@opengeni/api-router 0.30.1 → 1.0.0

package/src/routes/plugins.ts

@@ -1,3 +1,12 @@
+import pluginSnapshot from "../../../../data/catalog/plugins-snapshot.json";
+import { marketplacePlugin } from "../integrations/marketplace-plugin";
+import { mcpEndpointIdentity } from "@opengeni/contracts";
+import {
+  buildCapabilityCatalog,
+  createCatalogItem,
+  integrationSourceForOrganizationPolicy,
+} from "@opengeni/core";
+import { withOrganizationIntegrationPolicyFence } from "@opengeni/db/organization-integration-policy";
 import { createHash } from "node:crypto";
 
 import {
@@ -18,15 +27,18 @@ import {
   UninstallPluginResult,
   stableJson,
   type PluginComponentPreview,
+  type SkillActor,
 } from "@opengeni/contracts";
 import {
   portableSkillCapabilityId,
   portableSkillPluginKey,
   requireAccessGrant,
+  requireAccessGrantAuthorization,
   resolveSkillImport,
   type ApiRouteDeps,
   type GitHubSkillSourceClient,
 } from "@opengeni/core";
+import { skillInstallerActor, skillRemovalActor } from "./skill-install-authority";
 import {
   buildConnectionTokenResolver,
   CapabilityComponentVersionConflictError,
@@ -36,10 +48,12 @@ import {
   getConnectionMetadata,
   getInstalledPluginPackage,
   getPluginPackageUninstallPreview,
+  PluginUninstallPreviewChangedError,
   integrationBindingKey,
   installApiIntegration,
   installPluginMcpReference,
   installPortableSkill,
+  SkillSourceRemovalAuthorityError,
   listInstalledPluginPackages,
   PluginInstallationVersionConflictError,
   PluginInstallationVersionRequiredError,
@@ -58,6 +72,7 @@ import {
   type ResolvedApiIntegrationPreview,
 } from "../integrations/api-integrations";
 import { createGitHubSkillSourceClient } from "../integrations/github-skill-source";
+import { parseRequestJson } from "../http/request-body";
 
 const MAX_PLUGIN_MANIFEST_BYTES = 1024 * 1024;
 
@@ -71,6 +86,7 @@ type ResolvedPluginComponent = {
   install(ownerPluginInstallationId: string): Promise<{
     facetInstallationIds: string[];
     bindingIds?: string[];
+    skillReceipt?: import("@opengeni/contracts").SkillWriteReceipt;
   }>;
 };
 
@@ -96,15 +112,84 @@ export function registerPluginRoutes(
     await requireAccessGrant(c, deps, workspaceId, "workspace:read");
     return c.json(
       ListInstalledPluginsResponse.parse({
-        plugins: await listInstalledPluginPackages(deps.db, workspaceId),
+        plugins: (await listInstalledPluginPackages(deps.db, workspaceId)).map((plugin) => {
+          const source = pluginSnapshot.sources.find((candidate) =>
+            plugin.pluginKey.startsWith("marketplace/" + candidate.provider + "/"),
+          );
+          const entry = source?.entries.find(
+            (candidate) =>
+              plugin.pluginKey === "marketplace/" + source!.provider + "/" + candidate.name,
+          );
+          return { ...plugin, logoUrl: plugin.logoUrl ?? entry?.logoUrl ?? null };
+        }),
       }),
     );
   });
 
+  app.get("/v1/workspaces/:workspaceId/plugins/details", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const plugin = await getInstalledPluginPackage(
+      deps.db,
+      workspaceId,
+      c.req.query("pluginKey") ?? "",
+    );
+    if (!plugin || plugin.status === "disabled")
+      throw new HTTPException(404, { message: "Plugin is not installed" });
+    const stored = plugin.manifest as Record<string, any>;
+    if (stored.discovery) return c.json(stored.discovery);
+    const catalog = await buildCapabilityCatalog({
+      db: deps.db,
+      workspaceId,
+      settings: deps.settings,
+      subjectId: grant.subjectId,
+    });
+    const members = Array.isArray(stored.components) ? stored.components : [];
+    return c.json({
+      id: String(stored.pluginKey ?? "installed")
+        .replace("marketplace/", "")
+        .replace("/", ":"),
+      name: stored.name,
+      displayName: stored.name,
+      description: stored.description ?? "",
+      longDescription: stored.description ?? "",
+      provider: "custom",
+      category: stored.category ?? null,
+      logoUrl: null,
+      darkLogoUrl: null,
+      sourceUrl: stored.sourceUrl ?? null,
+      author: null,
+      version: stored.version,
+      skills: members
+        .filter((member) => member.kind === "skill")
+        .map((member) => ({
+          name: decodeURIComponent(member.url.split("/").filter(Boolean).at(-2) ?? member.key),
+          sourceUrl: member.url,
+        })),
+      mcpServers: members
+        .filter((member) => member.kind === "mcp")
+        .map((member) => {
+          const bom = Array.isArray(stored.bom)
+            ? stored.bom.find((entry: any) => entry.key === member.key)
+            : null;
+          const item = catalog.items.find((candidate) => candidate.id === bom?.capabilityId);
+          return {
+            name: item?.name ?? member.serverId,
+            transport: item?.transport ?? "http",
+            endpoint: item?.endpointUrl ?? null,
+          };
+        }),
+      components: [
+        ...new Set(members.map((member) => (member.kind === "skill" ? "skills" : member.kind))),
+      ],
+      installation: "installed",
+    });
+  });
+
   app.post("/v1/workspaces/:workspaceId/plugins/preview", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const payload = PreviewPluginRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, PreviewPluginRequest);
     const resolved = await resolvePluginPackage({
       deps,
       github,
@@ -120,9 +205,16 @@ export function registerPluginRoutes(
 
   app.post("/v1/workspaces/:workspaceId/plugins/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const payload = InstallPluginRequest.parse(await c.req.json());
+    const access = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "capabilities:manage",
+    );
+    const { grant } = access;
+    const payload = await parseRequestJson(c, InstallPluginRequest);
     const resolved = await resolvePluginPackage({
+      skillActor: () => skillInstallerActor(access),
       deps,
       github,
       transport,
@@ -188,11 +280,13 @@ export function registerPluginRoutes(
     const retainedFacetInstallationIds: string[] = [];
     const retainedBindingIds: string[] = [];
     const completedKeys: string[] = [];
+    const skillWrites: import("@opengeni/contracts").SkillWriteReceipt[] = [];
     let activeComponentKey = "none";
     try {
       for (const component of resolved.components) {
         activeComponentKey = component.preview.key;
         const installed = await component.install(prepared.pluginInstallationId);
+        if (installed.skillReceipt) skillWrites.push(installed.skillReceipt);
         retainedFacetInstallationIds.push(...installed.facetInstallationIds);
         retainedBindingIds.push(...(installed.bindingIds ?? []));
         completedKeys.push(component.preview.key);
@@ -204,6 +298,7 @@ export function registerPluginRoutes(
         });
       }
       const result = InstalledPlugin.parse({
+        ...(skillWrites.length ? { skillWrites } : {}),
         pluginKey: prepared.pluginKey,
         version: prepared.version,
         pluginId: prepared.pluginId,
@@ -213,7 +308,9 @@ export function registerPluginRoutes(
         componentCount: resolved.components.length,
         status: "installed",
       });
-      await finalizePluginPackageInstall(deps.db, {
+      const removalActor = skillRemovalActor(access);
+      const { skillReleases, skillPublications } = await finalizePluginPackageInstall(deps.db, {
+        ...(removalActor ? { skillActor: removalActor } : {}),
         accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
@@ -223,7 +320,14 @@ export function registerPluginRoutes(
         retainedBindingIds,
         result,
       });
-      return c.json(result, resolved.preview.installed ? 200 : 201);
+      return c.json(
+        {
+          ...result,
+          ...(skillReleases.length ? { skillReleases } : {}),
+          ...(skillPublications.length ? { skillPublications } : {}),
+        },
+        resolved.preview.installed ? 200 : 201,
+      );
     } catch (error) {
       await deferPluginPackageOperation(deps.db, {
         workspaceId,
@@ -231,6 +335,8 @@ export function registerPluginRoutes(
         phase: `component_failed:${activeComponentKey}`,
         errorCode: pluginFailureCode(error),
       }).catch(() => undefined);
+      if (error instanceof SkillSourceRemovalAuthorityError)
+        throw new HTTPException(403, { message: error.message });
       if (error instanceof HTTPException) throw error;
       if (error instanceof CapabilityComponentVersionConflictError) {
         throw new HTTPException(409, {
@@ -245,32 +351,67 @@ export function registerPluginRoutes(
 
   app.get("/v1/workspaces/:workspaceId/plugins/:pluginKey/uninstall-preview", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
     const pluginKey = decodeURIComponent(c.req.param("pluginKey"));
-    const preview = await getPluginPackageUninstallPreview(deps.db, workspaceId, pluginKey);
+    const preview = await getPluginPackageUninstallPreview(
+      deps.db,
+      workspaceId,
+      pluginKey,
+      grant.subjectId,
+    );
     return c.json(PluginUninstallPreview.parse({ pluginKey, ...preview }));
   });
 
   app.delete("/v1/workspaces/:workspaceId/plugins/:pluginKey", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const access = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "capabilities:manage",
+    );
+    const { grant } = access;
+    const skillActor = skillRemovalActor(access);
     const pluginKey = decodeURIComponent(c.req.param("pluginKey"));
-    const payload = UninstallPluginRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, UninstallPluginRequest);
     try {
       return c.json(
         UninstallPluginResult.parse({
           pluginKey,
           ...(await uninstallPluginPackage(deps.db, {
+            ...(skillActor ? { skillActor } : {}),
             accountId: grant.accountId,
             workspaceId,
             subjectId: grant.subjectId,
             pluginKey,
             expectedInstallationVersion: payload.expectedInstallationVersion,
+            ...(payload.expectedPreviewToken
+              ? { expectedPreviewToken: payload.expectedPreviewToken }
+              : {}),
             idempotencyKey: payload.idempotencyKey,
           })),
         }),
       );
     } catch (error) {
+      if (error instanceof PluginUninstallPreviewChangedError) {
+        const preview = error.preview ?? {
+          pluginKey,
+          ...(await getPluginPackageUninstallPreview(
+            deps.db,
+            workspaceId,
+            pluginKey,
+            grant.subjectId,
+          )),
+        };
+        return c.json(
+          {
+            code: error.code,
+            message: error.message,
+            preview: PluginUninstallPreview.parse(preview),
+          },
+          409,
+        );
+      }
       throw pluginMutationHttpError(error);
     }
   });
@@ -283,6 +424,7 @@ async function resolvePluginPackage(input: {
   accountId: string;
   workspaceId: string;
   subjectId: string;
+  skillActor?: () => SkillActor;
   url: string;
   bindings: Record<
     string,
@@ -294,15 +436,20 @@ async function resolvePluginPackage(input: {
   >;
 }): Promise<ResolvedPluginPackage> {
   let manifest;
+  const marketplace = marketplacePlugin(input.url);
   try {
-    const bytes = await fetchIntegrationSourceDocument(
-      input.transport,
-      input.url,
-      MAX_PLUGIN_MANIFEST_BYTES,
-    );
-    manifest = PluginManifest.parse(
-      JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)),
-    );
+    if (marketplace) {
+      manifest = marketplace.manifest;
+    } else {
+      const bytes = await fetchIntegrationSourceDocument(
+        input.transport,
+        input.url,
+        MAX_PLUGIN_MANIFEST_BYTES,
+      );
+      manifest = PluginManifest.parse(
+        JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)),
+      );
+    }
   } catch (error) {
     if (error instanceof HTTPException) throw error;
     throw new HTTPException(422, {
@@ -311,6 +458,14 @@ async function resolvePluginPackage(input: {
   }
   const manifestDigest = sha256(stableJson(manifest));
   const components: ResolvedPluginComponent[] = [];
+  const catalog = marketplace
+    ? await buildCapabilityCatalog({
+        db: input.deps.db,
+        workspaceId: input.workspaceId,
+        settings: input.deps.settings,
+        subjectId: input.subjectId,
+      })
+    : null;
   for (const component of manifest.components) {
     if (component.kind === "skill") {
       const resolved = await resolveSkillImport(component.url, input.github);
@@ -342,10 +497,13 @@ async function resolvePluginPackage(input: {
           },
         },
         install: async (ownerPluginInstallationId) => {
+          if (!input.skillActor)
+            throw new HTTPException(403, { message: "Skill installer authority is missing" });
           const summaries = new Map(
             resolved.preview.files.map((file) => [file.path, file] as const),
           );
           const installed = await installPortableSkill(input.deps.db, {
+            skillActor: input.skillActor(),
             accountId: input.accountId,
             workspaceId: input.workspaceId,
             subjectId: input.subjectId,
@@ -366,12 +524,20 @@ async function resolvePluginPackage(input: {
             }),
             owner: { kind: "plugin", id: ownerPluginInstallationId, removable: true },
           });
-          return { facetInstallationIds: [installed.facetInstallationId] };
+          return {
+            facetInstallationIds: [installed.facetInstallationId],
+            skillReceipt: installed.skillReceipt,
+          };
         },
       });
       continue;
     }
     if (component.kind === "integration") {
+      const source = await withOrganizationIntegrationPolicyFence(
+        input.deps.db,
+        input,
+        async (_tx, policy) => integrationSourceForOrganizationPolicy(policy, component.source),
+      );
       const requestedBinding = input.bindings[component.key];
       const connection = await optionalConnection(
         input.deps,
@@ -380,7 +546,7 @@ async function resolvePluginPackage(input: {
         requestedBinding?.connectionId,
       );
       const resolved = await resolveApiIntegrationPreview({
-        source: component.source,
+        source,
         connection: connectionDescriptor(connection),
         transport: input.transport,
         authority: {
@@ -470,7 +636,62 @@ async function resolvePluginPackage(input: {
       });
       continue;
     }
-    const server = configuredMcpServer(input.deps.settings.mcpServers, component.serverId);
+    const server = configuredMcpServer(
+      [...(marketplace?.servers ?? []), ...input.deps.settings.mcpServers],
+      component.serverId,
+    );
+    if (marketplace) {
+      const endpoint = mcpEndpointIdentity(server.url)!;
+      const matches = (catalog?.items ?? []).filter(
+        (item) => item.kind === "mcp" && mcpEndpointIdentity(item.endpointUrl) === endpoint,
+      );
+      // Prefer the original catalogue connection over legacy plugin-created duplicates.
+      matches.sort(
+        (a, b) =>
+          Number(a.id.startsWith("mcp:configured:marketplace-")) -
+            Number(b.id.startsWith("mcp:configured:marketplace-")) ||
+          Number(b.enabled) - Number(a.enabled) ||
+          a.id.localeCompare(b.id),
+      );
+      const existing = matches[0];
+      const capabilityId = existing?.id ?? "mcp:endpoint:" + sha256(endpoint).slice(0, 24);
+      const digest = sha256(stableJson({ endpoint, capabilityId }));
+      components.push({
+        preview: {
+          key: component.key,
+          kind: "mcp",
+          name: existing?.name ?? server.name ?? server.id,
+          capabilityId,
+          digest,
+          connectionRequired: !existing?.enabled,
+          connectionId: null,
+          instanceKey: null,
+          displayName: null,
+          facts: { endpointUrl: endpoint, connectionManagedSeparately: true },
+        },
+        install: async () => {
+          if (!existing)
+            await createCatalogItem({
+              db: input.deps.db,
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              payload: {
+                id: capabilityId,
+                kind: "mcp",
+                source: "manual",
+                name: server.name ?? server.id,
+                endpointUrl: endpoint,
+                category: "integrations",
+                tags: ["mcp"],
+                metadata: { authDiscovery: "unknown" },
+              },
+            });
+          // Connections are independently owned: installing/removing a plugin never signs in or disconnects an account.
+          return { facetInstallationIds: [] };
+        },
+      });
+      continue;
+    }
     const digest = sha256(stableJson(safeMcpFacts(server)));
     components.push({
       preview: {
@@ -543,7 +764,13 @@ async function resolvePluginPackage(input: {
       components: components.map((component) => component.preview),
       diff,
     }),
-    storedManifest: { ...manifest, sourceUrl: input.url, manifestDigest, bom },
+    storedManifest: {
+      ...manifest,
+      ...(marketplace ? { discovery: marketplace.discovery } : {}),
+      sourceUrl: input.url,
+      manifestDigest,
+      bom,
+    },
     components,
   };
 }
@@ -725,6 +952,8 @@ function pluginDiff(
 }
 
 function pluginMutationHttpError(error: unknown): HTTPException {
+  if (error instanceof SkillSourceRemovalAuthorityError)
+    return new HTTPException(403, { message: error.message });
   if (error instanceof PluginOperationIdempotencyError) {
     return new HTTPException(409, { message: "Plugin idempotency key was already used" });
   }