@opengeni/api-router 0.30.3 → 1.0.0

package/src/routes/preference-registry.ts

@@ -1,8 +1,5 @@
 import {
-  ActivatePreferenceRegistryRevisionRequest,
   ChangePreferenceRegistryScopeRequest,
-  CorrectPreferenceRegistryRequest,
-  CreatePreferenceRegistryProposalRequest,
   DeactivatePreferenceRegistryRequest,
   PreferenceRegistryConflictResponse,
   PreferenceRegistryDetailResponse,
@@ -11,7 +8,6 @@ import {
   PreferenceRegistryListQuery,
   PreferenceRegistryListResponse,
   PreferenceRegistryMutationResponse,
-  PreferenceRegistryRecord,
   PreferenceRegistrySnapshot,
   RejectPreferenceRegistryProposalRequest,
   SupersedePreferenceRegistryRequest,
@@ -26,10 +22,7 @@ import {
   type ApiRouteDeps,
 } from "@opengeni/core";
 import {
-  activatePreferenceRegistryRevision,
   changePreferenceRegistryScope,
-  correctPreferenceRegistry,
-  createPreferenceRegistryProposal,
   deactivatePreferenceRegistry,
   getOrCreatePreferenceRegistrySnapshot,
   getPreferenceRegistryDetail,
@@ -214,34 +207,20 @@ export function registerPreferenceRegistryRoutes(app: Hono, deps: ApiRouteDeps):
     }
   });
 
-  app.post(`${base}/proposals`, async (context) => {
-    const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization(
-      context,
-      deps,
-      workspaceId,
-      "workspace:read",
-    );
-    const { grant } = access;
-    const request = await parseBody(context, CreatePreferenceRegistryProposalRequest);
-    authorizePreferenceRegistryScopeMutation(access, request.scope);
-    try {
+  // Retain an explicit migration response, not a second single-text writer.
+  for (const path of ["/proposals", "/:preferenceId/activate", "/:preferenceId/correct"]) {
+    app.post(`${base}${path}`, async (context) => {
+      await requireAccessGrant(context, deps, context.req.param("workspaceId"), "workspace:read");
       return context.json(
-        PreferenceRegistryRecord.parse(
-          await createPreferenceRegistryProposal(deps.db, {
-            ...request,
-            accountId: grant.accountId,
-            workspaceId,
-            actorSubjectId: grant.subjectId,
-            principalKind: grant.principalKind,
-          }),
-        ),
-        201,
+        {
+          code: "SKILL_FILE_LIFECYCLE_REQUIRED",
+          message:
+            "Use the Skill content save, approve, or restore API. Skill metadata comes from SKILL.md frontmatter; this legacy endpoint makes no change.",
+        },
+        410,
       );
-    } catch (error) {
-      return preferenceError(context, error);
-    }
-  });
+    });
+  }
 
   app.get(`${base}/summary`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
@@ -300,66 +279,6 @@ export function registerPreferenceRegistryRoutes(app: Hono, deps: ApiRouteDeps):
     }
   });
 
-  app.post(`${base}/:preferenceId/activate`, async (context) => {
-    const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization(
-      context,
-      deps,
-      workspaceId,
-      "workspace:read",
-    );
-    const { grant } = access;
-    const id = preferenceId(context);
-    const request = await parseBody(context, ActivatePreferenceRegistryRevisionRequest);
-    try {
-      return context.json(
-        PreferenceRegistryMutationResponse.parse(
-          await activatePreferenceRegistryRevision(deps.db, {
-            accountId: grant.accountId,
-            workspaceId,
-            actorSubjectId: grant.subjectId,
-            principalKind: grant.principalKind,
-            preferenceId: id,
-            authorizeScope: (scope) => authorizePreferenceRegistryScopeMutation(access, scope),
-            ...request,
-          }),
-        ),
-      );
-    } catch (error) {
-      return preferenceError(context, error);
-    }
-  });
-
-  app.post(`${base}/:preferenceId/correct`, async (context) => {
-    const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization(
-      context,
-      deps,
-      workspaceId,
-      "workspace:read",
-    );
-    const { grant } = access;
-    const id = preferenceId(context);
-    const request = await parseBody(context, CorrectPreferenceRegistryRequest);
-    try {
-      return context.json(
-        PreferenceRegistryMutationResponse.parse(
-          await correctPreferenceRegistry(deps.db, {
-            ...request,
-            accountId: grant.accountId,
-            workspaceId,
-            actorSubjectId: grant.subjectId,
-            principalKind: grant.principalKind,
-            preferenceId: id,
-            authorizeScope: (scope) => authorizePreferenceRegistryScopeMutation(access, scope),
-          }),
-        ),
-      );
-    } catch (error) {
-      return preferenceError(context, error);
-    }
-  });
-
   app.post(`${base}/:preferenceId/scope`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization(

package/src/routes/rigs.ts

@@ -10,8 +10,14 @@ import {
   RigChangeTransitionError,
 } from "@opengeni/db";
 import type { Hono } from "hono";
+import type { Context } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { requireAccessGrant } from "@opengeni/core";
+import type { ZodType } from "zod";
+import {
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  requirePermission,
+} from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   activateRigVersionForApi,
@@ -27,10 +33,64 @@ import {
   updateRigForApi,
 } from "@opengeni/core";
 import { boundedLimit } from "../http/common";
+import { ApiHttpError } from "../http/api-error";
+
+async function parseRigRequest<T>(c: Context, schema: ZodType<T>, label: string): Promise<T> {
+  const body: unknown = await c.req.json().catch(() => null);
+  const bodyRecord = body && typeof body === "object" ? (body as Record<string, unknown>) : null;
+  const payloadRecord =
+    bodyRecord?.payload && typeof bodyRecord.payload === "object"
+      ? (bodyRecord.payload as Record<string, unknown>)
+      : null;
+  const imageOverrideUnsupported = Boolean(
+    (bodyRecord && Object.hasOwn(bodyRecord, "image")) ||
+    (payloadRecord && Object.hasOwn(payloadRecord, "image")),
+  );
+  const parsed = schema.safeParse(body);
+  if (parsed.success && !imageOverrideUnsupported) return parsed.data;
+  throw new ApiHttpError(422, {
+    code: "validation_failed",
+    message: imageOverrideUnsupported
+      ? "Sandbox Environment base-image overrides are not supported; Sandbox Environments use the deployment-managed platform sandbox."
+      : `Invalid ${label}.`,
+    retryable: false,
+    details: {
+      ...(imageOverrideUnsupported ? { code: "RIG_IMAGE_OVERRIDE_UNSUPPORTED" } : {}),
+      fields: parsed.success
+        ? []
+        : parsed.error.issues.slice(0, 16).map((issue) => ({
+            path: issue.path,
+            code: issue.code,
+          })),
+    },
+  });
+}
 
 export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, workflowClient } = deps;
 
+  async function requireRigMutation(
+    c: Context,
+    workspaceId: string,
+    permission: "rigs:manage" | "rigs:use",
+  ) {
+    const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId, permission);
+    const rigId = c.req.param("rigId");
+    if (!rigId) {
+      throw new HTTPException(400, { message: "sandbox environment id is required" });
+    }
+    const rig = await requireRigForApi(db, authorization.grant, rigId);
+    if (
+      rig.scope === "organization" &&
+      authorization.accountGrant?.permissions.includes("account:admin") !== true
+    ) {
+      throw new HTTPException(403, {
+        message: "missing permission: account:admin",
+      });
+    }
+    return { authorization, grant: authorization.grant, rig };
+  }
+
   async function startChangeVerification(
     workspaceId: string,
     changeId: string,
@@ -66,7 +126,7 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
       // The verifying transition already committed. Keep its deterministic
       // attempt identity retryable instead of reporting an opaque 5xx after a
       // durable mutation or inventing a second attempt after an ambiguous start.
-      deps.observability?.warn("rig change verification start failed", {
+      deps.observability?.warn("sandbox environment change verification start failed", {
         workspaceId,
         changeId,
         attempt,
@@ -103,26 +163,45 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
       // Creation already committed. The rig remains fully usable through its
       // runtime setup fallback and can be re-verified explicitly; never turn a
       // successful create into an unretryable 5xx because Temporal was down.
-      deps.observability?.warn("initial rig provider-image verification start failed", {
-        workspaceId,
-        versionId,
-        error: error instanceof Error ? error.message : String(error),
-      });
+      deps.observability?.warn(
+        "initial sandbox environment provider-image verification start failed",
+        {
+          workspaceId,
+          versionId,
+          error: error instanceof Error ? error.message : String(error),
+        },
+      );
       return false;
     }
   }
 
   app.get("/v1/workspaces/:workspaceId/rigs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
-    return c.json(await listRigs(db, workspaceId));
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    return c.json(await listRigs(db, grant));
   });
 
   app.post("/v1/workspaces/:workspaceId/rigs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
-    const payload = CreateRigRequest.parse(await c.req.json());
-    const rig = await createRigForApi({ db }, grant, payload);
+    const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+    const grant = authorization.grant;
+    requirePermission(grant, "rigs:manage");
+    const payload = await parseRigRequest(
+      c,
+      CreateRigRequest,
+      "Sandbox Environment create request",
+    );
+    const allowOrganization =
+      payload.scope === "organization" &&
+      authorization.accountGrant?.permissions.includes("account:admin") === true;
+    if (payload.scope === "organization" && !allowOrganization) {
+      throw new HTTPException(403, {
+        message: "missing permission: account:admin",
+      });
+    }
+    const rig = await createRigForApi({ db }, grant, payload, {
+      allowOrganization,
+    });
     if (rig.activeVersion) {
       const started = await tryStartInitialVersionVerification(workspaceId, rig.activeVersion.id);
       if (!started) c.header("OpenGeni-Rig-Verification", "deferred");
@@ -132,40 +211,67 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/rigs/:rigId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
-    return c.json(await requireRigForApi(db, workspaceId, c.req.param("rigId")));
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    return c.json(await requireRigForApi(db, grant, c.req.param("rigId")));
   });
 
   app.patch("/v1/workspaces/:workspaceId/rigs/:rigId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
-    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
-    const payload = UpdateRigRequest.parse(await c.req.json());
-    return c.json(await updateRigForApi({ db }, grant, rig, payload));
+    const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+    const grant = authorization.grant;
+    requirePermission(grant, "rigs:manage");
+    const rig = await requireRigForApi(db, grant, c.req.param("rigId"));
+    const allowOrganization =
+      rig.scope === "organization" &&
+      authorization.accountGrant?.permissions.includes("account:admin") === true;
+    if (rig.scope === "organization" && !allowOrganization) {
+      throw new HTTPException(403, {
+        message: "missing permission: account:admin",
+      });
+    }
+    const payload = await parseRigRequest(
+      c,
+      UpdateRigRequest,
+      "Sandbox Environment update request",
+    );
+    return c.json(await updateRigForApi({ db }, grant, rig, payload, { allowOrganization }));
   });
 
   app.delete("/v1/workspaces/:workspaceId/rigs/:rigId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
-    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
-    await deleteRigForApi({ db }, grant, rig);
+    const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+    const grant = authorization.grant;
+    requirePermission(grant, "rigs:manage");
+    const rig = await requireRigForApi(db, grant, c.req.param("rigId"));
+    const allowOrganization =
+      rig.scope === "organization" &&
+      authorization.accountGrant?.permissions.includes("account:admin") === true;
+    if (rig.scope === "organization" && !allowOrganization) {
+      throw new HTTPException(403, {
+        message: "missing permission: account:admin",
+      });
+    }
+    await deleteRigForApi({ db }, grant, rig, { allowOrganization });
     return c.json({ ok: true });
   });
 
   app.get("/v1/workspaces/:workspaceId/rigs/:rigId/versions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
-    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
-    return c.json(await listRigVersionsForApi({ db }, workspaceId, rig.id));
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    const rig = await requireRigForApi(db, grant, c.req.param("rigId"));
+    return c.json(await listRigVersionsForApi({ db }, rig.workspaceId, rig.id));
   });
 
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/versions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
-    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
-    const payload = RigDefinitionEditPayload.parse(await c.req.json());
+    const { grant, rig } = await requireRigMutation(c, workspaceId, "rigs:manage");
+    const payload = await parseRigRequest(
+      c,
+      RigDefinitionEditPayload,
+      "Sandbox Environment version request",
+    );
     const version = await createRigVersionForApi({ db }, grant, rig, payload);
-    const started = await tryStartInitialVersionVerification(workspaceId, version.id);
+    const started = await tryStartInitialVersionVerification(rig.workspaceId, version.id);
     if (!started) c.header("OpenGeni-Rig-Verification", "deferred");
     return c.json(version, 201);
   });
@@ -173,18 +279,22 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
   // Rollback / promote-activate: flips which existing version is active.
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/versions/:versionId/activate", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
-    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
+    const { grant, rig } = await requireRigMutation(c, workspaceId, "rigs:manage");
     const version = await activateRigVersionForApi({ db }, grant, rig, c.req.param("versionId"));
     return c.json(version);
   });
 
   app.get("/v1/workspaces/:workspaceId/rigs/:rigId/changes", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
-    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    const rig = await requireRigForApi(db, grant, c.req.param("rigId"));
     return c.json(
-      await listRigChangesForApi({ db }, workspaceId, rig.id, boundedLimit(c.req.query("limit"))),
+      await listRigChangesForApi(
+        { db },
+        rig.workspaceId,
+        rig.id,
+        boundedLimit(c.req.query("limit")),
+      ),
     );
   });
 
@@ -193,54 +303,61 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
   // promote gate (definition_edit) land in M4.
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/changes", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:use");
-    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
-    const request = ProposeRigChangeRequest.parse(await c.req.json());
+    const { grant, rig } = await requireRigMutation(c, workspaceId, "rigs:use");
+    const request = await parseRigRequest(
+      c,
+      ProposeRigChangeRequest,
+      "Sandbox Environment change request",
+    );
     const change = await proposeRigChangeForApi({ db }, grant, rig, request);
-    const verification = await startChangeVerification(workspaceId, change.id);
+    const verification = await startChangeVerification(rig.workspaceId, change.id);
     if (!verification.started) c.header("OpenGeni-Rig-Verification", "deferred");
     return c.json(verification.change, 201);
   });
 
   app.get("/v1/workspaces/:workspaceId/rigs/:rigId/changes/:changeId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    const rig = await requireRigForApi(db, grant, c.req.param("rigId"));
     return c.json(
-      await requireRigChangeForApi(db, workspaceId, c.req.param("rigId"), c.req.param("changeId")),
+      await requireRigChangeForApi(db, rig.workspaceId, rig.id, c.req.param("changeId")),
     );
   });
 
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/changes/:changeId/verify", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    const { rig } = await requireRigMutation(c, workspaceId, "rigs:use");
     const change = await requireRigChangeForApi(
       db,
-      workspaceId,
-      c.req.param("rigId"),
+      rig.workspaceId,
+      rig.id,
       c.req.param("changeId"),
     );
-    const verification = await startChangeVerification(workspaceId, change.id);
+    const verification = await startChangeVerification(rig.workspaceId, change.id);
     if (!verification.started) c.header("OpenGeni-Rig-Verification", "deferred");
     return c.json(verification.change, 202);
   });
 
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/changes/:changeId/promote", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
-    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
-    const change = await requireRigChangeForApi(db, workspaceId, rig.id, c.req.param("changeId"));
+    const { grant, rig } = await requireRigMutation(c, workspaceId, "rigs:manage");
+    const change = await requireRigChangeForApi(
+      db,
+      rig.workspaceId,
+      rig.id,
+      c.req.param("changeId"),
+    );
     const promoted = await promoteVerifiedDefinitionEditChangeForApi({ db }, grant, rig, change);
     return c.json(promoted.version, 201);
   });
 
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/verify", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
-    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
+    const { rig } = await requireRigMutation(c, workspaceId, "rigs:use");
     if (!rig.activeVersion) {
-      return c.json({ error: "rig has no active version" }, 422);
+      return c.json({ error: "sandbox environment has no active version" }, 422);
     }
-    await startVersionVerification(workspaceId, rig.activeVersion.id);
+    await startVersionVerification(rig.workspaceId, rig.activeVersion.id);
     return c.json({ ok: true, versionId: rig.activeVersion.id }, 202);
   });
 }