@opengeni/api-router 0.30.1 → 1.0.0

package/src/routes/scheduled-tasks.ts

@@ -1,18 +1,35 @@
+import { z } from "zod";
 import {
   CreateScheduledTaskRequest,
+  RefreshScheduledTaskAccessRequest,
+  ScheduledTaskSlackChannelId,
+  ScheduledTaskSlackChannelListResponse,
   TriggerScheduledTaskRequest,
   UpdateScheduledTaskRequest,
+  type AccessGrant,
 } from "@opengeni/contracts";
 import {
-  deleteScheduledTask,
+  getScheduledTaskRevisionAuthoritySubject,
   listScheduledTaskRuns,
   listScheduledTasks,
-  updateScheduledTask,
 } from "@opengeni/db";
 import type { Hono } from "hono";
+import type { ScheduledTask } from "@opengeni/contracts";
 import { HTTPException } from "hono/http-exception";
-import { requireAccessGrant } from "@opengeni/core";
-import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
+import {
+  isAuthenticatedPersonAuthorization,
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  requirePermission,
+  resolveWorkspaceCatalogSettings,
+  validateOpenGeniSlackBotConnectionSelection,
+  type ScheduledTaskSlackChannelVerifier,
+} from "@opengeni/core";
+import {
+  recordWorkspaceUsage,
+  requireLimit,
+  resolveScheduledTaskPreflightModel,
+} from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   captureScheduledTaskRestoreState,
@@ -26,20 +43,152 @@ import {
   requireScheduledTaskForApi,
   syncCreatedScheduledTask,
   syncUpdatedScheduledTask,
+  updateScheduledTaskForApi,
+  triggerScheduledTaskForGrant,
+  validateScheduledTaskMachineTarget,
   validateScheduledTaskTarget,
   validatedScheduledTaskUpdate,
+  listScheduledTaskAccessAttention,
+  refreshScheduledTaskAccess,
+  scheduledTaskAccessSource,
+  withScheduledTaskPolicyDrift,
+  withScheduledTaskRunAccessFailures,
 } from "@opengeni/core";
+import type { AccessGrantAuthorization } from "@opengeni/core";
 import { boundedLimit } from "../http/common";
-import { revokeKnowledgeSourceScheduleAuthorization } from "../integrations/google-drive";
-import { revokeAtlassianScheduleAuthorization } from "../integrations/atlassian";
+import { permissionsRequiredByFirstPartyTools } from "../mcp/first-party-tool-permissions";
+import {
+  createOpenGeniSlackBotInteractionClient,
+  verifyScheduledTaskSlackChannel,
+} from "../integrations/slack-bot";
+import { deleteScheduledTaskWithDurableCleanup } from "../scheduled-task-deletion";
+import { parseRequestBody, readRequestJson } from "../http/request-body";
 
 export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void {
-  const { settings, db, workflowClient, objectStorage } = deps;
+  const { db, workflowClient, objectStorage } = deps;
+  const slackChannelVerifier =
+    (grant: AccessGrant): ScheduledTaskSlackChannelVerifier =>
+    async ({ connectionId, channelId }) =>
+      await verifyScheduledTaskSlackChannel(deps, {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        subjectId: grant.subjectId,
+        connectionId,
+        channelId,
+      });
+
+  // Channels a person may choose as a task's fixed Slack destination: active,
+  // non-shared channels the selected OpenGeni bot already belongs to.
+  app.get("/v1/workspaces/:workspaceId/scheduled-task-slack-channels", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "scheduled_tasks:manage",
+    );
+    const grant = authorization.grant;
+    requirePermission(grant, "connections:write");
+    if (!isAuthenticatedPersonAuthorization(authorization)) {
+      throw new HTTPException(403, {
+        message: "Only a person can choose the Slack channel a scheduled task posts to",
+      });
+    }
+    const connectionId = c.req.query("connectionId");
+    if (!connectionId || !z.string().uuid().safeParse(connectionId).success) {
+      throw new HTTPException(400, { message: "connectionId is required" });
+    }
+    const cursor = c.req.query("cursor");
+    if (cursor !== undefined && cursor.length > 1_024) {
+      throw new HTTPException(400, { message: "invalid cursor" });
+    }
+    await validateOpenGeniSlackBotConnectionSelection(db, grant, workspaceId, connectionId);
+    const client = await createOpenGeniSlackBotInteractionClient(deps, {
+      accountId: grant.accountId,
+      workspaceId,
+      connectionId,
+      subjectId: grant.subjectId,
+    });
+    const result = await client.listChannels({ limit: 200, ...(cursor ? { cursor } : {}) });
+    c.header("cache-control", "private, no-store");
+    return c.json(
+      ScheduledTaskSlackChannelListResponse.parse({
+        channels: result.channels
+          .filter(
+            (channel) =>
+              channel.isMember &&
+              !channel.isArchived &&
+              !channel.isShared &&
+              !channel.isExternallyShared &&
+              !channel.isOrgShared &&
+              ScheduledTaskSlackChannelId.safeParse(channel.id).success,
+          )
+          .map((channel) => ({ id: channel.id, name: channel.name, isPrivate: channel.isPrivate })),
+        nextCursor: result.nextCursor || null,
+      }),
+    );
+  });
+
+  // Drift is advisory: it is attached for viewers who can act on a task and
+  // never fails the read it decorates.
+  async function withPolicyDrift(
+    authorization: AccessGrantAuthorization,
+    tasks: ScheduledTask[],
+  ): Promise<ScheduledTask[]> {
+    if (!tasks.some((task) => scheduledTaskAccessSource(task, authorization.grant))) {
+      return tasks;
+    }
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: authorization.grant.accountId,
+        workspaceId: authorization.grant.workspaceId,
+      })
+    ).settings;
+    return await withScheduledTaskPolicyDrift({
+      db,
+      settings: catalogSettings,
+      authorization,
+      tasks,
+      permissionsRequiredByTools: permissionsRequiredByFirstPartyTools,
+      onError: (error) => {
+        deps.observability?.warn("Scheduled task access drift could not be computed", {
+          errorClass: error instanceof Error ? error.name : "ScheduledTaskPolicyDriftError",
+          origin: "api",
+        });
+      },
+    });
+  }
+
+  // Registered before `/:taskId` so the literal segment is never read as an id.
+  app.get("/v1/workspaces/:workspaceId/scheduled-tasks/attention", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
+    // The account plan reads only the MCP registry and tool defaults, which the
+    // model catalog does not change, so the deployment settings suffice here.
+    const tasks = await listScheduledTaskAccessAttention({
+      db,
+      settings: deps.settings,
+      grant,
+      onError: (error) => {
+        deps.observability?.warn("Scheduled task account availability could not be computed", {
+          errorClass: error instanceof Error ? error.name : "ScheduledTaskAccessAttentionError",
+          origin: "api",
+        });
+      },
+    });
+    return c.json({ tasks });
+  });
 
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
-    const rawPayload = await c.req.json();
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "scheduled_tasks:manage",
+    );
+    const grant = authorization.grant;
+    const rawPayload = await readRequestJson(c);
     const parsedPayload = CreateScheduledTaskRequest.safeParse(rawPayload);
     if (!parsedPayload.success) {
       throw new HTTPException(400, {
@@ -47,6 +196,12 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       });
     }
     const payload = parsedPayload.data;
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
     await requireLimit(deps, {
       accountId: grant.accountId,
       workspaceId,
@@ -54,14 +209,16 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       quantity: 1,
     });
     const task = await createValidatedScheduledTask({
-      settings,
+      settings: catalogSettings,
       db,
       objectStorage,
       grant,
+      authorization,
       payload,
       toolsProvided: scheduledTaskToolsProvided(rawPayload),
       sessionAuthorization: deps.sessionAuthorization,
       authorizationSurface: "http",
+      verifySlackChannel: slackChannelVerifier(grant),
     });
     await syncCreatedScheduledTask({ db, workflowClient, task });
     return c.json(scheduledTaskForGrant(task, grant), 201);
@@ -69,25 +226,104 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
 
   app.get("/v1/workspaces/:workspaceId/scheduled-tasks", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
-    const tasks = await listScheduledTasks(db, workspaceId, boundedLimit(c.req.query("limit")));
-    return c.json(tasks.map((task) => scheduledTaskForGrant(task, grant)));
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "scheduled_tasks:run",
+    );
+    const grant = authorization.grant;
+    const sessionId = c.req.query("sessionId");
+    const offset = Number(c.req.query("offset") ?? 0);
+    if (!Number.isSafeInteger(offset) || offset < 0) {
+      throw new HTTPException(400, { message: "invalid offset" });
+    }
+    if (sessionId !== undefined) {
+      if (!z.string().uuid().safeParse(sessionId).success) {
+        throw new HTTPException(400, { message: "invalid sessionId" });
+      }
+      await requireAccessGrant(c, deps, workspaceId, "sessions:control");
+    }
+    const tasks = await listScheduledTasks(
+      db,
+      workspaceId,
+      boundedLimit(c.req.query("limit")),
+      offset,
+      sessionId,
+    );
+    return c.json(
+      (await withPolicyDrift(authorization, tasks)).map((task) =>
+        scheduledTaskForGrant(task, grant),
+      ),
+    );
   });
 
   app.get("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "scheduled_tasks:run",
+    );
+    const grant = authorization.grant;
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
-    return c.json(scheduledTaskForGrant(task, grant));
+    const [withDrift] = await withPolicyDrift(authorization, [task]);
+    return c.json(scheduledTaskForGrant(withDrift ?? task, grant));
+  });
+
+  // The owner's explicit access refresh: re-freeze connectors, connector
+  // accounts and an agent-created task's OpenGeni tools with the calling
+  // person's current authority. It changes neither the schedule nor its
+  // status, so the Temporal schedule is untouched.
+  app.post("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/refresh-access", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "scheduled_tasks:manage",
+    );
+    const parsed = RefreshScheduledTaskAccessRequest.safeParse(
+      await c.req.json().catch(() => null),
+    );
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: "invalid scheduled task access refresh request" });
+    }
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: authorization.grant.accountId,
+        workspaceId,
+      })
+    ).settings;
+    const task = await refreshScheduledTaskAccess({
+      settings: catalogSettings,
+      db,
+      objectStorage,
+      authorization,
+      taskId: c.req.param("taskId"),
+      request: parsed.data,
+      permissionsRequiredByTools: permissionsRequiredByFirstPartyTools,
+      sessionAuthorization: deps.sessionAuthorization,
+      authorizationSurface: "http",
+    });
+    const [withDrift] = await withPolicyDrift(authorization, [task]);
+    return c.json(scheduledTaskForGrant(withDrift ?? task, authorization.grant));
   });
 
   app.patch("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "scheduled_tasks:manage",
+    );
+    const grant = authorization.grant;
     const taskId = c.req.param("taskId");
     const existing = await requireScheduledTaskForApi(db, workspaceId, taskId);
     const previous = await captureScheduledTaskRestoreState(db, existing);
-    const rawPayload = await c.req.json();
+    const rawPayload = await readRequestJson(c);
     const parsedPayload = UpdateScheduledTaskRequest.safeParse(rawPayload);
     if (!parsedPayload.success) {
       throw new HTTPException(400, {
@@ -95,18 +331,34 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       });
     }
     const payload = parsedPayload.data;
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
     const update = await validatedScheduledTaskUpdate({
-      settings,
+      settings: catalogSettings,
       db,
       objectStorage,
       grant,
       existing,
+      authorization,
       payload,
       toolsProvided: scheduledTaskToolsProvided(rawPayload),
       sessionAuthorization: deps.sessionAuthorization,
       authorizationSurface: "http",
+      verifySlackChannel: slackChannelVerifier(grant),
     });
-    const task = await updateScheduledTask(db, workspaceId, taskId, update);
+    const task = await updateScheduledTaskForApi(
+      db,
+      grant,
+      taskId,
+      update,
+      payload.agentLearning
+        ? { authorization, request: payload.agentLearning, restoreState: previous }
+        : undefined,
+    );
     await syncUpdatedScheduledTask({ db, workflowClient, previous, task });
     return c.json(scheduledTaskForGrant(task, grant));
   });
@@ -116,7 +368,7 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     const existing = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     const previous = await captureScheduledTaskRestoreState(db, existing);
-    const task = await updateScheduledTask(db, workspaceId, existing.id, {
+    const task = await updateScheduledTaskForApi(db, grant, existing.id, {
       status: "paused",
     });
     await syncUpdatedScheduledTask({ db, workflowClient, previous, task });
@@ -125,12 +377,33 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
 
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/resume", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "scheduled_tasks:manage",
+    );
+    const grant = authorization.grant;
     const existing = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     const previous = await captureScheduledTaskRestoreState(db, existing);
-    const task = await updateScheduledTask(db, workspaceId, existing.id, {
-      status: "active",
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
+    const update = await validatedScheduledTaskUpdate({
+      settings: catalogSettings,
+      db,
+      objectStorage,
+      grant,
+      existing,
+      payload: { status: "active" },
+      authorization,
+      sessionAuthorization: deps.sessionAuthorization,
+      authorizationSurface: "http",
     });
+    const task = await updateScheduledTaskForApi(db, grant, existing.id, update);
     await syncUpdatedScheduledTask({ db, workflowClient, previous, task });
     return c.json(scheduledTaskForGrant(task, grant));
   });
@@ -142,6 +415,12 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     // recognised as codex-billed and skip the credit/cost gates at the edge.
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     if (task.action.kind === "agent_turn") {
+      const catalogSettings = (
+        await resolveWorkspaceCatalogSettings(db, deps.settings, {
+          accountId: grant.accountId,
+          workspaceId,
+        })
+      ).settings;
       await validateScheduledTaskTarget({
         db,
         sessionAuthorization: deps.sessionAuthorization,
@@ -154,25 +433,50 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
         agentConfig: task.agentConfig,
         missingTargetStatus: 404,
       });
-      await requireLimit(deps, {
-        accountId: grant.accountId,
-        workspaceId,
-        action: "agent_run:create",
-        quantity: 1,
-        model: task.agentConfig.model ?? deps.settings.openaiModel,
+      await validateScheduledTaskMachineTarget({
+        settings: catalogSettings,
+        db,
+        grant,
+        runMode: task.runMode,
+        agentConfig: task.agentConfig,
+        requireOnline: true,
+      });
+      const taskAuthoritySubjectId = await getScheduledTaskRevisionAuthoritySubject(db, {
+        accountId: task.accountId,
+        workspaceId: task.workspaceId,
+        taskId: task.id,
+        taskAuthorityRevision: task.authorityRevision,
       });
+      await requireLimit(
+        { ...deps, settings: catalogSettings },
+        {
+          accountId: grant.accountId,
+          workspaceId,
+          // A manual trigger does not transfer the task's frozen human to
+          // the triggering administrator. Unavailable authority is refused
+          // visibly by worker dispatch; this edge still checks the workspace.
+          initiatingHumanSubjectId:
+            taskAuthoritySubjectId === task.ownerSubjectId ? taskAuthoritySubjectId : null,
+          action: "agent_run:create",
+          quantity: 1,
+          // A model-less task is checked against the model its occurrence
+          // will run (a connected subscription, the credits default, or the
+          // deployment default), not always the deployment default.
+          model: await resolveScheduledTaskPreflightModel(db, catalogSettings, task),
+        },
+      );
     }
     // Body is optional (a bare POST is still a valid trigger); only a present,
     // non-empty body must parse against the contract.
     const body = await c.req.json().catch(() => ({}));
-    const { triggerId } = TriggerScheduledTaskRequest.parse(body ?? {});
+    const { triggerId } = parseRequestBody(TriggerScheduledTaskRequest, body ?? {});
     const triggerToken = scheduledTaskTriggerToken(triggerId);
     const agentRunUsageIdempotencyKey =
       task.action.kind === "agent_turn"
         ? manualScheduledTaskTriggerUsageKey(workspaceId, task.id, triggerToken)
         : `knowledge-source-sync:manual:${workspaceId}:${task.id}:${triggerToken}`;
     const triggerWorkflowId = manualScheduledTaskTriggerWorkflowId(task.id, triggerToken);
-    await workflowClient.triggerScheduledTask({
+    await triggerScheduledTaskForGrant(db, grant, workflowClient, {
       task,
       agentRunUsageIdempotencyKey,
       triggerWorkflowId,
@@ -197,16 +501,10 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
   app.delete("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
-    const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
-    if (task.metadata.connectorKind === "atlassian") {
-      await revokeAtlassianScheduleAuthorization(deps, { task, subjectId: grant.subjectId });
-    } else {
-      await revokeKnowledgeSourceScheduleAuthorization(deps, { task, subjectId: grant.subjectId });
-    }
-    await workflowClient.deleteScheduledTaskSchedule({
-      temporalScheduleId: task.temporalScheduleId,
+    await deleteScheduledTaskWithDurableCleanup(deps, {
+      grant,
+      taskId: c.req.param("taskId"),
     });
-    await deleteScheduledTask(db, workspaceId, task.id);
     return c.json({ ok: true });
   });
 
@@ -220,6 +518,13 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       task.id,
       boundedLimit(c.req.query("limit")),
     );
-    return c.json(taskRuns.map((run) => scheduledTaskRunForGrant(run, grant)));
+    const runs = await withScheduledTaskRunAccessFailures({
+      db,
+      settings: deps.settings,
+      grant,
+      task,
+      runs: taskRuns,
+    });
+    return c.json(runs.map((run) => scheduledTaskRunForGrant(run, grant)));
   });
 }

package/src/routes/session-artifact-associations.ts

@@ -0,0 +1,87 @@
+import {
+  requireAccessGrant,
+  requirePermission,
+  requireSessionAuthorization,
+  SessionAuthorizationDeniedError,
+  SessionAuthorizationUnavailableError,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import {
+  hasEditableArtifactSessionLink,
+  hasWorkspaceArtifactSessionLink,
+  transactionallyAuthorizeEditableArtifactActor,
+  withRlsContext,
+} from "@opengeni/db";
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+import { withAccessGrantSessionRlsContext } from "../access-grant-rls";
+import { editableArtifactActorForGrant } from "./editable-artifacts";
+
+const SessionId = z.string().uuid();
+const EditableArtifactId = z.string().regex(/^(?!0{32}$)[0-9a-f]{32}$/u);
+
+/** Exact authorized membership proof, not a paginated artifact discovery API. */
+export function registerSessionArtifactAssociationRoutes(app: Hono, deps: ApiRouteDeps): void {
+  app.get(
+    "/v1/workspaces/:workspaceId/sessions/:sessionId/artifact-associations/:artifactId",
+    async (context) => {
+      const workspaceId = context.req.param("workspaceId");
+      const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
+      requirePermission(grant, "sessions:read");
+      const sessionId = context.req.param("sessionId");
+      const artifactId = context.req.param("artifactId");
+      const kind = EditableArtifactId.safeParse(artifactId).success
+        ? "editable"
+        : SessionId.safeParse(artifactId).success
+          ? "site"
+          : null;
+      const requestedKind = context.req.query("kind");
+      if (
+        !SessionId.safeParse(sessionId).success ||
+        !kind ||
+        (requestedKind !== undefined && requestedKind !== kind)
+      ) {
+        throw new HTTPException(404, { message: "Artifact association not found" });
+      }
+      try {
+        return await withAccessGrantSessionRlsContext(deps, grant, async () => {
+          await requireSessionAuthorization(deps, grant, {
+            sessionId,
+            operation: "session.read",
+            surface: "http",
+          });
+          const scope = { accountId: grant.accountId, workspaceId };
+          const linked =
+            kind === "editable"
+              ? await hasEditableArtifactSessionLink(deps.db, scope, sessionId, artifactId)
+              : await hasWorkspaceArtifactSessionLink(deps.db, workspaceId, sessionId, artifactId);
+          if (!linked) throw new HTTPException(404, { message: "Artifact association not found" });
+          if (kind === "editable") {
+            const decision = await withRlsContext(deps.db, scope, (tx) =>
+              transactionallyAuthorizeEditableArtifactActor(tx, {
+                scope,
+                artifactId,
+                actor: editableArtifactActorForGrant(grant, "0000000000000001"),
+                permission: "read",
+              }),
+            );
+            if (!decision.allowed) {
+              throw new HTTPException(404, { message: "Artifact association not found" });
+            }
+          }
+          context.header("cache-control", "private, no-store");
+          return context.json({ sessionId, artifactId, kind });
+        });
+      } catch (error) {
+        if (error instanceof SessionAuthorizationDeniedError) {
+          throw new HTTPException(404, { message: "Artifact association not found" });
+        }
+        if (error instanceof SessionAuthorizationUnavailableError) {
+          throw new HTTPException(503, { message: "Session authorization is unavailable" });
+        }
+        throw error;
+      }
+    },
+  );
+}