@opengeni/api-router 0.30.1 → 0.30.3

package/src/routes/browser-sessions.ts

@@ -100,7 +100,7 @@ import {
   getBrowserRevisionArtifactAuthority,
   getEnrollment,
   getExternalAuthInteractiveContext,
-  getFiles,
+  getFilesForSubject,
   getFileUpload,
   getAuthRun,
   getExternalAuthPreparation,
@@ -145,6 +145,7 @@ import {
   SessionAuthorizationDeniedError,
   SessionAuthorizationUnavailableError,
   type ApiRouteDeps,
+  type ResolvedSessionAuthorization,
 } from "@opengeni/core";
 import {
   BrowserControlProtocolError,
@@ -927,7 +928,7 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
         browserSessionId,
         "session.control",
         "browser.action",
-        async ({ sessionClient, binding, record }) => {
+        async ({ sessionClient, binding, record, sourceAuthorization }) => {
           const command = BrowserActionCommand.parse({
             protocolVersion: BROWSER_CONTROL_PROTOCOL_VERSION,
             operationId: request.operationId,
@@ -957,27 +958,25 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
                   message: "object storage is not configured",
                 });
               }
-              const files = await getFiles(deps.db, workspaceId, workspaceFileIds);
-              const byId = new Map(files.map((file) => [file.id, file]));
-              const ordered = workspaceFileIds.map((fileId) => byId.get(fileId));
-              if (ordered.some((file) => !file)) {
-                throw new HTTPException(404, { message: "workspace file not found" });
-              }
-              if (ordered.some((file) => file!.status !== "ready")) {
-                throw new HTTPException(409, { message: "workspace file is not ready" });
-              }
+              const files = await getFilesForSubject(deps.db, {
+                accountId: grant.accountId,
+                workspaceId,
+                subjectId: browserFileAuthoritySubjectId(grant, sourceAuthorization),
+                fileIds: workspaceFileIds,
+              });
+              const ordered = requireAuthorizedBrowserUploadFiles(workspaceFileIds, files);
               const authorities = await Promise.all(
                 ordered.map(async (file) => {
                   const signed = await deps.objectStorage!.createGetUrl({
-                    key: file!.objectKey,
+                    key: file.objectKey,
                     expiresInSeconds: BROWSER_WORKSPACE_FILE_AUTHORITY_TTL_SECONDS,
                     audience: signedUrlAudienceForPlacement(record.session.placement),
                   });
                   return {
-                    fileId: file!.id,
-                    safeFilename: browserUploadFilename(file!.safeFilename),
-                    sizeBytes: file!.sizeBytes,
-                    sha256: browserUploadSha256(file!.sha256),
+                    fileId: file.id,
+                    safeFilename: browserUploadFilename(file.safeFilename),
+                    sizeBytes: file.sizeBytes,
+                    sha256: browserUploadSha256(file.sha256),
                     download: {
                       url: signed.url,
                       expiresAt: signed.expiresAt.toISOString(),
@@ -2874,6 +2873,7 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
       record: BrowserSessionControlRecord;
       binding: NonNullable<BrowserSessionControlRecord["session"]["controller"]>;
       placement: BrowserPlacement;
+      sourceAuthorization: ResolvedSessionAuthorization | null;
     }) => Promise<T>,
     recoverMissing = true,
   ): Promise<T> {
@@ -2883,7 +2883,12 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
         workspaceId,
         browserSessionId,
       });
-      await authorizeSourceSession(deps, grant, record.sourceSessionId, authorizationOperation);
+      const sourceAuthorization = await authorizeSourceSession(
+        deps,
+        grant,
+        record.sourceSessionId,
+        authorizationOperation,
+      );
       if (record.session.lifecycle !== "active" || !record.session.controller) {
         throw new BrowserSessionStateError("BrowserSession is not active");
       }
@@ -2923,6 +2928,7 @@ export function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): voi
           record,
           binding,
           placement,
+          sourceAuthorization,
         };
         let result: T;
         try {
@@ -3792,9 +3798,9 @@ async function authorizeSourceSession(
   grant: AccessGrant,
   sessionId: string,
   operation: SessionAuthorizationOperation,
-): Promise<void> {
+): Promise<ResolvedSessionAuthorization | null> {
   try {
-    await requireSessionAuthorization(deps, grant, {
+    return await requireSessionAuthorization(deps, grant, {
       sessionId,
       operation,
       surface: "http",
@@ -4285,6 +4291,40 @@ function browserUploadFileIds(action: BrowserActionRequestValue["action"]): stri
   ];
 }
 
+/** Resolve Drive authority from the same immutable session authorization that
+ * admitted the browser action. Agent-attempt subjects are technical worker
+ * identities; their frozen initiating human is the only personal Drive
+ * principal. Pure service attempts retain null and can read only ordinary
+ * workspace files through the database predicate. */
+export function browserFileAuthoritySubjectId(
+  grant: AccessGrant,
+  authorization: ResolvedSessionAuthorization | null,
+): string | null {
+  if (!authorization) return grant.principalKind === "agent_attempt" ? null : grant.subjectId;
+  return authorization.actor.kind === "agent_attempt"
+    ? authorization.actor.initiatingHumanSubjectId
+    : authorization.actor.subjectId;
+}
+
+/** The batch authority query intentionally omits every unauthorized file. Any
+ * omission therefore fails the whole upload before an object-storage URL is
+ * minted, including mixed ordinary/Drive mappings and partially authorized
+ * batches. */
+export function requireAuthorizedBrowserUploadFiles(
+  workspaceFileIds: readonly string[],
+  authorizedFiles: readonly FileAsset[],
+): FileAsset[] {
+  const byId = new Map(authorizedFiles.map((file) => [file.id, file]));
+  return workspaceFileIds.map((fileId) => {
+    const file = byId.get(fileId);
+    if (!file) throw new HTTPException(404, { message: "workspace file not found" });
+    if (file.status !== "ready") {
+      throw new HTTPException(409, { message: "workspace file is not ready" });
+    }
+    return file;
+  });
+}
+
 function browserUploadFilename(value: string): string {
   const normalized = value
     .trim()

package/src/routes/connections.ts

@@ -557,6 +557,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       ...(c.req.query("code") ? { code: c.req.query("code") } : {}),
       ...(c.req.query("state") ? { state: c.req.query("state") } : {}),
       ...(c.req.query("error") ? { error: c.req.query("error") } : {}),
+      ...(c.req.query("picked_file_ids") ? { pickedFileIds: c.req.query("picked_file_ids") } : {}),
       requestUrl: c.req.url,
     };
     const result = await completeGoogleDriveOAuthCallback(deps, input);

package/src/routes/files.ts

@@ -24,9 +24,10 @@ import {
   getFileUpload,
   getGeneratedImageArtifact,
   getGeneratedVideoArtifact,
+  getFilesForSubject,
   getRetainedFileArtifact,
   getRetainedScreenshotArtifact,
-  requireFile,
+  requireFileForSubject,
   type RetainedFileArtifact,
   type GeneratedImageArtifact,
   type GeneratedVideoArtifact,
@@ -34,7 +35,11 @@ import {
 } from "@opengeni/db";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { requireAccessGrant } from "@opengeni/core";
+import {
+  requireAccessGrant,
+  requireLiveAgentAttemptAuthorization,
+  SessionAuthorizationDeniedError,
+} from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
@@ -265,8 +270,13 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/files/:fileId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "files:read");
-    const file = await requireFile(db, workspaceId, c.req.param("fileId")).catch(() => null);
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const file = await requireFileForSubject(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      fileId: c.req.param("fileId"),
+    }).catch(() => null);
     if (!file) {
       throw new HTTPException(404, { message: "file not found" });
     }
@@ -275,9 +285,14 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/artifacts/:artifactId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
     const artifactId = retainedArtifactId(c.req.param("artifactId"));
-    const artifact = await getWorkspaceArtifact(db, workspaceId, artifactId);
+    const artifact = await getWorkspaceArtifact(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: await fileAuthoritySubjectIdForGrant(deps, grant),
+      artifactId,
+    });
     if (!artifact) {
       return c.json(retainedArtifactUnavailable(artifactId, "deleted"), 404);
     }
@@ -286,9 +301,14 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/artifacts/:artifactId/content", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
     const artifactId = retainedArtifactId(c.req.param("artifactId"));
-    const artifact = await getWorkspaceArtifact(db, workspaceId, artifactId);
+    const artifact = await getWorkspaceArtifact(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: await fileAuthoritySubjectIdForGrant(deps, grant),
+      artifactId,
+    });
     if (!artifact) {
       return c.json(retainedArtifactUnavailable(artifactId, "deleted"), 404);
     }
@@ -378,13 +398,18 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/files/:fileId/download-url", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
     if (!objectStorage) {
       throw new HTTPException(503, {
         message: "object storage is not configured",
       });
     }
-    const file = await requireFile(db, workspaceId, c.req.param("fileId")).catch(() => null);
+    const file = await requireFileForSubject(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      fileId: c.req.param("fileId"),
+    }).catch(() => null);
     if (!file) {
       throw new HTTPException(404, { message: "file not found" });
     }
@@ -537,14 +562,18 @@ function retainedArtifactMetadata(artifact: RetainedFileArtifact): RetainedArtif
 
 async function getWorkspaceArtifact(
   db: ApiRouteDeps["db"],
-  workspaceId: string,
-  artifactId: string,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    artifactId: string;
+  },
 ): Promise<{ file: RetainedFileArtifact["file"]; metadata: RetainedArtifactMetadata } | null> {
-  const generated = await getGeneratedImageArtifact(db, workspaceId, artifactId);
+  const generated = await getGeneratedImageArtifact(db, input.workspaceId, input.artifactId);
   if (generated) {
     return { file: generated.file, metadata: retainedGeneratedImageMetadata(generated) };
   }
-  const generatedVideo = await getGeneratedVideoArtifact(db, workspaceId, artifactId);
+  const generatedVideo = await getGeneratedVideoArtifact(db, input.workspaceId, input.artifactId);
   if (generatedVideo && !generatedVideo.artifact.deletedAt) {
     const file = generatedVideoFileAsset(generatedVideo.file);
     return {
@@ -555,8 +584,43 @@ async function getWorkspaceArtifact(
       }),
     };
   }
-  const artifact = await getRetainedFileArtifact(db, workspaceId, artifactId);
-  return artifact ? { file: artifact.file, metadata: retainedArtifactMetadata(artifact) } : null;
+  const artifact = await getRetainedFileArtifact(db, input.workspaceId, input.artifactId);
+  if (!artifact) return null;
+  const [authorizedFile] = await getFilesForSubject(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    subjectId: input.subjectId,
+    fileIds: [artifact.file.id],
+  });
+  if (!authorizedFile) return null;
+  const authorizedArtifact = { ...artifact, file: authorizedFile };
+  return {
+    file: authorizedFile,
+    metadata: retainedArtifactMetadata(authorizedArtifact),
+  };
+}
+
+/** Human and stable service grants already carry their immutable subject.
+ * Agent tokens carry only a technical worker subject, so resolve the exact
+ * live attempt and use the initiating human frozen on its durable turn. */
+export async function fileAuthoritySubjectIdForGrant(
+  deps: Pick<ApiRouteDeps, "db">,
+  grant: import("@opengeni/contracts").AccessGrant,
+): Promise<string | null> {
+  if (grant.principalKind !== "agent_attempt") return grant.subjectId;
+  const sessionId = grant.metadata?.["sessionId"];
+  if (typeof sessionId !== "string") {
+    throw new HTTPException(404, { message: "file not found" });
+  }
+  try {
+    const actor = await requireLiveAgentAttemptAuthorization(deps.db, grant, sessionId);
+    return actor.initiatingHumanSubjectId;
+  } catch (error) {
+    if (error instanceof SessionAuthorizationDeniedError) {
+      throw new HTTPException(404, { message: "file not found", cause: error });
+    }
+    throw error;
+  }
 }
 
 function generatedVideoFileAsset(

package/src/routes/sessions.ts

@@ -2257,7 +2257,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     const result = await acceptSessionUserMessage(deps, grant, workspaceId, sessionId, {
       text: payload.text,
       annotations: payload.annotations,
-      turnInstructions: payload.turnInstructions ?? null,
+      modelContext: payload.modelContext ?? null,
       resources: payload.resources,
       model: payload.model ?? null,
       reasoningEffort: payload.reasoningEffort ?? null,
@@ -2300,7 +2300,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       const { accepted } = await acceptSessionUserMessage(deps, grant, workspaceId, sessionId, {
         text: event.payload.text,
         annotations: event.payload.annotations,
-        turnInstructions: event.payload.turnInstructions ?? null,
+        modelContext: event.payload.modelContext ?? null,
         resources: event.payload.resources ?? [],
         model: event.payload.model ?? null,
         reasoningEffort: event.payload.reasoningEffort ?? null,