionVerification(workspaceId, rig.activeVersion.id);
+      if (!started) c.header("OpenGeni-Rig-Verification", "deferred");
+    }
     return c.json(rig, 201);
   });
 
@@ -112,7 +164,10 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
     const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
     const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
     const payload = RigDefinitionEditPayload.parse(await c.req.json());
-    return c.json(await createRigVersionForApi({ db }, grant, rig, payload), 201);
+    const version = await createRigVersionForApi({ db }, grant, rig, payload);
+    const started = await tryStartInitialVersionVerification(workspaceId, version.id);
+    if (!started) c.header("OpenGeni-Rig-Verification", "deferred");
+    return c.json(version, 201);
   });
 
   // Rollback / promote-activate: flips which existing version is active.
@@ -142,8 +197,9 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
     const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
     const request = ProposeRigChangeRequest.parse(await c.req.json());
     const change = await proposeRigChangeForApi({ db }, grant, rig, request);
-    const verifying = await startChangeVerification(workspaceId, change.id);
-    return c.json(verifying, 201);
+    const verification = await startChangeVerification(workspaceId, change.id);
+    if (!verification.started) c.header("OpenGeni-Rig-Verification", "deferred");
+    return c.json(verification.change, 201);
   });
 
   app.get("/v1/workspaces/:workspaceId/rigs/:rigId/changes/:changeId", async (c) => {
@@ -163,8 +219,9 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
       c.req.param("rigId"),
       c.req.param("changeId"),
     );
-    const verifying = await startChangeVerification(workspaceId, change.id);
-    return c.json(verifying, 202);
+    const verification = await startChangeVerification(workspaceId, change.id);
+    if (!verification.started) c.header("OpenGeni-Rig-Verification", "deferred");
+    return c.json(verification.change, 202);
   });
 
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/changes/:changeId/promote", async (c) => {

package/src/routes/scheduled-tasks.ts

@@ -10,6 +10,7 @@ import {
   updateScheduledTask,
 } from "@opengeni/db";
 import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
 import { requireAccessGrant } from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
@@ -19,13 +20,18 @@ import {
   manualScheduledTaskTriggerUsageKey,
   manualScheduledTaskTriggerWorkflowId,
   scheduledTaskToolsProvided,
+  scheduledTaskForGrant,
+  scheduledTaskRunForGrant,
   scheduledTaskTriggerToken,
   requireScheduledTaskForApi,
   syncCreatedScheduledTask,
   syncUpdatedScheduledTask,
+  validateScheduledTaskTarget,
   validatedScheduledTaskUpdate,
 } from "@opengeni/core";
 import { boundedLimit } from "../http/common";
+import { revokeKnowledgeSourceScheduleAuthorization } from "../integrations/google-drive";
+import { revokeAtlassianScheduleAuthorization } from "../integrations/atlassian";
 
 export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { settings, db, workflowClient, objectStorage } = deps;
@@ -34,7 +40,13 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     const rawPayload = await c.req.json();
-    const payload = CreateScheduledTaskRequest.parse(rawPayload);
+    const parsedPayload = CreateScheduledTaskRequest.safeParse(rawPayload);
+    if (!parsedPayload.success) {
+      throw new HTTPException(400, {
+        message: "invalid scheduled task create request",
+      });
+    }
+    const payload = parsedPayload.data;
     await requireLimit(deps, {
       accountId: grant.accountId,
       workspaceId,
@@ -48,21 +60,25 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       grant,
       payload,
       toolsProvided: scheduledTaskToolsProvided(rawPayload),
+      sessionAuthorization: deps.sessionAuthorization,
+      authorizationSurface: "http",
     });
     await syncCreatedScheduledTask({ db, workflowClient, task });
-    return c.json(task, 201);
+    return c.json(scheduledTaskForGrant(task, grant), 201);
   });
 
   app.get("/v1/workspaces/:workspaceId/scheduled-tasks", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
-    return c.json(await listScheduledTasks(db, workspaceId, boundedLimit(c.req.query("limit"))));
+    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
+    const tasks = await listScheduledTasks(db, workspaceId, boundedLimit(c.req.query("limit")));
+    return c.json(tasks.map((task) => scheduledTaskForGrant(task, grant)));
   });
 
   app.get("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
-    return c.json(await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId")));
+    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
+    const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
+    return c.json(scheduledTaskForGrant(task, grant));
   });
 
   app.patch("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId", async (c) => {
@@ -72,7 +88,13 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     const existing = await requireScheduledTaskForApi(db, workspaceId, taskId);
     const previous = await captureScheduledTaskRestoreState(db, existing);
     const rawPayload = await c.req.json();
-    const payload = UpdateScheduledTaskRequest.parse(rawPayload);
+    const parsedPayload = UpdateScheduledTaskRequest.safeParse(rawPayload);
+    if (!parsedPayload.success) {
+      throw new HTTPException(400, {
+        message: "invalid scheduled task update request",
+      });
+    }
+    const payload = parsedPayload.data;
     const update = await validatedScheduledTaskUpdate({
       settings,
       db,
@@ -81,30 +103,36 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       existing,
       payload,
       toolsProvided: scheduledTaskToolsProvided(rawPayload),
+      sessionAuthorization: deps.sessionAuthorization,
+      authorizationSurface: "http",
     });
     const task = await updateScheduledTask(db, workspaceId, taskId, update);
     await syncUpdatedScheduledTask({ db, workflowClient, previous, task });
-    return c.json(task);
+    return c.json(scheduledTaskForGrant(task, grant));
   });
 
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/pause", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     const existing = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     const previous = await captureScheduledTaskRestoreState(db, existing);
-    const task = await updateScheduledTask(db, workspaceId, existing.id, { status: "paused" });
+    const task = await updateScheduledTask(db, workspaceId, existing.id, {
+      status: "paused",
+    });
     await syncUpdatedScheduledTask({ db, workflowClient, previous, task });
-    return c.json(task);
+    return c.json(scheduledTaskForGrant(task, grant));
   });
 
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/resume", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     const existing = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     const previous = await captureScheduledTaskRestoreState(db, existing);
-    const task = await updateScheduledTask(db, workspaceId, existing.id, { status: "active" });
+    const task = await updateScheduledTask(db, workspaceId, existing.id, {
+      status: "active",
+    });
     await syncUpdatedScheduledTask({ db, workflowClient, previous, task });
-    return c.json(task);
+    return c.json(scheduledTaskForGrant(task, grant));
   });
 
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/trigger", async (c) => {
@@ -113,23 +141,36 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     // Load the task before the gate so a codex-model scheduled task can be
     // recognised as codex-billed and skip the credit/cost gates at the edge.
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
-    await requireLimit(deps, {
-      accountId: grant.accountId,
-      workspaceId,
-      action: "agent_run:create",
-      quantity: 1,
-      model: task.agentConfig.model ?? deps.settings.openaiModel,
-    });
+    if (task.action.kind === "agent_turn") {
+      await validateScheduledTaskTarget({
+        db,
+        sessionAuthorization: deps.sessionAuthorization,
+        authorizationSurface: "http",
+        grant,
+        targetSessionId: task.targetSessionId,
+        runMode: task.runMode,
+        variableSetId: task.variableSetId,
+        rigId: task.rigId,
+        agentConfig: task.agentConfig,
+        missingTargetStatus: 404,
+      });
+      await requireLimit(deps, {
+        accountId: grant.accountId,
+        workspaceId,
+        action: "agent_run:create",
+        quantity: 1,
+        model: task.agentConfig.model ?? deps.settings.openaiModel,
+      });
+    }
     // Body is optional (a bare POST is still a valid trigger); only a present,
     // non-empty body must parse against the contract.
     const body = await c.req.json().catch(() => ({}));
     const { triggerId } = TriggerScheduledTaskRequest.parse(body ?? {});
     const triggerToken = scheduledTaskTriggerToken(triggerId);
-    const agentRunUsageIdempotencyKey = manualScheduledTaskTriggerUsageKey(
-      workspaceId,
-      task.id,
-      triggerToken,
-    );
+    const agentRunUsageIdempotencyKey =
+      task.action.kind === "agent_turn"
+        ? manualScheduledTaskTriggerUsageKey(workspaceId, task.id, triggerToken)
+        : `knowledge-source-sync:manual:${workspaceId}:${task.id}:${triggerToken}`;
     const triggerWorkflowId = manualScheduledTaskTriggerWorkflowId(task.id, triggerToken);
     await workflowClient.triggerScheduledTask({
       task,
@@ -137,24 +178,31 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       triggerWorkflowId,
       initiator: { kind: "subject", subjectId: grant.subjectId },
     });
-    await recordWorkspaceUsage(deps, {
-      accountId: grant.accountId,
-      workspaceId,
-      subjectId: grant.subjectId,
-      eventType: "agent_run.created",
-      quantity: 1,
-      unit: "run",
-      sourceResourceType: "scheduled_task",
-      sourceResourceId: task.id,
-      idempotencyKey: agentRunUsageIdempotencyKey,
-    });
-    return c.json(task, 202);
+    if (task.action.kind === "agent_turn") {
+      await recordWorkspaceUsage(deps, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        eventType: "agent_run.created",
+        quantity: 1,
+        unit: "run",
+        sourceResourceType: "scheduled_task",
+        sourceResourceId: task.id,
+        idempotencyKey: agentRunUsageIdempotencyKey,
+      });
+    }
+    return c.json(scheduledTaskForGrant(task, grant), 202);
   });
 
   app.delete("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
+    if (task.metadata.connectorKind === "atlassian") {
+      await revokeAtlassianScheduleAuthorization(deps, { task, subjectId: grant.subjectId });
+    } else {
+      await revokeKnowledgeSourceScheduleAuthorization(deps, { task, subjectId: grant.subjectId });
+    }
     await workflowClient.deleteScheduledTaskSchedule({
       temporalScheduleId: task.temporalScheduleId,
     });
@@ -164,10 +212,14 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
 
   app.get("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/runs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
-    return c.json(
-      await listScheduledTaskRuns(db, workspaceId, task.id, boundedLimit(c.req.query("limit"))),
+    const taskRuns = await listScheduledTaskRuns(
+      db,
+      workspaceId,
+      task.id,
+      boundedLimit(c.req.query("limit")),
     );
+    return c.json(taskRuns.map((run) => scheduledTaskRunForGrant(run, grant)));
   });
 }