@opengeni/api-router 0.30.1 → 1.0.0

package/src/integrations/fiken.ts

@@ -1,10 +1,17 @@
+import { withOrganizationIntegrationAcquisition } from "@opengeni/db/organization-integration-policy";
+import { claimOAuthAcquisition, finishOAuthAcquisition } from "./oauth-client";
+import { safeReturnPath } from "./oauth-return-path";
 import type { ApiRouteDeps } from "@opengeni/core";
 import type { Settings } from "@opengeni/config";
+import { createHash } from "node:crypto";
+import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
+import { requireConnectOwnerAuthority } from "@opengeni/core";
 import {
   FIKEN_CREDENTIAL_LABEL,
   FIKEN_CREDENTIAL_ROLE,
   FIKEN_PROVIDER_DOMAIN,
   FikenOAuthStartResponse,
+  FikenInstallRequest,
   type AccessGrant,
   type ConnectionMetadata,
   type FikenCompanySummary,
@@ -13,7 +20,6 @@ import {
 } from "@opengeni/contracts";
 import {
   fikenConnectionMetadata,
-  hasPermission,
   isFikenConnection,
   preferredFikenConnection,
   requireEnvironmentEncryption,
@@ -24,9 +30,12 @@ import {
   consumeIntegrationOAuthStateNonce,
   createConnection,
   encryptEnvironmentValue,
+  decryptEnvironmentValue,
+  getConnectAttempt,
+  finishConnectOperation,
   getConnectionMetadata,
-  getWorkspaceGrant,
   listConnectionsMetadata,
+  loadConnectionCredentialForBroker,
   recordAuditEvent,
   setConnectionStatus,
   updateConnection,
@@ -37,8 +46,10 @@ import { readResponseJsonBounded, type FetchLike } from "@opengeni/network";
 import { HTTPException } from "hono/http-exception";
 import {
   integrationBaseUrl,
+  oauthStateFailureReturn,
   oauthStateTtlMs,
   requireIntegrationsStateSecret,
+  workspaceIntegrationsPath,
 } from "./oauth-client";
 
 const FIKEN_API_BASE = "https://api.fiken.no/api/v2";
@@ -54,6 +65,87 @@ const MAX_DRAFT_LINES = 100;
 // Fiken company slugs as issued by Fiken: lowercase alphanumerics and dashes.
 const COMPANY_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,127}$/;
 
+/** Shared native/embedded token adapter. Provider verification happens before
+ * persistence; the caller reauthorizes inside its durable commit transaction.
+ * That caller must acquire the organization policy fence for `fiken` BEFORE
+ * owner/tenancy locks and invoke the returned writer with that exact tx. */
+export async function prepareFikenTokenInstall(
+  deps: ApiRouteDeps,
+  grant: Pick<AccessGrant, "accountId" | "workspaceId" | "subjectId">,
+  raw: unknown,
+  expectedVersion?: number,
+): Promise<(tx: Database) => Promise<ConnectionMetadata>> {
+  const payload = FikenInstallRequest.parse(raw);
+  await withOrganizationIntegrationAcquisition(deps.db, grant, ["fiken"], async () => {});
+  const key = requireEnvironmentEncryption(deps.settings);
+  const existing = payload.connectionId
+    ? await getConnectionMetadata(deps.db, grant.workspaceId, payload.connectionId, null)
+    : null;
+  if (payload.connectionId && !existing)
+    throw new HTTPException(404, { message: "connection not found" });
+  if (existing && !isFikenConnection(existing))
+    throw new HTTPException(422, { message: "connectionId is not a Fiken connection" });
+  if (expectedVersion !== undefined && existing?.version !== expectedVersion)
+    throw new HTTPException(409, { message: "The selected Fiken account changed" });
+  const verified = await verifyFikenApiToken(payload.apiToken, deps.fikenFetch ?? fetch);
+  const defaultCompanySlug = resolveFikenDefaultCompanySlug({
+    requested: payload.defaultCompanySlug ?? null,
+    previous: existing
+      ? (fikenConnectionMetadata(existing.metadata)?.defaultCompanySlug ?? null)
+      : null,
+    companies: verified.companies,
+  });
+  if (payload.defaultCompanySlug && defaultCompanySlug !== payload.defaultCompanySlug)
+    throw new HTTPException(422, {
+      message: "The selected company is not accessible with this token",
+    });
+  const metadata = {
+    credentialRole: FIKEN_CREDENTIAL_ROLE,
+    credentialLabel: FIKEN_CREDENTIAL_LABEL,
+    companies: verified.companies,
+    defaultCompanySlug,
+    verifiedAt: new Date().toISOString(),
+  };
+  const credentialEncrypted = encryptEnvironmentValue(
+    key,
+    JSON.stringify(fikenCredentialBundle(payload.apiToken)),
+  );
+  return async (tx) => {
+    if (existing) {
+      const updated = await updateConnection(tx, {
+        workspaceId: grant.workspaceId,
+        connectionId: existing.id,
+        visibleToSubjectId: null,
+        expectedVersion: existing.version,
+        kind: "api_key",
+        status: "active",
+        credentialEncrypted,
+        grantedScopes: [],
+        expiresAt: null,
+        metadata,
+        updatedBySubjectId: grant.subjectId,
+      });
+      if (!updated)
+        throw new HTTPException(409, {
+          message: "The Fiken connection changed; reload before retrying",
+        });
+      return updated;
+    }
+    return createConnection(tx, {
+      accountId: grant.accountId,
+      workspaceId: grant.workspaceId,
+      subjectId: null,
+      providerDomain: FIKEN_PROVIDER_DOMAIN,
+      kind: "api_key",
+      credentialEncrypted,
+      grantedScopes: [],
+      expiresAt: null,
+      metadata,
+      createdBySubjectId: grant.subjectId,
+    });
+  };
+}
+
 export type FikenOperation =
   | "companies.list"
   | "contacts.list"
@@ -102,6 +194,8 @@ type FikenContext = {
   sessionId: string | null;
 };
 
+type FikenProviderAuthorization = () => Promise<boolean | void>;
+
 /**
  * Fiken allows only a single concurrent API request per credential; concurrent
  * requests can 429 and repeated violations can get the token banned. Serialize
@@ -281,6 +375,7 @@ export type FikenListInput = {
 
 export class FikenClient {
   private readonly resolveCredential: ReturnType<typeof buildConnectionTokenResolver>;
+  private expectedConnectionVersion: number;
 
   constructor(
     private readonly db: Database,
@@ -289,11 +384,22 @@ export class FikenClient {
     private readonly metadata: FikenConnectionMetadata,
     private readonly context: FikenContext,
     private readonly fetchImpl: FetchLike = fetch,
+    private readonly authorizeProviderRequest?: FikenProviderAuthorization,
   ) {
+    this.expectedConnectionVersion = connection.version;
     // OAuth-kind connections refresh through the generic broker; route that
-    // token-endpoint transport through the same injectable Fiken fetch.
+    // token-endpoint transport through the same injectable Fiken fetch. Keep
+    // the optional authorization immediately before actual refresh I/O.
+    const refreshFetch: FetchLike = this.authorizeProviderRequest
+      ? async (input, init) => {
+          if ((await this.authorizeProviderRequest?.()) === false) {
+            throw new Error("the Fiken credential refresh is no longer authorized");
+          }
+          return await this.fetchImpl(input, init);
+        }
+      : fetchImpl;
     this.resolveCredential = buildConnectionTokenResolver(db, settings, undefined, {
-      refreshTransport: { fetchImpl },
+      refreshTransport: { fetchImpl: refreshFetch },
     });
   }
 
@@ -619,17 +725,27 @@ export class FikenClient {
       for (const [key, value] of Object.entries(input.query ?? {})) {
         url.searchParams.set(key, value);
       }
-      // Credential resolution (DB read + possible broker refresh) happens
-      // outside the serialization chain: only the provider HTTP call itself
-      // must obey Fiken's single-concurrent-request rule.
-      const headers = await this.headersFor(operation, url.toString());
       const result = await serializedPerConnection(this.connection.id, async () => {
+        const authority = await this.currentAuthority(this.expectedConnectionVersion);
+        const credential = await this.credentialFor(operation, url.toString());
+        await this.currentAuthority(credential.connectionVersion, authority.authorityGeneration);
+        // The adapter callback is a fallible preflight. The canonical
+        // credential callback below records the physical-use fact, so it must
+        // be the final await before the target fetch.
+        if (this.authorizeProviderRequest && (await this.authorizeProviderRequest()) === false) {
+          throw new Error("the Fiken provider request is no longer authorized");
+        }
+        await this.currentAuthority(credential.connectionVersion, authority.authorityGeneration);
+        if (credential.authorizeProviderRequest && !(await credential.authorizeProviderRequest())) {
+          throw new Error("the Fiken provider request is no longer authorized");
+        }
+        this.expectedConnectionVersion = credential.connectionVersion;
         let response: Response;
         try {
           response = await this.fetchImpl(url, {
             method,
             headers: {
-              ...headers,
+              ...credential.headers,
               accept: "application/json",
               ...(input.body !== undefined ? { "content-type": "application/json" } : {}),
             },
@@ -642,7 +758,7 @@ export class FikenClient {
         } catch {
           throw new FikenProviderError("transport_error");
         }
-        return await this.readResponse(operation, response);
+        return await this.readResponse(operation, response, credential.connectionVersion);
       });
       await this.recordAudit(operation, "succeeded");
       return result;
@@ -655,15 +771,14 @@ export class FikenClient {
   private async readResponse(
     operation: FikenOperation,
     response: Response,
+    credentialVersion: number,
   ): Promise<{ payload: unknown; page: FikenPage | null; locationId: number | null }> {
     if (response.status === 401) {
       await response.body?.cancel().catch(() => undefined);
-      // A 401 after resolution means the credential is genuinely rejected
-      // (revoked token or revoked OAuth grant). setConnectionStatus is a
-      // strict version CAS and a broker refresh may have bumped the version
-      // since this client resolved the row, so re-read the current version
-      // instead of using the resolution-time snapshot.
-      await this.markNeedsReauth().catch(() => undefined);
+      // Only the exact active credential generation sent on this request may
+      // transition. A late 401 must not poison a reconnect or revocation that
+      // became current while the provider response was in flight.
+      await this.markNeedsReauth(credentialVersion).catch(() => undefined);
       throw new FikenProviderError("credential_rejected", 401);
     }
     if (response.status === 429) {
@@ -699,27 +814,67 @@ export class FikenClient {
     return { payload, page: pageFromHeaders(response.headers), locationId };
   }
 
-  private async markNeedsReauth(): Promise<void> {
+  private async markNeedsReauth(credentialVersion: number): Promise<void> {
     const current = await getConnectionMetadata(
       this.db,
       this.context.workspaceId,
       this.connection.id,
       null,
     );
-    if (!current || current.status === "needs_reauth") return;
+    if (
+      !current ||
+      current.status !== "active" ||
+      current.version !== credentialVersion ||
+      !isFikenConnection(current)
+    ) {
+      return;
+    }
     await setConnectionStatus(
       this.db,
       this.context.workspaceId,
       "needs_reauth",
       "Fiken rejected the credential",
-      { id: current.id, version: current.version, subjectId: null },
+      { id: current.id, version: credentialVersion, subjectId: null },
     );
   }
 
-  private async headersFor(
+  private async currentAuthority(
+    expectedVersion: number,
+    expectedAuthorityGeneration?: number,
+  ): Promise<{ version: number; authorityGeneration: number }> {
+    const current = await loadConnectionCredentialForBroker(this.db, this.settings, {
+      workspaceId: this.context.workspaceId,
+      connectionId: this.connection.id,
+      providerDomain: FIKEN_PROVIDER_DOMAIN,
+      kind: this.connection.kind === "oauth2" ? "oauth2" : "api_key",
+      subjectId: null,
+      ...(expectedAuthorityGeneration !== undefined ? { expectedAuthorityGeneration } : {}),
+    });
+    if (
+      !current ||
+      current.accountId !== this.context.accountId ||
+      current.workspaceId !== this.context.workspaceId ||
+      current.subjectId !== null ||
+      current.providerDomain !== FIKEN_PROVIDER_DOMAIN ||
+      current.kind !== this.connection.kind ||
+      current.status !== "active" ||
+      current.version !== expectedVersion ||
+      current.authorityGeneration === undefined ||
+      !fikenConnectionMetadata(current.metadata)
+    ) {
+      throw new Error("the Fiken connection authority changed");
+    }
+    return { version: current.version, authorityGeneration: current.authorityGeneration };
+  }
+
+  private async credentialFor(
     operation: FikenOperation,
     destinationUrl: string,
-  ): Promise<Record<string, string>> {
+  ): Promise<{
+    headers: Record<string, string>;
+    connectionVersion: number;
+    authorizeProviderRequest?: () => Promise<boolean>;
+  }> {
     const result = await this.resolveCredential({
       workspaceId: this.context.workspaceId,
       serverId: "opengeni-fiken",
@@ -732,10 +887,20 @@ export class FikenClient {
       },
       destinationUrl,
     });
-    if (result.status !== "ok" || result.connectionId !== this.connection.id) {
+    if (
+      result.status !== "ok" ||
+      result.connectionId !== this.connection.id ||
+      result.connectionVersion === undefined
+    ) {
       throw new Error("the Fiken connection needs to be reconnected");
     }
-    return result.headers;
+    return {
+      headers: result.headers,
+      connectionVersion: result.connectionVersion,
+      ...(result.authorizeProviderRequest
+        ? { authorizeProviderRequest: result.authorizeProviderRequest }
+        : {}),
+    };
   }
 
   private receipt(operation: FikenOperation, operationId?: string) {
@@ -771,7 +936,12 @@ export class FikenClient {
 }
 
 export function createFikenClient(
-  deps: { db: Database; settings: Settings; fikenFetch?: typeof fetch },
+  deps: {
+    db: Database;
+    settings: Settings;
+    fikenFetch?: typeof fetch;
+    authorizeProviderRequest?: FikenProviderAuthorization;
+  },
   resolved: Awaited<ReturnType<typeof resolveFikenConnectionForTool>>,
 ): FikenClient {
   return new FikenClient(
@@ -781,6 +951,7 @@ export function createFikenClient(
     resolved.metadata,
     resolved.context,
     deps.fikenFetch,
+    deps.authorizeProviderRequest,
   );
 }
 
@@ -898,6 +1069,8 @@ export class FikenOAuthCallbackError extends Error {
 }
 
 type FikenOAuthState = {
+  externalContinuation?: ExternalActorContinuation;
+  connectAttemptId?: string;
   accountId: string;
   workspaceId: string;
   subjectId: string;
@@ -931,8 +1104,11 @@ export async function startFikenOAuth(
     subjectId: string;
     requestUrl: string;
     payload: FikenOAuthStartRequest;
+    externalContinuation?: ExternalActorContinuation;
+    connectAttemptId?: string;
   },
 ): Promise<FikenOAuthStartResponse> {
+  await withOrganizationIntegrationAcquisition(deps.db, input, ["fiken"], async () => {});
   const fiken = requireFikenOAuthSettings(deps.settings);
   const existing = input.payload.connectionId
     ? await getConnectionMetadata(deps.db, input.workspaceId, input.payload.connectionId, null)
@@ -948,7 +1124,18 @@ export async function startFikenOAuth(
     accountId: input.accountId,
     workspaceId: input.workspaceId,
     subjectId: input.subjectId,
-    returnPath: `/workspaces/${input.workspaceId}/capabilities`,
+    returnPath: safeReturnPath(
+      input.payload.returnPath ?? workspaceIntegrationsPath(input.workspaceId),
+    ),
+    ...(input.connectAttemptId ? { connectAttemptId: input.connectAttemptId } : {}),
+    ...(input.externalContinuation
+      ? {
+          encryptedExternalContinuation: encryptEnvironmentValue(
+            requireEnvironmentEncryption(deps.settings),
+            JSON.stringify(ExternalActorContinuation.parse(input.externalContinuation)),
+          ),
+        }
+      : {}),
     ...(existing ? { connectionId: existing.id, connectionVersion: existing.version } : {}),
   });
   const authorizationUrl = new URL(FIKEN_AUTHORIZE_URL);
@@ -970,12 +1157,38 @@ export async function completeFikenOAuthCallback(
     error?: string | undefined;
     requestUrl: string;
   },
-): Promise<{ redirectTo: string }> {
+): Promise<{ redirectTo: string; exactReturn?: boolean }> {
   const baseUrl = integrationBaseUrl(deps.settings.publicBaseUrl, input.requestUrl);
   const returnBaseUrl = deps.settings.webBaseUrl?.replace(/\/+$/, "") ?? baseUrl;
   let state: FikenOAuthState | null = null;
+  let exactReturnUrl: string | undefined;
+  let operation: { attemptId: string; operationId: string; inputDigest: string } | undefined;
   try {
     state = readFikenOAuthState(input.state, deps.settings);
+    if (state.connectAttemptId) {
+      const stored = await getConnectAttempt(deps.db, state, state.connectAttemptId);
+      if (stored.attempt.providerId !== "fiken-oauth" || stored.attempt.ownership !== "workspace")
+        throw new FikenOAuthCallbackError("invalid_state");
+      exactReturnUrl = stored.returnUrl;
+      operation = {
+        attemptId: state.connectAttemptId,
+        operationId: `oauth:${state.nonce}`,
+        inputDigest: createHash("sha256").update(input.state!).digest("hex"),
+      };
+      const claim = await claimOAuthAcquisition(
+        deps.db,
+        state,
+        {
+          ...operation,
+          expectedRevision: stored.attempt.revision,
+          authorize: (tx, _attempt, origin) =>
+            requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
+        },
+        "fiken",
+        Boolean(input.code && !input.error),
+      );
+      if (claim.status === "replayed") return { redirectTo: exactReturnUrl, exactReturn: true };
+    }
     await requireFikenCallbackGrant(deps.db, state);
     const consumed = await consumeIntegrationOAuthStateNonce(deps.db, {
       accountId: state.accountId,
@@ -988,6 +1201,27 @@ export async function completeFikenOAuthCallback(
     if (!consumed) {
       throw new FikenOAuthCallbackError("state_replayed");
     }
+    // A proven pre-exchange rejection is terminal, not an uncertain provider
+    // effect. Persist its receipt so repeated browser callbacks cannot retry it.
+    if (operation && (input.error || !input.code)) {
+      await finishConnectOperation(deps.db, state, {
+        ...operation,
+        authorize: (tx, _attempt, origin) =>
+          requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
+        commit: async (_tx, current) => ({
+          ...current,
+          revision: current.revision + 1,
+          state: input.error === "access_denied" ? "cancelled" : "failed",
+          nextAction: { type: "none" },
+          error: {
+            code: input.error ? "provider_denied" : "missing_code",
+            message: "Authorization was not completed. Start a new connection attempt.",
+            retryable: false,
+          },
+        }),
+      });
+      return { redirectTo: exactReturnUrl!, exactReturn: true };
+    }
     if (input.error) {
       throw new FikenOAuthCallbackError(
         input.error === "access_denied" ? "provider_denied" : "provider_error",
@@ -996,6 +1230,7 @@ export async function completeFikenOAuthCallback(
     if (!input.code) {
       throw new FikenOAuthCallbackError("missing_code");
     }
+    await withOrganizationIntegrationAcquisition(deps.db, state, ["fiken"], async () => {});
     const fiken = requireFikenOAuthSettings(deps.settings);
     const key = requireEnvironmentEncryption(deps.settings);
     const fetchImpl = deps.fikenFetch ?? fetch;
@@ -1052,34 +1287,76 @@ export async function completeFikenOAuthCallback(
       defaultCompanySlug,
       verifiedAt: new Date().toISOString(),
     };
-    const connection = existing
-      ? await updateConnection(deps.db, {
-          workspaceId: state.workspaceId,
-          connectionId: existing.id,
-          visibleToSubjectId: null,
-          expectedVersion: existing.version,
-          kind: "oauth2",
-          status: "active",
-          credentialEncrypted,
-          expiresAt: token.expiresAt,
-          metadata,
-          updatedBySubjectId: state.subjectId,
-        })
-      : await createConnection(deps.db, {
-          accountId: state.accountId,
-          workspaceId: state.workspaceId,
-          // Workspace-owned by design, like the pasted-token install: the
-          // first-party fiken tools resolve only workspace connections until
-          // the delegation-snapshot lane exists for personal ownership.
-          subjectId: null,
-          providerDomain: FIKEN_PROVIDER_DOMAIN,
-          kind: "oauth2",
-          credentialEncrypted,
-          grantedScopes: [],
-          expiresAt: token.expiresAt,
-          metadata,
-          createdBySubjectId: state.subjectId,
-        });
+    const persist = (tx: Database) =>
+      existing
+        ? updateConnection(tx, {
+            workspaceId: state!.workspaceId,
+            connectionId: existing.id,
+            visibleToSubjectId: null,
+            expectedVersion: existing.version,
+            kind: "oauth2",
+            status: "active",
+            credentialEncrypted,
+            expiresAt: token.expiresAt,
+            metadata,
+            updatedBySubjectId: state!.subjectId,
+          })
+        : createConnection(tx, {
+            accountId: state!.accountId,
+            workspaceId: state!.workspaceId,
+            // Workspace-owned by design, like the pasted-token install: the
+            // first-party fiken tools resolve only workspace connections until
+            // the delegation-snapshot lane exists for personal ownership.
+            subjectId: null,
+            providerDomain: FIKEN_PROVIDER_DOMAIN,
+            kind: "oauth2",
+            credentialEncrypted,
+            grantedScopes: [],
+            expiresAt: token.expiresAt,
+            metadata,
+            createdBySubjectId: state!.subjectId,
+          });
+    if (operation) {
+      await finishOAuthAcquisition(
+        deps.db,
+        state,
+        {
+          ...operation,
+          authorize: (tx, _attempt, origin) =>
+            requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
+          commit: async (tx, current) => {
+            const connection = await persist(tx);
+            if (!connection) throw new FikenOAuthCallbackError("connection_conflict");
+            return {
+              ...current,
+              revision: current.revision + 1,
+              state: "complete",
+              credentialsCommitted: true,
+              nextAction: { type: "none" },
+              account: {
+                id: connection.id,
+                version: connection.version,
+                providerId: "fiken-oauth",
+                label: "Fiken",
+                ownership: "workspace",
+                status: "connected",
+              },
+            };
+          },
+        },
+        "fiken",
+      );
+      return { redirectTo: exactReturnUrl!, exactReturn: true };
+    }
+    const connection = await withOrganizationIntegrationAcquisition(
+      deps.db,
+      state,
+      ["fiken"],
+      async (tx) => {
+        await requireFikenCallbackGrant(tx, state!);
+        return persist(tx);
+      },
+    );
     if (!connection) {
       throw new FikenOAuthCallbackError("connection_conflict");
     }
@@ -1087,12 +1364,17 @@ export async function completeFikenOAuthCallback(
       redirectTo: fikenReturnUrl(returnBaseUrl, state.returnPath, "connected", connection.id),
     };
   } catch (error) {
+    if (exactReturnUrl) return { redirectTo: exactReturnUrl, exactReturn: true };
+    // Reading the state is the first step, so no state means the link itself
+    // was unusable: say whether it expired instead of suggesting a token.
+    const failure = state ? null : oauthStateFailureReturn(deps.settings, input.state);
     return {
       redirectTo: fikenReturnUrl(
         returnBaseUrl,
-        state?.returnPath ?? "/integrations",
+        state?.returnPath ?? failure!.returnPath,
         "error",
-        error instanceof FikenOAuthCallbackError ? error.reason : "callback_failed",
+        failure?.reason ??
+          (error instanceof FikenOAuthCallbackError ? error.reason : "callback_failed"),
       ),
     };
   }
@@ -1190,6 +1472,21 @@ function readFikenOAuthState(raw: string | undefined, settings: Settings): Fiken
     workspaceId: required(payload.workspaceId),
     subjectId: required(payload.subjectId),
     returnPath: required(payload.returnPath),
+    ...(typeof payload.connectAttemptId === "string"
+      ? { connectAttemptId: required(payload.connectAttemptId) }
+      : {}),
+    ...(typeof payload.encryptedExternalContinuation === "string"
+      ? {
+          externalContinuation: ExternalActorContinuation.parse(
+            JSON.parse(
+              decryptEnvironmentValue(
+                requireEnvironmentEncryption(settings),
+                payload.encryptedExternalContinuation,
+              ),
+            ),
+          ),
+        }
+      : {}),
     ...(typeof payload.connectionId === "string" ? { connectionId: payload.connectionId } : {}),
     ...(typeof payload.connectionVersion === "number"
       ? { connectionVersion: payload.connectionVersion }
@@ -1200,14 +1497,7 @@ function readFikenOAuthState(raw: string | undefined, settings: Settings): Fiken
 }
 
 async function requireFikenCallbackGrant(db: Database, state: FikenOAuthState): Promise<void> {
-  const grant = await getWorkspaceGrant(db, state.subjectId, state.workspaceId);
-  if (
-    !grant ||
-    grant.accountId !== state.accountId ||
-    !hasPermission(grant.permissions, "connections:write")
-  ) {
-    throw new FikenOAuthCallbackError("permission_lost");
-  }
+  await requireConnectOwnerAuthority(db, state);
 }
 
 function fikenReturnUrl(