@opengeni/api-router 0.30.1 → 1.0.0

package/src/routes/canonical-human-identities.ts

@@ -5,7 +5,11 @@ import {
   CanonicalHumanIdentityProjection,
   LinkCanonicalHumanLoginBindingRequest,
 } from "@opengeni/contracts/canonical-human-identities";
-import { requireCanonicalHumanRequestIdentity } from "@opengeni/core/canonical-human-identities";
+import {
+  getManagedAuthRequestActorLeaseStamp,
+  markManagedAuthRequestActorTransitionApplied,
+  requireCanonicalHumanRequestIdentity,
+} from "@opengeni/core/canonical-human-identities";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   applyCanonicalHumanIdentityOperation,
@@ -13,11 +17,15 @@ import {
   CanonicalHumanIdentityConflictError,
   CanonicalHumanIdentityNotFoundError,
   CanonicalHumanIdentityOperationReuseError,
+  CanonicalHumanIdentityMutationInFlightError,
   getCanonicalHumanIdentityProjection,
 } from "@opengeni/db/canonical-human-identities";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
+import { admitManagedSignInMutation } from "./managed-sign-in-methods";
+import { managedAuthSecretRequestDigest } from "@opengeni/core/managed-auth-session-sets";
+import { deliverManagedSignInNotification } from "../auth/managed-sign-in-notifications";
 
 const BindingId = z.string().uuid();
 
@@ -25,6 +33,8 @@ async function requestIdentity(context: Context, deps: ApiRouteDeps) {
   return await requireCanonicalHumanRequestIdentity(context, {
     db: deps.db,
     ...(deps.managedAuth === undefined ? {} : { managedAuth: deps.managedAuth }),
+    managedAuthSessionAdapter: deps.managedAuthSessionAdapter,
+    managedAuthSessionSetMode: deps.settings.managedAuthSessionSetMode,
     allowRecovery: true,
   });
 }
@@ -50,6 +60,9 @@ function identityError(context: Context, error: unknown): Response {
   if (error instanceof CanonicalHumanIdentityOperationReuseError) {
     return context.json({ code: error.code, message: error.message }, 409);
   }
+  if (error instanceof CanonicalHumanIdentityMutationInFlightError) {
+    return context.json({ code: error.code, message: error.message, retryable: true }, 409);
+  }
   if (error instanceof CanonicalHumanIdentityNotFoundError) {
     return context.json(
       { code: "CANONICAL_HUMAN_IDENTITY_NOT_FOUND", message: error.message },
@@ -76,24 +89,47 @@ async function mutate(
     operationId: string;
     expectedIdentityRevision: number;
     reason: string;
+    verifiedManagedRecovery?: boolean;
   },
 ): Promise<Response> {
   const identity = await requestIdentity(context, deps);
+  const actorFence = getManagedAuthRequestActorLeaseStamp(context.req.raw);
+  if (deps.settings.managedAuthSessionSetMode !== "legacy" && !actorFence) {
+    throw new HTTPException(409, { message: "Managed actor mutation fence is unavailable" });
+  }
   try {
-    return context.json(
-      CanonicalHumanIdentityMutationResponse.parse(
-        await applyCanonicalHumanIdentityOperation(deps.db, {
-          operationId: input.operationId,
-          authUserId: identity.authUserId,
-          expectedIdentityRevision: input.expectedIdentityRevision,
-          operationType: input.operationType,
-          ...(input.bindingId ? { bindingId: input.bindingId } : {}),
-          ...(input.providerId ? { providerId: input.providerId } : {}),
-          ...(input.providerAccountId ? { providerAccountId: input.providerAccountId } : {}),
-          reason: input.reason,
-        }),
-      ),
+    const response = CanonicalHumanIdentityMutationResponse.parse(
+      await applyCanonicalHumanIdentityOperation(deps.db, {
+        operationId: input.operationId,
+        authUserId: identity.authUserId,
+        expectedIdentityRevision: input.expectedIdentityRevision,
+        operationType: input.operationType,
+        ...(input.bindingId ? { bindingId: input.bindingId } : {}),
+        ...(input.providerId ? { providerId: input.providerId } : {}),
+        ...(input.providerAccountId ? { providerAccountId: input.providerAccountId } : {}),
+        reason: input.reason,
+        ...(input.verifiedManagedRecovery
+          ? {
+              verifiedRecovery: {
+                authSessionId: identity.authSessionId,
+                requestDigest: managedAuthSecretRequestDigest(
+                  deps.settings.betterAuthSecret!,
+                  input,
+                ),
+              },
+            }
+          : {}),
+        ...(actorFence ? { actorFence } : {}),
+      }),
     );
+    if (actorFence) markManagedAuthRequestActorTransitionApplied(context.req.raw);
+    if (input.verifiedManagedRecovery)
+      await deliverManagedSignInNotification(
+        deps.db,
+        deps.managedEmailTransport,
+        input.operationId,
+      );
+    return context.json(response);
   } catch (error) {
     return identityError(context, error);
   }
@@ -117,6 +153,11 @@ export function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDe
 
   app.post(`${base}/login-bindings`, async (context) => {
     const request = await parseBody(context, LinkCanonicalHumanLoginBindingRequest);
+    if (["google", "github", "credential"].includes(request.providerId.trim().toLowerCase())) {
+      throw new HTTPException(403, {
+        message: "Use personal sign-in method settings with fresh provider proof",
+      });
+    }
     return await mutate(context, deps, {
       operationType: "link",
       ...request,
@@ -126,6 +167,19 @@ export function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDe
 
   app.delete(`${base}/login-bindings/:bindingId`, async (context) => {
     const request = await parseBody(context, CanonicalHumanBindingOperationRequest);
+    const actor = await requestIdentity(context, deps);
+    const projection = await getCanonicalHumanIdentityProjection(deps.db, actor.authUserId);
+    if (
+      projection.loginBindings.some(
+        (binding) =>
+          binding.id === bindingId(context) &&
+          ["google", "github", "credential"].includes(binding.providerId),
+      )
+    ) {
+      throw new HTTPException(403, {
+        message: "Use personal sign-in method settings with last-method protection",
+      });
+    }
     return await mutate(context, deps, {
       operationType: "unlink",
       bindingId: bindingId(context),
@@ -136,6 +190,19 @@ export function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDe
 
   app.post(`${base}/login-bindings/:bindingId/recovery`, async (context) => {
     const request = await parseBody(context, CanonicalHumanBindingOperationRequest);
+    const actor = await requestIdentity(context, deps);
+    const projection = await getCanonicalHumanIdentityProjection(deps.db, actor.authUserId);
+    if (
+      projection.loginBindings.some(
+        (binding) =>
+          binding.id === bindingId(context) &&
+          ["google", "github", "credential"].includes(binding.providerId),
+      )
+    ) {
+      throw new HTTPException(403, {
+        message: "Managed-provider recovery cannot be initiated through raw binding management",
+      });
+    }
     return await mutate(context, deps, {
       operationType: "begin_recovery",
       bindingId: bindingId(context),
@@ -146,11 +213,20 @@ export function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDe
 
   app.post(`${base}/login-bindings/:bindingId/recovery/complete`, async (context) => {
     const request = await parseBody(context, CanonicalHumanBindingOperationRequest);
+    const actor = await requestIdentity(context, deps);
+    const projection = await getCanonicalHumanIdentityProjection(deps.db, actor.authUserId);
+    const managed = projection.loginBindings.some(
+      (binding) =>
+        binding.id === bindingId(context) &&
+        ["google", "github", "credential"].includes(binding.providerId),
+    );
+    if (managed) await admitManagedSignInMutation(context, deps);
     return await mutate(context, deps, {
       operationType: "recover",
       bindingId: bindingId(context),
       ...request,
       operationId: request.operationId ?? randomUUID(),
+      ...(managed ? { verifiedManagedRecovery: true } : {}),
     });
   });
 }

package/src/routes/capabilities.ts

@@ -3,9 +3,16 @@ import {
   CreateCapabilityCatalogItemRequest,
   DiscoverMcpCapabilitiesResponse,
   EnableCapabilityRequest,
+  ConnectorToolPermissionsResponse,
+  UpdateConnectorToolPermissionsRequest,
 } from "@opengeni/contracts";
 import type { Hono } from "hono";
-import { requireAccessGrant } from "@opengeni/core";
+import {
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  getConnectorToolPermissions,
+  updateConnectorToolPermissions,
+} from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   buildCapabilityCatalog,
@@ -15,10 +22,62 @@ import {
   enableCapability,
   officialMcpRegistryUrl,
 } from "@opengeni/core";
+import { isPersonalConnectionOwnerPrincipal } from "../connection-ownership";
 import { boundedLimit } from "../http/common";
+import { z } from "zod";
+import pluginSnapshot from "../../../../data/catalog/plugins-snapshot.json";
+const discoverablePlugins = pluginSnapshot.sources
+  .flatMap((source) => source.entries.map((entry) => ({ ...entry, provider: source.provider })))
+  .sort((a, b) => a.displayName.localeCompare(b.displayName) || a.id.localeCompare(b.id));
+import { inspectMcpAuthentication } from "../integrations/oauth-client";
+import { parseRequestJson } from "../http/request-body";
 
 export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, settings } = deps;
+  app.get("/v1/workspaces/:workspaceId/capabilities/discovery/plugins", async (c) => {
+    await requireAccessGrant(c, deps, c.req.param("workspaceId"), "workspace:read");
+    const query = (c.req.query("query") ?? "").trim().toLowerCase();
+    const provider = c.req.query("provider");
+    const id = c.req.query("id");
+    const offset = z.coerce
+      .number()
+      .int()
+      .min(0)
+      .max(10000)
+      .parse(c.req.query("offset") ?? 0);
+    const matches = discoverablePlugins.filter(
+      (item) =>
+        (!id || item.id === id) &&
+        (!provider || item.provider === provider) &&
+        query
+          .split(/\s+/)
+          .every((term) =>
+            [
+              item.displayName,
+              item.name,
+              item.description,
+              item.category,
+              item.author?.name,
+              ...item.keywords,
+              ...(item.components ?? []),
+            ]
+              .join(" ")
+              .toLowerCase()
+              .includes(term),
+          ),
+    );
+    const end = offset + 40;
+    return c.json({
+      items: matches.slice(offset, end),
+      total: matches.length,
+      nextOffset: end < matches.length ? end : null,
+    });
+  });
+  app.post("/v1/workspaces/:workspaceId/capabilities/discovery/mcp-auth", async (c) => {
+    await requireAccessGrant(c, deps, c.req.param("workspaceId"), "workspace:read");
+    const { url } = await parseRequestJson(c, z.object({ url: z.string().url().max(2048) }));
+    return c.json(await inspectMcpAuthentication(url, settings));
+  });
 
   app.get("/v1/workspaces/:workspaceId/capabilities", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -32,8 +91,8 @@ export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/capabilities", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const payload = CreateCapabilityCatalogItemRequest.parse(await c.req.json());
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
+    const payload = await parseRequestJson(c, CreateCapabilityCatalogItemRequest);
     return c.json(
       await createCatalogItem({ db, accountId: grant.accountId, workspaceId, payload }),
       201,
@@ -60,10 +119,52 @@ export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
   });
 
+  app.get("/v1/workspaces/:workspaceId/capabilities/:capabilityId/tool-permissions", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:read");
+    return c.json(
+      ConnectorToolPermissionsResponse.parse(
+        await getConnectorToolPermissions({
+          db,
+          settings,
+          workspaceId,
+          grant: access.grant,
+          capabilityId: decodeURIComponent(c.req.param("capabilityId")),
+          personalOwnerVerified: isPersonalConnectionOwnerPrincipal(access),
+        }),
+      ),
+    );
+  });
+
+  app.patch(
+    "/v1/workspaces/:workspaceId/capabilities/:capabilityId/tool-permissions",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const access = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "capabilities:manage",
+      );
+      const payload = UpdateConnectorToolPermissionsRequest.safeParse(await c.req.json());
+      if (!payload.success) return c.json({ error: "Invalid connector permission target" }, 400);
+      await updateConnectorToolPermissions({
+        db,
+        settings,
+        workspaceId,
+        grant: access.grant,
+        capabilityId: decodeURIComponent(c.req.param("capabilityId")),
+        personalOwnerVerified: isPersonalConnectionOwnerPrincipal(access),
+        payload: payload.data,
+      });
+      return c.json({ saved: true });
+    },
+  );
+
   app.post("/v1/workspaces/:workspaceId/capabilities/:capabilityId/enable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const payload = EnableCapabilityRequest.parse(await c.req.json());
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
+    const payload = await parseRequestJson(c, EnableCapabilityRequest);
     const installation = await enableCapability({
       db,
       grant,
@@ -78,7 +179,7 @@ export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/capabilities/:capabilityId/disable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const installation = await disableCapability({
       db,
       accountId: grant.accountId,

package/src/routes/channels.ts

@@ -1,16 +1,22 @@
 import { z } from "zod";
-import { CreateChannelRequest, UpdateChannelRequest } from "@opengeni/contracts";
+import {
+  CreateChannelRequest,
+  ReorderChannelsRequest,
+  UpdateChannelRequest,
+} from "@opengeni/contracts";
 import {
   ChannelNameConflictError,
   createChannel,
   deleteChannel,
   listChannels,
+  reorderChannels,
   updateChannel,
 } from "@opengeni/db";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { requireAccessGrant } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
+import { parseRequestJson } from "../http/request-body";
 
 // Workspace-shared channels organize root sessions ("workstreams") by work
 // type in the rail. Deliberately session-permission-gated (not workspace:admin):
@@ -37,7 +43,7 @@ export function registerChannelRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/channels", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:create");
-    const payload = CreateChannelRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, CreateChannelRequest);
     try {
       const channel = await createChannel(db, {
         accountId: grant.accountId,
@@ -58,7 +64,7 @@ export function registerChannelRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.patch("/v1/workspaces/:workspaceId/channels/:channelId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "sessions:create");
-    const payload = UpdateChannelRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, UpdateChannelRequest);
     try {
       const channel = await updateChannel(
         db,
@@ -78,6 +84,17 @@ export function registerChannelRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
   });
 
+  app.put("/v1/workspaces/:workspaceId/channels/order", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "sessions:create");
+    const payload = await parseRequestJson(c, ReorderChannelsRequest);
+    const channels = await reorderChannels(db, workspaceId, payload.channelIds);
+    if (!channels) {
+      throw new HTTPException(409, { message: "projects changed; refresh and try again" });
+    }
+    return c.json(channels);
+  });
+
   app.delete("/v1/workspaces/:workspaceId/channels/:channelId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "sessions:create");