@opengeni/api-router 0.30.1 → 1.0.0

package/src/routes/pr-review.ts

@@ -0,0 +1,622 @@
+import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import { withOrganizationIntegrationAcquisition } from "@opengeni/db/organization-integration-policy";
+import {
+  CreatePrReviewAppRegistrationRequest,
+  CreatePrReviewRepositoryBindingRequest,
+  PrReviewAppRegistration,
+  PrReviewRepositoryBinding,
+  UpdatePrReviewAppRegistrationRequest,
+  UpdatePrReviewRepositoryBindingRequest,
+} from "@opengeni/contracts";
+import {
+  assertWorkspaceModelPolicyAllows,
+  canonicalConfiguredModel,
+  defaultPrReviewProviderBaseUrl,
+  workspaceCustomModelReference,
+  lockActiveCustomModelForAdmission,
+  modelUnavailableHttpException,
+  prReviewWebhookAuthKind,
+  normalizePrReviewProviderBaseUrl,
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  requirePermission,
+  resolveWorkspaceCatalogSettings,
+  type ApiRouteDeps,
+  PR_REVIEW_AUTOMATION_SETUP,
+} from "@opengeni/core";
+import {
+  createPrReviewAppRegistration,
+  createPrReviewRepositoryBinding,
+  deletePrReviewAppRegistration,
+  deletePrReviewRepositoryBinding,
+  decryptVariableSetValue,
+  encryptVariableSetValue,
+  getPrReviewAppRegistrationSecret,
+  listPrReviewAppRegistrations,
+  listPrReviewRepositoryBindings,
+  nestedPostgresSqlState,
+  recordAuditEvent,
+  updatePrReviewAppRegistration,
+  updatePrReviewRepositoryBinding,
+} from "@opengeni/db";
+import { listGitHubAppRepositoriesWithSigningSettings } from "@opengeni/github";
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import {
+  PrReviewProviderRepositoryError,
+  verifyPrReviewProviderRepository,
+} from "../integrations/pr-review-provider";
+import { registerPrReviewGitHubRoutes } from "./pr-review-github";
+import { integrationCommitGrant } from "../integrations/integration-commit-authority";
+import { parseRequestJson } from "../http/request-body";
+
+export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const { db, settings } = deps;
+  registerPrReviewGitHubRoutes(app, deps);
+
+  app.get("/v1/workspaces/:workspaceId/pr-review/registrations", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+
+    return c.json({
+      registrations: await listPrReviewAppRegistrations(db, grant.accountId, workspaceId),
+      repositories: await listPrReviewRepositoryBindings(db, grant.accountId, workspaceId),
+    });
+  });
+
+  app.post("/v1/workspaces/:workspaceId/pr-review/registrations", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    requirePermission(grant, "secrets:write");
+
+    assertPrReviewSandboxBackend(deps);
+    const payload = await parseRequestJson(c, CreatePrReviewAppRegistrationRequest);
+    const encryptionKey = requirePrReviewEncryptionKey(deps);
+    let providerBaseUrl: string;
+    try {
+      providerBaseUrl = normalizePrReviewProviderBaseUrl(
+        payload.provider,
+        payload.providerBaseUrl ?? defaultPrReviewProviderBaseUrl(payload.provider),
+      );
+    } catch (error) {
+      throw new HTTPException(422, {
+        message:
+          error instanceof Error
+            ? error.message
+            : "PR Review providerBaseUrl must be a credential-free HTTPS origin or path",
+      });
+    }
+    if (
+      payload.provider === "azure_devops" &&
+      new URL(providerBaseUrl).pathname.split("/").filter(Boolean).length === 0
+    ) {
+      throw new HTTPException(422, {
+        message: "Azure DevOps PR Review providerBaseUrl must include the organization path",
+      });
+    }
+    const registration = await mapPrReviewUniqueConflict(
+      withOrganizationIntegrationAcquisition(
+        db,
+        grant,
+        [prReviewIntegrationKey(payload.provider)],
+        (tx) =>
+          createPrReviewAppRegistration(tx, {
+            accountId: grant.accountId,
+            workspaceId,
+            name: payload.name,
+            provider: payload.provider,
+            providerBaseUrl,
+            appId: payload.appId ?? null,
+            credentialKind: payload.credentialKind,
+            credentialEncrypted: encryptVariableSetValue(
+              encryptionKey,
+              payload.privateKey ?? payload.accessToken!,
+            ),
+            accessTokenExpiresAt: payload.accessTokenExpiresAt
+              ? new Date(payload.accessTokenExpiresAt)
+              : null,
+            webhookAuthKind: prReviewWebhookAuthKind(payload.provider),
+            webhookSecretEncrypted: encryptVariableSetValue(encryptionKey, payload.webhookSecret),
+            webhookUsername: payload.webhookUsername ?? null,
+            createdBySubjectId: grant.subjectId,
+          }),
+      ),
+      "A PR Review registration with this provider and name already exists",
+    );
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: "prReview.app_registration.created",
+      targetType: "pr_review_app_registration",
+      targetId: registration.id,
+      metadata: {
+        provider: registration.provider,
+        credentialKind: registration.credentialKind,
+        webhookAuthKind: registration.webhookAuthKind,
+      },
+    });
+    return c.json(PrReviewAppRegistration.parse(registration), 201);
+  });
+
+  app.patch("/v1/workspaces/:workspaceId/pr-review/registrations/:registrationId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    requirePermission(grant, "secrets:write");
+
+    const payload = await parseRequestJson(c, UpdatePrReviewAppRegistrationRequest);
+    const existing = await getPrReviewAppRegistrationSecret(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      registrationId: c.req.param("registrationId"),
+    });
+    if (!existing)
+      throw new HTTPException(404, {
+        message: "PR Review app registration not found",
+      });
+    if (existing.credentialKind === "managed_github_app") {
+      if (
+        payload.accessToken !== undefined ||
+        payload.privateKey !== undefined ||
+        payload.webhookSecret !== undefined ||
+        payload.webhookUsername !== undefined ||
+        payload.accessTokenExpiresAt !== undefined
+      ) {
+        throw new HTTPException(422, {
+          message: "Opengeni Lens credentials are managed by the deployment",
+        });
+      }
+      if (payload.status === "active") {
+        throw new HTTPException(409, {
+          message: "Reconnect Opengeni Lens to reactivate and resync its repositories",
+        });
+      }
+    }
+    if (payload.accessToken && existing.credentialKind !== "provider_token") {
+      throw new HTTPException(422, {
+        message: "GitHub App registrations accept private keys, not access tokens",
+      });
+    }
+    if (payload.privateKey && existing.credentialKind !== "github_app") {
+      throw new HTTPException(422, {
+        message: "Provider-token registrations do not accept GitHub private keys",
+      });
+    }
+    if (
+      payload.accessTokenExpiresAt !== undefined &&
+      existing.credentialKind !== "provider_token"
+    ) {
+      throw new HTTPException(422, {
+        message: "GitHub App registrations do not accept access-token expiry",
+      });
+    }
+    const encryptionKey =
+      payload.privateKey || payload.accessToken || payload.webhookSecret
+        ? requirePrReviewEncryptionKey(deps)
+        : null;
+    const updated = await mapPrReviewUniqueConflict(
+      updatePrReviewAppRegistration(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        registrationId: existing.id,
+        ...(payload.name !== undefined ? { name: payload.name } : {}),
+        ...(payload.accessToken !== undefined
+          ? {
+              credentialEncrypted: encryptVariableSetValue(encryptionKey!, payload.accessToken),
+            }
+          : {}),
+        ...(payload.privateKey !== undefined
+          ? {
+              credentialEncrypted: encryptVariableSetValue(encryptionKey!, payload.privateKey),
+            }
+          : {}),
+        ...(payload.accessTokenExpiresAt !== undefined
+          ? {
+              accessTokenExpiresAt: payload.accessTokenExpiresAt
+                ? new Date(payload.accessTokenExpiresAt)
+                : null,
+            }
+          : {}),
+        ...(payload.webhookSecret !== undefined
+          ? {
+              webhookSecretEncrypted: encryptVariableSetValue(
+                encryptionKey!,
+                payload.webhookSecret,
+              ),
+            }
+          : {}),
+        ...(payload.webhookUsername !== undefined
+          ? { webhookUsername: payload.webhookUsername }
+          : {}),
+        ...(payload.status !== undefined ? { status: payload.status } : {}),
+      }),
+      "A PR Review registration with this provider and name already exists",
+    );
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: "prReview.app_registration.updated",
+      targetType: "pr_review_app_registration",
+      targetId: existing.id,
+      metadata: {
+        fields: Object.keys(payload).filter(
+          (field) => field !== "accessToken" && field !== "privateKey" && field !== "webhookSecret",
+        ),
+        credentialRotated: payload.accessToken !== undefined || payload.privateKey !== undefined,
+        webhookSecretRotated: payload.webhookSecret !== undefined,
+      },
+    });
+    return c.json(PrReviewAppRegistration.parse(updated));
+  });
+
+  app.delete("/v1/workspaces/:workspaceId/pr-review/registrations/:registrationId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    requirePermission(grant, "secrets:write");
+    const deleted = await deletePrReviewAppRegistration(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      registrationId: c.req.param("registrationId"),
+    });
+    if (!deleted)
+      throw new HTTPException(404, {
+        message: "PR Review app registration not found",
+      });
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: "prReview.app_registration.disabled",
+      targetType: "pr_review_app_registration",
+      targetId: c.req.param("registrationId"),
+      metadata: {},
+    });
+    return c.body(null, 204);
+  });
+
+  app.post("/v1/workspaces/:workspaceId/pr-review/repositories", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await integrationCommitGrant(
+      await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:admin"),
+      ["workspace:admin"],
+      { settings: deps.settings, authorizationHeader: c.req.header("authorization") },
+    );
+
+    const payload = await parseRequestJson(c, CreatePrReviewRepositoryBindingRequest);
+    const registration = await getPrReviewAppRegistrationSecret(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      registrationId: payload.registrationId,
+    });
+    if (!registration)
+      throw new HTTPException(404, {
+        message: "PR Review app registration not found",
+      });
+    const integrationKey = prReviewIntegrationKey(registration.provider);
+    await withOrganizationIntegrationAcquisition(db, grant, [integrationKey], async () => {});
+    const repositoryUrl = new URL(payload.repositoryUri);
+    let canonicalRepositoryUri = repositoryUrl.href;
+    let canonicalRepositoryFullName = payload.repositoryFullName;
+    let canonicalProviderRepositoryId = String(payload.providerRepositoryId);
+    let canonicalProjectId = payload.projectId === undefined ? null : String(payload.projectId);
+    const providerUrl = new URL(registration.providerBaseUrl);
+    const providerPath = providerUrl.pathname.replace(/\/$/, "");
+    if (
+      repositoryUrl.protocol !== "https:" ||
+      repositoryUrl.username ||
+      repositoryUrl.password ||
+      repositoryUrl.host.toLowerCase() !== providerUrl.host.toLowerCase() ||
+      (providerPath !== "" &&
+        providerPath !== "/" &&
+        !repositoryUrl.pathname.startsWith(`${providerPath}/`))
+    ) {
+      throw new HTTPException(422, {
+        message:
+          "repositoryUri must be a credential-free HTTPS URL on the registered provider host",
+      });
+    }
+    if (registration.provider === "github") {
+      const installationId = positiveInteger(payload.installationId);
+      const repositoryId = positiveInteger(payload.providerRepositoryId);
+      if (!installationId || !repositoryId || !registration.appId) {
+        throw new HTTPException(422, {
+          message: "GitHub repository bindings require App, installation, and repository IDs",
+        });
+      }
+      const encryptionKey = requirePrReviewEncryptionKey(deps);
+      if (!registration.credentialEncrypted) {
+        throw new HTTPException(409, {
+          message: "PR Review GitHub App credential is unavailable",
+        });
+      }
+      let allowedRepositories;
+      try {
+        allowedRepositories = await listGitHubAppRepositoriesWithSigningSettings(
+          {
+            githubAppId: registration.appId,
+            githubAppPrivateKey: decryptVariableSetValue(
+              encryptionKey,
+              registration.credentialEncrypted,
+            ),
+          },
+          { installationIds: [installationId] },
+        );
+      } catch {
+        throw new HTTPException(502, {
+          message: "Could not verify the repository against the registered GitHub App",
+        });
+      }
+      const allowedRepository = allowedRepositories.find(
+        (candidate) =>
+          candidate.id === repositoryId &&
+          candidate.fullName.toLowerCase() === payload.repositoryFullName.toLowerCase(),
+      );
+      if (!allowedRepository) {
+        throw new HTTPException(403, {
+          message: "GitHub repository is not installed for this PR Review App",
+        });
+      }
+      canonicalRepositoryUri = allowedRepository.cloneUrl;
+      canonicalRepositoryFullName = allowedRepository.fullName;
+      canonicalProviderRepositoryId = String(allowedRepository.id);
+    }
+    if (registration.provider !== "github") {
+      if (
+        registration.accessTokenExpiresAt &&
+        Date.parse(registration.accessTokenExpiresAt) <= Date.now()
+      ) {
+        throw new HTTPException(409, {
+          message: "PR Review provider credential has expired",
+        });
+      }
+      const encryptionKey = requirePrReviewEncryptionKey(deps);
+      if (!registration.credentialEncrypted) {
+        throw new HTTPException(409, {
+          message: "PR Review provider credential is unavailable",
+        });
+      }
+      try {
+        const verified = await verifyPrReviewProviderRepository({
+          provider: registration.provider,
+          providerBaseUrl: registration.providerBaseUrl,
+          providerRepositoryId: String(payload.providerRepositoryId),
+          ...(payload.projectId !== undefined ? { projectId: String(payload.projectId) } : {}),
+          token: decryptVariableSetValue(encryptionKey, registration.credentialEncrypted),
+          username: registration.webhookUsername,
+          settings,
+        });
+        canonicalRepositoryUri = verified.repositoryUri;
+        canonicalRepositoryFullName = verified.repositoryFullName;
+        canonicalProviderRepositoryId = verified.providerRepositoryId;
+        canonicalProjectId = verified.projectId;
+      } catch (error) {
+        if (error instanceof PrReviewProviderRepositoryError) {
+          const status =
+            error.reason === "denied" ? 403 : error.reason === "identity_mismatch" ? 422 : 502;
+          throw new HTTPException(status, { message: error.message });
+        }
+        throw error;
+      }
+    }
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
+    const model = payload.model
+      ? (canonicalConfiguredModel(catalogSettings, payload.model) ?? null)
+      : null;
+    if (model) await assertWorkspaceModelPolicyAllows(db, catalogSettings, workspaceId, model);
+    const beforeCreateCommit = model
+      ? prReviewCustomModelCommitGuard({
+          settings: catalogSettings,
+          accountId: grant.accountId,
+          workspaceId,
+          modelId: model,
+        })
+      : undefined;
+    const template = PR_REVIEW_AUTOMATION_SETUP;
+
+    const binding = await mapPrReviewUniqueConflict(
+      withOrganizationIntegrationAcquisition(db, grant, [integrationKey], async (tx) => {
+        await grant.authorizeCommit(tx);
+        return createPrReviewRepositoryBinding(tx, {
+          accountId: grant.accountId,
+          workspaceId,
+          registrationId: registration.id,
+          provider: registration.provider,
+          repositoryUri: canonicalRepositoryUri,
+          repositoryFullName: canonicalRepositoryFullName,
+          providerRepositoryId: canonicalProviderRepositoryId,
+          installationId:
+            payload.installationId === undefined ? null : String(payload.installationId),
+          projectId: canonicalProjectId,
+          model,
+          additionalInstructions: payload.additionalInstructions ?? null,
+          status: payload.status,
+          createdBySubjectId: grant.subjectId,
+
+          adapterId: template.adapterId,
+          eventTypes: template.eventTypes,
+          configuration: template.configuration,
+          sessionTemplate: template.sessionTemplate,
+          ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
+        });
+      }),
+      "This repository is already bound to the selected PR Review registration",
+    );
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: "prReview.repository_binding.created",
+      targetType: "pr_review_repository_binding",
+      targetId: binding.id,
+      metadata: {
+        provider: binding.provider,
+        registrationId: binding.registrationId,
+        providerRepositoryId: binding.providerRepositoryId,
+      },
+    });
+    return c.json(PrReviewRepositoryBinding.parse(binding), 201);
+  });
+
+  app.patch("/v1/workspaces/:workspaceId/pr-review/repositories/:bindingId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+
+    const payload = await parseRequestJson(c, UpdatePrReviewRepositoryBindingRequest);
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
+    const model =
+      payload.model === undefined
+        ? undefined
+        : payload.model === null
+          ? null
+          : (canonicalConfiguredModel(catalogSettings, payload.model) ?? null);
+    if (model) await assertWorkspaceModelPolicyAllows(db, catalogSettings, workspaceId, model);
+    const beforeUpdateCommit = async (
+      tx: ApiRouteDeps["db"],
+      context: {
+        currentModel: string | null;
+        currentStatus: "active" | "disabled";
+        nextModel: string | null;
+        nextStatus: "active" | "disabled";
+      },
+    ): Promise<void> => {
+      const materialExecutionChange =
+        payload.model !== undefined ||
+        payload.additionalInstructions !== undefined ||
+        (context.currentStatus === "disabled" && context.nextStatus === "active");
+      if (!materialExecutionChange || !context.nextModel) return;
+      await prReviewCustomModelCommitGuard({
+        settings: catalogSettings,
+        accountId: grant.accountId,
+        workspaceId,
+        modelId: context.nextModel,
+      })?.(tx);
+    };
+    const binding = await updatePrReviewRepositoryBinding(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      bindingId: c.req.param("bindingId"),
+      subjectId: grant.subjectId,
+      ...(model !== undefined ? { model } : {}),
+      ...(payload.additionalInstructions !== undefined
+        ? { additionalInstructions: payload.additionalInstructions }
+        : {}),
+      ...(payload.status !== undefined ? { status: payload.status } : {}),
+      beforeUpdateCommit,
+    });
+    if (!binding)
+      throw new HTTPException(404, {
+        message: "PR Review repository binding not found",
+      });
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: "prReview.repository_binding.updated",
+      targetType: "pr_review_repository_binding",
+      targetId: binding.id,
+      metadata: { fields: Object.keys(payload) },
+    });
+    return c.json(PrReviewRepositoryBinding.parse(binding));
+  });
+
+  app.delete("/v1/workspaces/:workspaceId/pr-review/repositories/:bindingId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const deleted = await deletePrReviewRepositoryBinding(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      bindingId: c.req.param("bindingId"),
+      subjectId: grant.subjectId,
+    });
+    if (!deleted)
+      throw new HTTPException(404, {
+        message: "PR Review repository binding not found",
+      });
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: "prReview.repository_binding.disabled",
+      targetType: "pr_review_repository_binding",
+      targetId: c.req.param("bindingId"),
+      metadata: {},
+    });
+    return c.body(null, 204);
+  });
+}
+
+/** PR Review's server-owned provider, not a repository URL or user label,
+ * establishes Lens identity. Other providers have no curated acquisition key. */
+function prReviewIntegrationKey(provider: string): "github-lens" | null {
+  return provider === "github" ? "github-lens" : null;
+}
+
+function prReviewCustomModelCommitGuard(input: {
+  settings: ApiRouteDeps["settings"];
+  accountId: string;
+  workspaceId: string;
+  modelId: string;
+}): ((tx: ApiRouteDeps["db"]) => Promise<void>) | undefined {
+  const reference = workspaceCustomModelReference(input.settings, input.modelId);
+  if (!reference) return undefined;
+  return async (tx): Promise<void> => {
+    const active = await lockActiveCustomModelForAdmission(tx, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      reference,
+    });
+    if (!active) {
+      throw modelUnavailableHttpException(input.modelId);
+    }
+  };
+}
+
+function assertPrReviewSandboxBackend(deps: ApiRouteDeps): void {
+  if (deps.settings.sandboxBackend === "selfhosted") {
+    throw new HTTPException(409, {
+      message:
+        "Opengeni Review Bot requires managed compute so it can materialize and verify the exact pull-request head",
+    });
+  }
+}
+
+function requirePrReviewEncryptionKey(deps: ApiRouteDeps): Uint8Array {
+  const key = environmentsEncryptionKeyBytes(deps.settings);
+  if (!key) {
+    throw new HTTPException(503, {
+      message: "Opengeni Review Bot requires configured secret encryption",
+    });
+  }
+  return key;
+}
+
+async function mapPrReviewUniqueConflict<T>(operation: Promise<T>, message: string): Promise<T> {
+  try {
+    return await operation;
+  } catch (error) {
+    if (nestedPostgresSqlState(error) === "23505") {
+      throw new HTTPException(409, { message });
+    }
+    throw error;
+  }
+}
+
+function positiveInteger(value: unknown): number | null {
+  if (typeof value === "number" && Number.isSafeInteger(value) && value > 0) return value;
+  if (typeof value === "string" && /^\d+$/.test(value)) {
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null;
+  }
+  return null;
+}