@opengeni/api-router 0.30.1 → 1.0.0

package/src/routes/skill-content.ts

@@ -0,0 +1,297 @@
+import { z } from "zod";
+import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { SkillFile, SKILL_MAX_FILES, type SkillWriteReceipt } from "@opengeni/contracts";
+import { getSessionForSubject, readSkillRemovalScope } from "@opengeni/db";
+import {
+  approveSkill,
+  rejectSkill,
+  removeSkill,
+  listSkills,
+  readSkill,
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  restoreSkill,
+  saveSkill,
+  validateSkillFiles,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import { applySkillFileChanges, buildPortableSkillArtifact } from "@opengeni/runtime/skill-library";
+import { authorizePreferenceRegistryScopeMutation } from "./preference-registry";
+
+const scopeSchema = z.enum(["workspace", "organization", "user"]);
+const saveRequest = z
+  .object({
+    operationId: z.uuid(),
+    skillId: z.uuid(),
+    expectedRevisionId: z.uuid().nullable(),
+    expectedScopeVersion: z.number().int().nonnegative(),
+    scope: scopeSchema.default("workspace"),
+    stableKey: z.string().min(1).max(96),
+    files: z.array(SkillFile).max(SKILL_MAX_FILES),
+    deletions: z.array(z.string().min(1).max(512)).max(SKILL_MAX_FILES).default([]),
+    reason: z.string().min(1).max(2000),
+  })
+  .strict();
+const revisionRequest = z
+  .object({
+    removalOperationId: z.uuid().optional(),
+    operationId: z.uuid(),
+    revisionId: z.uuid(),
+    expectedRevisionId: z.uuid().nullable(),
+    expectedScopeVersion: z.number().int().nonnegative(),
+    reason: z.string().min(1).max(2000),
+  })
+  .strict();
+
+const removeRequest = revisionRequest.omit({ revisionId: true, removalOperationId: true });
+
+async function parseSkillRequest<S extends z.ZodType>(c: Context, schema: S): Promise<z.infer<S>> {
+  const parsed = schema.safeParse(await c.req.json().catch(() => null));
+  if (!parsed.success) throw new HTTPException(422, { message: "Invalid Skill request" });
+  return parsed.data;
+}
+
+function skillIdentifier(value: string): string {
+  const parsed = z.uuid().safeParse(value);
+  if (!parsed.success)
+    throw new HTTPException(422, { message: "Invalid Skill revision or identity" });
+  return parsed.data;
+}
+
+/** Human folder editing and the legacy Skill admin share scope authorization. */
+export function registerSkillContentRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const base = "/v1/workspaces/:workspaceId/skills/content";
+  app.get(base, async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const query = z
+      .object({
+        limit: z.coerce.number().int().min(1).max(250).default(100),
+        cursor: z.string().max(2048).optional(),
+        sessionId: z.uuid().optional(),
+      })
+      .safeParse(c.req.query());
+    if (!query.success) throw new HTTPException(422, { message: "Invalid Skill list query" });
+    if (query.data.sessionId) {
+      await requireAccessGrant(c, deps, workspaceId, "sessions:read");
+      const session = await getSessionForSubject(
+        deps.db,
+        workspaceId,
+        query.data.sessionId,
+        grant.subjectId,
+      );
+      if (!session) throw new HTTPException(404, { message: "Session not found" });
+    }
+    let after: { stableKey: string; id: string } | undefined;
+    if (query.data.cursor !== undefined) {
+      try {
+        after = z
+          .object({ stableKey: z.string().min(1).max(128), id: z.uuid() })
+          .strict()
+          .parse(JSON.parse(Buffer.from(query.data.cursor, "base64url").toString("utf8")));
+      } catch {
+        throw new HTTPException(422, { message: "Invalid Skill list cursor" });
+      }
+    }
+    const rows = await listSkills(
+      deps.db,
+      { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+      {
+        limit: query.data.limit + 1,
+        metadataOnly: true,
+        ...(after ? { after } : {}),
+        ...(query.data.sessionId ? { sessionId: query.data.sessionId } : {}),
+      },
+    );
+    const page = rows.slice(0, query.data.limit);
+    const last = page.at(-1);
+    return c.json({
+      skills: page.map(({ files: _files, ...summary }) => summary),
+      nextCursor:
+        rows.length > query.data.limit && last
+          ? Buffer.from(JSON.stringify({ stableKey: last.stableKey, id: last.id })).toString(
+              "base64url",
+            )
+          : null,
+    });
+  });
+  app.get(`${base}/:skillId`, async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const skillId = skillIdentifier(c.req.param("skillId"));
+    const revision = c.req.query("revisionId");
+    const revisionId = revision === undefined ? undefined : skillIdentifier(revision);
+    const skill = await readSkill(
+      deps.db,
+      { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+      skillId,
+      revisionId,
+    );
+    if (!skill) throw new HTTPException(404, { message: "Skill not found" });
+    return c.json(skill);
+  });
+  app.post(`${base}/save`, async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:read");
+    const request = await parseSkillRequest(c, saveRequest);
+    authorizePreferenceRegistryScopeMutation(access, request.scope);
+    const context = {
+      accountId: access.grant.accountId,
+      workspaceId,
+      subjectId: access.grant.subjectId,
+    };
+    const skillId = request.skillId;
+    const current = await readSkill(
+      deps.db,
+      context,
+      skillId,
+      request.expectedRevisionId ?? undefined,
+    );
+    if (request.expectedRevisionId && !current)
+      throw new HTTPException(404, { message: "Skill not found" });
+    if (current) {
+      authorizePreferenceRegistryScopeMutation(access, current.scope);
+      if (current.scope !== request.scope)
+        throw new HTTPException(409, {
+          message: "Move Skill scope through the existing scope-management workflow.",
+        });
+    }
+    let files;
+    try {
+      files = validateSkillFiles(
+        applySkillFileChanges(
+          request.expectedRevisionId ? (current?.files ?? []) : [],
+          request.files,
+          request.deletions,
+        ),
+      );
+      buildPortableSkillArtifact(files);
+    } catch {
+      throw new HTTPException(400, {
+        message:
+          "Invalid Skill folder. SKILL.md requires valid YAML frontmatter with a name and description. Use unique relative text-file paths and respect the file and folder size limits.",
+      });
+    }
+    const receipt = await skillMutation(() =>
+      saveSkill(deps.db, {
+        accountId: context.accountId,
+        workspaceId,
+        actor: { kind: "human", principalKind: "human_session", subjectId: context.subjectId },
+        operationId: request.operationId,
+        skillId,
+        expectedRevisionId: request.expectedRevisionId,
+        expectedScopeVersion: request.expectedScopeVersion,
+        scope: request.scope,
+        stableKey: current?.stableKey ?? request.stableKey,
+        files,
+        reason: request.reason,
+      }),
+    );
+    return c.json(receipt);
+  });
+  app.post(`${base}/:skillId/remove`, async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:read");
+    const skillId = skillIdentifier(c.req.param("skillId"));
+    const request = await parseSkillRequest(c, removeRequest);
+    const context = {
+      accountId: access.grant.accountId,
+      workspaceId,
+      subjectId: access.grant.subjectId,
+    };
+    const current = await readSkill(deps.db, context, skillId);
+    const scope =
+      current?.scope ??
+      (await readSkillRemovalScope(deps.db, context, skillId, request.operationId));
+    if (!scope) throw new HTTPException(404, { message: "Skill not found" });
+    authorizePreferenceRegistryScopeMutation(access, scope);
+    if (scope === "organization")
+      throw new HTTPException(403, { message: "Organization skills cannot be removed here." });
+    return c.json(
+      await skillMutation(() =>
+        removeSkill(deps.db, {
+          ...request,
+          skillId,
+          accountId: context.accountId,
+          workspaceId,
+          actor: { kind: "human", principalKind: "human_session", subjectId: context.subjectId },
+        }),
+      ),
+    );
+  });
+  for (const operation of ["approve", "reject", "restore"] as const) {
+    app.post(`${base}/:skillId/${operation}`, async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:read");
+      const skillId = skillIdentifier(c.req.param("skillId"));
+      const request = await parseSkillRequest(c, revisionRequest);
+      const current = await readSkill(
+        deps.db,
+        { accountId: access.grant.accountId, workspaceId, subjectId: access.grant.subjectId },
+        skillId,
+      );
+      const scope =
+        current?.scope ??
+        (operation === "approve" && request.removalOperationId
+          ? await readSkillRemovalScope(
+              deps.db,
+              {
+                accountId: access.grant.accountId,
+                workspaceId,
+                subjectId: access.grant.subjectId,
+              },
+              skillId,
+              request.operationId,
+            )
+          : null);
+      if (!scope) throw new HTTPException(404, { message: "Skill not found" });
+      authorizePreferenceRegistryScopeMutation(access, scope);
+      const apply =
+        operation === "approve"
+          ? approveSkill
+          : operation === "reject"
+            ? rejectSkill
+            : restoreSkill;
+      return c.json(
+        await skillMutation(() =>
+          apply(deps.db, {
+            ...request,
+            skillId,
+            accountId: access.grant.accountId,
+            workspaceId,
+            actor: {
+              kind: "human",
+              principalKind: "human_session",
+              subjectId: access.grant.subjectId,
+            },
+          }),
+        ),
+      );
+    });
+  }
+}
+
+async function skillMutation(run: () => Promise<SkillWriteReceipt>): Promise<SkillWriteReceipt> {
+  try {
+    return await run();
+  } catch (error) {
+    let current: unknown = error;
+    for (let depth = 0; depth < 4 && current && typeof current === "object"; depth++) {
+      const candidate = current as { code?: unknown; cause?: unknown };
+      if (candidate.code === "23505" || candidate.code === "40001" || candidate.code === "55P03")
+        throw new HTTPException(409, {
+          message:
+            "Skill changed or this operation key was reused. Reload and reconcile the change.",
+        });
+      if (candidate.code === "42501")
+        throw new HTTPException(403, {
+          message: "Skill change is not permitted for this actor or scope.",
+        });
+      if (candidate.code === "22023" || candidate.code === "23514")
+        throw new HTTPException(400, { message: "Skill content or revision request is invalid." });
+      current = candidate.cause;
+    }
+    throw error;
+  }
+}

package/src/routes/skill-install-authority.ts

@@ -0,0 +1,64 @@
+import { SkillActor, type SkillActor as SkillActorType } from "@opengeni/contracts";
+import {
+  requireResolvedAccessGrantAuthorization,
+  type AccessGrantAuthorization,
+} from "@opengeni/core";
+import { HTTPException } from "hono/http-exception";
+
+/** Use authenticated request provenance, never a caller-supplied actor or subject alone. */
+export function skillInstallerActor(access: AccessGrantAuthorization): SkillActorType {
+  const grant = requireResolvedAccessGrantAuthorization(access, access.grant.workspaceId);
+  const metadata = grant.metadata ?? {};
+  const hasAttempt = ["sessionId", "turnId", "attemptId", "executionGeneration"].some(
+    (key) => metadata[key] !== undefined,
+  );
+  if (hasAttempt || grant.principalKind === "agent_attempt") {
+    const parsed = SkillActor.safeParse({
+      kind: "agent",
+      sessionId: metadata.sessionId,
+      turnId: metadata.turnId,
+      attemptId: metadata.attemptId,
+      executionGeneration: metadata.executionGeneration,
+    });
+    if (!parsed.success)
+      throw new HTTPException(403, {
+        message: "Skill installation requires complete signed attempt authority.",
+      });
+    return parsed.data;
+  }
+  if (
+    grant.principalKind === "human_session" &&
+    !grant.serviceInitiator &&
+    !grant.serviceInitiatorContext &&
+    !grant.subjectId.startsWith("api_key:")
+  ) {
+    return { kind: "human", principalKind: "human_session", subjectId: grant.subjectId };
+  }
+  if (
+    grant.principalKind === "service" ||
+    grant.principalKind === "api_key" ||
+    grant.principalKind === "configured_key"
+  ) {
+    return { kind: "service", principalKind: grant.principalKind, subjectId: grant.subjectId };
+  }
+  throw new HTTPException(403, {
+    message:
+      "Skill installation requires authenticated human, service, or complete live-attempt authority.",
+  });
+}
+
+/** Non-Skill component removals remain available to their existing callers. */
+export function skillRemovalActor(access: AccessGrantAuthorization): SkillActorType | undefined {
+  const grant = requireResolvedAccessGrantAuthorization(access, access.grant.workspaceId);
+  if (
+    grant.principalKind !== "human_session" ||
+    grant.serviceInitiator ||
+    grant.serviceInitiatorContext ||
+    grant.subjectId.startsWith("api_key:") ||
+    ["sessionId", "turnId", "attemptId", "executionGeneration"].some(
+      (key) => grant.metadata?.[key] !== undefined,
+    )
+  )
+    return undefined;
+  return skillInstallerActor(access);
+}

package/src/routes/skills.ts

@@ -11,8 +11,11 @@ import {
 } from "@opengeni/contracts";
 import {
   portableSkillCapabilityId,
+  createPublicSkillSearchClient,
+  PublicSkillSearchError,
   portableSkillPluginKey,
   requireAccessGrant,
+  requireAccessGrantAuthorization,
   resolveSkillImport,
   type ApiRouteDeps,
   type GitHubSkillSourceClient,
@@ -23,7 +26,9 @@ import {
   listInstalledSkills,
   PortableSkillInstallationVersionConflictError,
   PortableSkillInstallationVersionRequiredError,
+  PortableSkillSourcePathConflictError,
   uninstallPortableSkill,
+  SkillSourceRemovalAuthorityError,
 } from "@opengeni/db";
 import { loadSkillLibrarySkill, skillLibraryRepositoryUrl } from "@opengeni/runtime/skill-library";
 import { createHash } from "node:crypto";
@@ -31,6 +36,9 @@ import { HTTPException } from "hono/http-exception";
 import type { Hono } from "hono";
 
 import { createGitHubSkillSourceClient } from "../integrations/github-skill-source";
+import { registerSkillContentRoutes } from "./skill-content";
+import { skillInstallerActor, skillRemovalActor } from "./skill-install-authority";
+import { parseRequestJson } from "../http/request-body";
 
 export type SkillRouteOverrides = Readonly<{
   github?: GitHubSkillSourceClient;
@@ -41,7 +49,24 @@ export function registerSkillRoutes(
   deps: ApiRouteDeps,
   overrides: SkillRouteOverrides = {},
 ): void {
+  registerSkillContentRoutes(app, deps);
   const github = overrides.github ?? createGitHubSkillSourceClient(deps.settings);
+  const discovery = createPublicSkillSearchClient(deps.settings);
+  app.get("/v1/workspaces/:workspaceId/skills/search", async (c) => {
+    await requireAccessGrant(c, deps, c.req.param("workspaceId"), "workspace:read");
+    try {
+      return c.json(await discovery.search({ query: c.req.query("q") ?? "", limit: 20 }));
+    } catch (error) {
+      if (!(error instanceof PublicSkillSearchError)) throw error;
+      if (error.retryAfterSeconds) c.header("Retry-After", String(error.retryAfterSeconds));
+      throw new HTTPException(
+        error.code === "invalid_query" ? 422 : error.code === "rate_limited" ? 429 : 503,
+        {
+          message: "Skill search is unavailable. Please try again.",
+        },
+      );
+    }
+  });
 
   app.get("/v1/workspaces/:workspaceId/skills", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -55,9 +80,16 @@ export function registerSkillRoutes(
 
   app.post("/v1/workspaces/:workspaceId/skills/library/:libraryId/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const access = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "capabilities:manage",
+    );
+    const { grant } = access;
+    const skillActor = skillInstallerActor(access);
     const libraryId = decodeURIComponent(c.req.param("libraryId"));
-    const payload = InstallLibrarySkillRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, InstallLibrarySkillRequest);
     let loaded: ReturnType<typeof loadSkillLibrarySkill>;
     try {
       loaded = loadSkillLibrarySkill(libraryId, payload.expectedVersion);
@@ -81,6 +113,7 @@ export function registerSkillRoutes(
     });
     try {
       const installed = await installPortableSkill(deps.db, {
+        skillActor,
         accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
@@ -118,7 +151,7 @@ export function registerSkillRoutes(
   app.post("/v1/workspaces/:workspaceId/skills/preview", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const payload = PreviewSkillImportRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, PreviewSkillImportRequest);
     const resolved = await resolveForRoute(payload.url, github);
     const installed = await getPortableSkillUninstallPreview(
       deps.db,
@@ -136,16 +169,22 @@ export function registerSkillRoutes(
 
   app.post("/v1/workspaces/:workspaceId/skills/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const payload = InstallSkillRequest.parse(await c.req.json());
+    const access = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "capabilities:manage",
+    );
+    const { grant } = access;
+    const skillActor = skillInstallerActor(access);
+    const payload = await parseRequestJson(c, InstallSkillRequest);
     const resolved = await resolveForRoute(payload.url, github);
     if (
       resolved.preview.sourceCommit !== payload.expectedSourceCommit ||
       resolved.preview.contentSha256 !== payload.expectedContentSha256
     ) {
       throw new HTTPException(409, {
-        message:
-          "The Skill source changed after preview. Review the new commit and contents before installing.",
+        message: "The skill changed after preview. Review its contents again before installing.",
       });
     }
     const fileSummaryByPath = new Map(
@@ -153,6 +192,7 @@ export function registerSkillRoutes(
     );
     try {
       const installed = await installPortableSkill(deps.db, {
+        skillActor,
         accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
@@ -204,13 +244,21 @@ export function registerSkillRoutes(
 
   app.delete("/v1/workspaces/:workspaceId/skills/:capabilityId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const access = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "capabilities:manage",
+    );
+    const { grant } = access;
+    const skillActor = skillRemovalActor(access);
     const capabilityId = decodeURIComponent(c.req.param("capabilityId"));
-    const payload = UninstallSkillRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, UninstallSkillRequest);
     try {
       return c.json(
         UninstallSkillResult.parse(
           await uninstallPortableSkill(deps.db, {
+            ...(skillActor ? { skillActor } : {}),
             accountId: grant.accountId,
             workspaceId,
             capabilityId,
@@ -224,12 +272,17 @@ export function registerSkillRoutes(
           message: "The Skill changed after preview. Review uninstall impact again.",
         });
       }
+      if (error instanceof SkillSourceRemovalAuthorityError)
+        throw new HTTPException(403, { message: error.message });
       throw error;
     }
   });
 }
 
 function portableSkillMutationHttpError(error: unknown): Error {
+  if (error instanceof PortableSkillSourcePathConflictError) {
+    return new HTTPException(409, { message: error.message });
+  }
   if (error instanceof PortableSkillInstallationVersionRequiredError) {
     return new HTTPException(400, { message: error.message });
   }

package/src/routes/social.ts

@@ -2,8 +2,10 @@ import {
   CreateSocialConnectionRequest,
   CreateSocialPostRequest,
   OAuthStartResponse,
+  OrganizationIntegrationDeniedError,
   SocialOAuthStartRequest,
 } from "@opengeni/contracts";
+import { withOrganizationIntegrationAcquisition } from "@opengeni/db/organization-integration-policy";
 import {
   createSocialConnection,
   createSocialPost,
@@ -15,10 +17,16 @@ import {
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
-import { requireAccessGrant } from "@opengeni/core";
+import { requireAccessGrant, requireAccessGrantAuthorization } from "@opengeni/core";
+import {
+  assertPersonalConnectionOwnerPrincipal,
+  isPersonalConnectionOwnerPrincipal,
+  requireLegacyOAuthActor,
+} from "../connection-ownership";
 import type { ApiRouteDeps } from "@opengeni/core";
 import { boundedLimit } from "../http/common";
 import { completeSocialOAuthCallback, startSocialOAuth } from "../integrations/social-oauth";
+import { parseRequestJson } from "../http/request-body";
 
 export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, settings, observability } = deps;
@@ -39,22 +47,28 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/social/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const payload = CreateSocialConnectionRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, CreateSocialConnectionRequest);
     try {
       return c.json(
-        await createSocialConnection(db, {
-          accountId: grant.accountId,
-          workspaceId,
-          provider: payload.provider,
-          accountHandle: payload.accountHandle,
-          accountName: payload.accountName ?? null,
-          externalAccountId: payload.externalAccountId ?? null,
-          status: payload.status,
-          scopes: payload.scopes,
-          credentialRef: payload.credentialRef ?? null,
-          tokenMetadata: payload.tokenMetadata,
-          metadata: payload.metadata,
-        }),
+        await withOrganizationIntegrationAcquisition(
+          db,
+          { accountId: grant.accountId, workspaceId },
+          [payload.provider === "x" || payload.provider === "reddit" ? payload.provider : null],
+          (tx) =>
+            createSocialConnection(tx, {
+              accountId: grant.accountId,
+              workspaceId,
+              provider: payload.provider,
+              accountHandle: payload.accountHandle,
+              accountName: payload.accountName ?? null,
+              externalAccountId: payload.externalAccountId ?? null,
+              status: payload.status,
+              scopes: payload.scopes,
+              credentialRef: payload.credentialRef ?? null,
+              tokenMetadata: payload.tokenMetadata,
+              metadata: payload.metadata,
+            }),
+        ),
         201,
       );
     } catch (error) {
@@ -99,18 +113,27 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
       });
     }
     const payload = parsed.data;
-    const grant = await requireAccessGrant(
+    const access = await requireAccessGrantAuthorization(
       c,
       deps,
       workspaceId,
       payload.ownership === "workspace" ? "workspace:admin" : "workspace:read",
     );
+    // The contract already defaults this request to workspace ownership; an
+    // explicit personal choice still needs a human who can own it.
+    requireLegacyOAuthActor(access);
+    const personalOwnershipAllowed = isPersonalConnectionOwnerPrincipal(access);
+    if (payload.ownership === "personal") {
+      assertPersonalConnectionOwnerPrincipal(access);
+    }
+    const grant = access.grant;
     const result = await startSocialOAuth(
       { db, settings, observability },
       {
         accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
+        personalOwnershipAllowed,
         requestUrl: c.req.url,
         payload,
       },
@@ -128,7 +151,9 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
         requestUrl: c.req.url,
       },
     );
-    return c.redirect(result.redirectTo, 302);
+    return result.exactReturn
+      ? new Response(null, { status: 302, headers: { location: result.redirectTo } })
+      : c.redirect(result.redirectTo, 302);
   });
 
   app.get("/v1/workspaces/:workspaceId/social/posts", async (c) => {
@@ -152,7 +177,7 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/social/posts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const payload = CreateSocialPostRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, CreateSocialPostRequest);
     try {
       return c.json(
         await createSocialPost(db, {
@@ -206,6 +231,9 @@ function parseConnectionIds(raw: string | undefined): string[] | undefined {
 }
 
 function socialHttpException(error: unknown): HTTPException {
+  if (error instanceof OrganizationIntegrationDeniedError) {
+    return new HTTPException(403, { message: error.message });
+  }
   const message = error instanceof Error ? error.message : String(error);
   if (message.includes("not found")) {
     return new HTTPException(404, { message });