@opengeni/api-router 0.30.3 → 1.0.0

package/src/routes/environments.ts

@@ -1,12 +1,12 @@
 import {
   CreateVariableSetRequest,
+  ResolveVariableSetAttachmentsRequest,
+  ResolveVariableSetAttachmentsResponse,
   SetVariableSetVariableRequest,
   UpdateVariableSetRequest,
   VariableSetVariableName,
 } from "@opengeni/contracts";
 import {
-  countActiveSessionsUsingVariableSet,
-  countScheduledTasksUsingVariableSet,
   countVariableSets,
   createVariableSet,
   decryptVariableSetValue,
@@ -16,12 +16,19 @@ import {
   getVariableSetByName,
   listVariableSets,
   readVariableSetSecretAtomically,
+  resolveVariableSetAttachments,
   setVariableSetVariable,
   updateVariableSet,
+  VariableSetAttachedError,
 } from "@opengeni/db";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { requireAccessGrant, requireLiteralPermission, requirePermission } from "@opengeni/core";
+import {
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  requireLiteralPermission,
+  requirePermission,
+} from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   assertAllowedVariableSetVariableName,
@@ -31,6 +38,7 @@ import {
   requireVariableSetEncryption,
   requireVariableSetForApi,
 } from "@opengeni/core";
+import { parseRequestJson } from "../http/request-body";
 
 export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { settings, db } = deps;
@@ -45,15 +53,35 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       const grant = await requireAccessGrant(c, deps, workspaceId);
       requirePermission(grant, "variable-sets:list");
       requirePermission(grant, "secrets:list");
-      return c.json(await listVariableSets(db, workspaceId));
+      return c.json(
+        await listVariableSets(db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+        }),
+      );
     });
 
     app.post(`${prefix}`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId);
+      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+      const grant = authorization.grant;
       requirePermission(grant, "variable-sets:write");
       const key = requireVariableSetEncryption(settings);
-      const payload = CreateVariableSetRequest.parse(await c.req.json());
+      const payload = await parseRequestJson(c, CreateVariableSetRequest);
+      if (prefix.endsWith("/environments") && payload.scope !== "workspace") {
+        throw new HTTPException(422, {
+          message: "the legacy environments route only creates workspace-scoped variable sets",
+        });
+      }
+      if (
+        payload.scope === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") !== true
+      ) {
+        throw new HTTPException(403, {
+          message: "missing permission: account:admin",
+        });
+      }
       if (payload.variables.length > 0) {
         requirePermission(grant, "secrets:write");
       }
@@ -73,12 +101,17 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
         }
         variableNames.add(variable.name);
       }
-      if ((await countVariableSets(db, workspaceId)) >= MAX_ENVIRONMENTS_PER_WORKSPACE) {
+      const access = {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+      };
+      if ((await countVariableSets(db, access, payload.scope)) >= MAX_ENVIRONMENTS_PER_WORKSPACE) {
         throw new HTTPException(422, {
           message: `a workspace supports at most ${MAX_ENVIRONMENTS_PER_WORKSPACE} variable sets`,
         });
       }
-      if (await getVariableSetByName(db, workspaceId, name)) {
+      if (await getVariableSetByName(db, access, name, payload.scope)) {
         throw new HTTPException(409, {
           message: `variable set name is already in use: ${name}`,
         });
@@ -88,6 +121,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       const created = await createVariableSet(db, {
         accountId: grant.accountId,
         workspaceId,
+        scope: payload.scope,
+        subjectId: grant.subjectId,
+        allowOrganization: payload.scope === "organization",
         name,
         description: payload.description ?? null,
         variables: payload.variables.map((variable) => ({
@@ -103,12 +139,32 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       return c.json(created, 201);
     });
 
+    if (prefix.endsWith("/variable-sets")) {
+      app.post(`${prefix}/resolve-attachments`, async (c) => {
+        const workspaceId = c.req.param("workspaceId")!;
+        const grant = await requireAccessGrant(c, deps, workspaceId);
+        requirePermission(grant, "variable-sets:attach");
+        requirePermission(grant, "variable-sets:use");
+        const payload = await parseRequestJson(c, ResolveVariableSetAttachmentsRequest);
+        const variableSets = await resolveVariableSetAttachments(
+          db,
+          {
+            accountId: grant.accountId,
+            workspaceId,
+            subjectId: grant.subjectId,
+          },
+          payload.variableSetIds,
+        );
+        return c.json(ResolveVariableSetAttachmentsResponse.parse({ variableSets }));
+      });
+    }
+
     app.get(`${prefix}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
       const grant = await requireAccessGrant(c, deps, workspaceId);
       requirePermission(grant, "variable-sets:read");
       requirePermission(grant, "secrets:list");
-      return c.json(await requireVariableSetForApi(db, workspaceId, c.req.param("variableSetId")!));
+      return c.json(await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!));
     });
 
     if (prefix.endsWith("/variable-sets")) {
@@ -139,27 +195,47 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.patch(`${prefix}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId);
+      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+      const grant = authorization.grant;
       requirePermission(grant, "variable-sets:write");
-      const variableSet = await requireVariableSetForApi(
-        db,
-        workspaceId,
-        c.req.param("variableSetId")!,
-      );
-      const payload = UpdateVariableSetRequest.parse(await c.req.json());
+      const variableSet = await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!);
+      const allowOrganization =
+        variableSet.scope === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") === true;
+      if (variableSet.scope === "organization" && !allowOrganization) {
+        throw new HTTPException(403, {
+          message: "missing permission: account:admin",
+        });
+      }
+      const payload = await parseRequestJson(c, UpdateVariableSetRequest);
       const name = payload.name !== undefined ? trimmedVariableSetName(payload.name) : undefined;
       if (name !== undefined && name !== variableSet.name) {
-        const existing = await getVariableSetByName(db, workspaceId, name);
+        const existing = await getVariableSetByName(
+          db,
+          {
+            accountId: grant.accountId,
+            workspaceId,
+            subjectId: grant.subjectId,
+          },
+          name,
+          variableSet.scope,
+        );
         if (existing && existing.id !== variableSet.id) {
           throw new HTTPException(409, {
             message: `variable set name is already in use: ${name}`,
           });
         }
       }
-      const updated = await updateVariableSet(db, workspaceId, variableSet.id, {
-        ...(name !== undefined ? { name } : {}),
-        ...(payload.description !== undefined ? { description: payload.description } : {}),
-      });
+      const updated = await updateVariableSet(
+        db,
+        { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+        variableSet.id,
+        {
+          ...(name !== undefined ? { name } : {}),
+          ...(payload.description !== undefined ? { description: payload.description } : {}),
+          allowOrganization,
+        },
+      );
       await recordVariableSetAuditEvent(db, {
         grant,
         action: "variable_set.updated",
@@ -170,35 +246,36 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.delete(`${prefix}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId);
+      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+      const grant = authorization.grant;
       requirePermission(grant, "variable-sets:write");
       requirePermission(grant, "secrets:write");
-      const variableSet = await requireVariableSetForApi(
-        db,
-        workspaceId,
-        c.req.param("variableSetId")!,
-      );
-      const attachedTasks = await countScheduledTasksUsingVariableSet(
-        db,
-        workspaceId,
-        variableSet.id,
-      );
-      if (attachedTasks > 0) {
-        throw new HTTPException(409, {
-          message: `variable set is attached to ${attachedTasks} scheduled task(s); detach first`,
+      const variableSet = await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!);
+      const allowOrganization =
+        variableSet.scope === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") === true;
+      if (variableSet.scope === "organization" && !allowOrganization) {
+        throw new HTTPException(403, {
+          message: "missing permission: account:admin",
         });
       }
-      const activeSessions = await countActiveSessionsUsingVariableSet(
-        db,
-        workspaceId,
-        variableSet.id,
-      );
-      if (activeSessions > 0) {
-        throw new HTTPException(409, {
-          message: `variable set is attached to ${activeSessions} active session(s); wait for them to finish or cancel them first`,
-        });
+      try {
+        await deleteVariableSet(
+          db,
+          {
+            accountId: grant.accountId,
+            workspaceId,
+            subjectId: grant.subjectId,
+          },
+          variableSet.id,
+          { allowOrganization },
+        );
+      } catch (error) {
+        if (error instanceof VariableSetAttachedError) {
+          throw new HTTPException(409, { message: error.message });
+        }
+        throw error;
       }
-      await deleteVariableSet(db, workspaceId, variableSet.id);
       await recordVariableSetAuditEvent(db, {
         grant,
         action: "variable_set.deleted",
@@ -209,17 +286,22 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.put(`${prefix}/:variableSetId/variables/:name`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId);
+      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+      const grant = authorization.grant;
       requirePermission(grant, "variable-sets:write");
       requirePermission(grant, "secrets:write");
       const key = requireVariableSetEncryption(settings);
       const name = parseVariableName(c.req.param("name")!);
-      const variableSet = await requireVariableSetForApi(
-        db,
-        workspaceId,
-        c.req.param("variableSetId")!,
-      );
-      const payload = SetVariableSetVariableRequest.parse(await c.req.json());
+      const variableSet = await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!);
+      const allowOrganization =
+        variableSet.scope === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") === true;
+      if (variableSet.scope === "organization" && !allowOrganization) {
+        throw new HTTPException(403, {
+          message: "missing permission: account:admin",
+        });
+      }
+      const payload = await parseRequestJson(c, SetVariableSetVariableRequest);
       const exists = variableSet.variables.some((variable) => variable.name === name);
       if (!exists && variableSet.variables.length >= MAX_VARIABLES_PER_ENVIRONMENT) {
         throw new HTTPException(422, {
@@ -229,9 +311,11 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       const metadata = await setVariableSetVariable(db, {
         accountId: grant.accountId,
         workspaceId,
+        subjectId: grant.subjectId,
         variableSetId: variableSet.id,
         name,
         valueEncrypted: encryptVariableSetValue(key, payload.value),
+        allowOrganization,
       });
       await recordVariableSetAuditEvent(db, {
         grant,
@@ -244,16 +328,28 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.delete(`${prefix}/:variableSetId/variables/:name`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId);
+      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+      const grant = authorization.grant;
       requirePermission(grant, "variable-sets:write");
       requirePermission(grant, "secrets:write");
       const name = parseVariableName(c.req.param("name")!);
-      const variableSet = await requireVariableSetForApi(
-        db,
+      const variableSet = await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!);
+      const allowOrganization =
+        variableSet.scope === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") === true;
+      if (variableSet.scope === "organization" && !allowOrganization) {
+        throw new HTTPException(403, {
+          message: "missing permission: account:admin",
+        });
+      }
+      const deleted = await deleteVariableSetVariable(db, {
+        accountId: grant.accountId,
         workspaceId,
-        c.req.param("variableSetId")!,
-      );
-      const deleted = await deleteVariableSetVariable(db, workspaceId, variableSet.id, name);
+        subjectId: grant.subjectId,
+        variableSetId: variableSet.id,
+        name,
+        allowOrganization,
+      });
       if (!deleted) {
         throw new HTTPException(404, {
           message: "variable set variable not found",

package/src/routes/external-identity-links.ts

@@ -0,0 +1,201 @@
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+import {
+  BeginExternalIdentityLinkRequest,
+  ConfirmExternalIdentityLinkRequest,
+} from "@opengeni/contracts/external-identities";
+import {
+  beginExternalIdentityLink,
+  confirmExternalIdentityLink,
+  getExternalIdentityLink,
+  listExternalIdentityLinks,
+  previewExternalIdentityLink,
+  revokeExternalIdentityLink,
+  ensureExternalIdentity,
+  ExternalIdentityLinkConflictError,
+  withWorkspaceSubjectRls,
+  lockExternalWorkspaceMembershipLifecycle,
+  getWorkspaceGrant,
+  namedSubjectPersonalWorkspaceId,
+  managedPersonalWorkspacePermissions,
+} from "@opengeni/db";
+import {
+  requireAccessGrantAuthorization,
+  externalActorContinuationForAuthorization,
+  externalContinuationCommitAuthorizer,
+  hasPermission,
+  type AccessGrantAuthorization,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import { parseRequestBody, parseRequestJson, readRequestJson } from "../http/request-body";
+
+function nativeConfirmation(authorization: AccessGrantAuthorization) {
+  if (
+    !authorization.contextIntegrity ||
+    !authorization.canonicalManagedHumanSession ||
+    authorization.authenticatedSubjectId !== authorization.grant.subjectId ||
+    !authorization.grant.subjectId.startsWith("user:")
+  )
+    throw new HTTPException(403, { message: "Confirm using your authenticated Opengeni account" });
+}
+
+/** Both products address the link through a workspace they already own. The
+ * link itself is organization-local; the host's Personal workspace need not be
+ * exposed to the native human, and neither side names the other's subject. */
+export function registerExternalIdentityLinkRoutes(app: Hono, deps: ApiRouteDeps) {
+  const base = "/v1/workspaces/:workspaceId/identity-links";
+  app.get(base, async (c) => {
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      c.req.param("workspaceId"),
+      "workspace:read",
+    );
+    if (!externalActorContinuationForAuthorization(authorization))
+      nativeConfirmation(authorization);
+    const parsedCursor = z.string().uuid().optional().safeParse(c.req.query("cursor"));
+    if (!parsedCursor.success) throw new HTTPException(400, { message: "Invalid link cursor" });
+    const cursor = parsedCursor.data;
+    const grant = authorization.grant;
+    return c.json(
+      await withWorkspaceSubjectRls(deps.db, grant.workspaceId, grant.subjectId, async (tx) => {
+        await externalContinuationCommitAuthorizer(authorization)?.(tx);
+        return listExternalIdentityLinks(tx, {
+          accountId: grant.accountId,
+          subjectId: grant.subjectId,
+          ...(cursor ? { cursor } : {}),
+        });
+      }),
+    );
+  });
+  app.post(base, async (c) => {
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      c.req.param("workspaceId"),
+      "workspace:read",
+    );
+    const continuation = externalActorContinuationForAuthorization(authorization);
+    if (!continuation || continuation.actor.actingMode !== "external")
+      throw new HTTPException(403, { message: "Start linking as the external product user" });
+    const input = await parseRequestJson(c, BeginExternalIdentityLinkRequest);
+    if (input.expiresAt !== null && Date.parse(input.expiresAt) <= Date.now())
+      throw new HTTPException(422, { message: "Link expiry must be in the future" });
+    const commit = externalContinuationCommitAuthorizer(authorization)!;
+    try {
+      const result = await withWorkspaceSubjectRls(
+        deps.db,
+        authorization.grant.workspaceId,
+        authorization.grant.subjectId,
+        async (tx) => {
+          await commit(tx);
+          const identity = await ensureExternalIdentity(tx, {
+            accountId: authorization.grant.accountId,
+            ...continuation.identity,
+          });
+          return beginExternalIdentityLink(tx, identity, input);
+        },
+      );
+      return c.json(result, 201);
+    } catch (error) {
+      if (error instanceof ExternalIdentityLinkConflictError)
+        throw new HTTPException(409, { message: error.message });
+      throw error;
+    }
+  });
+  app.on(["GET", "POST"], [base + "/:linkId", base + "/:linkId/:operation"], async (c) => {
+    const workspaceId = c.req.param("workspaceId")!;
+    const linkId = z.string().uuid().parse(c.req.param("linkId"));
+    const operation = c.req.param("operation");
+    if (
+      !(
+        (c.req.method === "GET" && !operation) ||
+        (c.req.method === "POST" && ["preview", "confirm", "revoke"].includes(operation ?? ""))
+      )
+    )
+      throw new HTTPException(404, { message: "Not found" });
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "workspace:read",
+    );
+    const external = externalActorContinuationForAuthorization(authorization);
+    if (operation === "preview" || operation === "confirm" || !external)
+      nativeConfirmation(authorization);
+    const grant = authorization.grant;
+    const input = c.req.method === "POST" ? await readRequestJson(c) : null;
+    try {
+      const result = await withWorkspaceSubjectRls(
+        deps.db,
+        workspaceId,
+        grant.subjectId,
+        async (tx) => {
+          await externalContinuationCommitAuthorizer(authorization)?.(tx);
+          if (operation === "preview") {
+            const request = parseRequestBody(
+              z.object({ challenge: ConfirmExternalIdentityLinkRequest.shape.challenge }).strict(),
+              input,
+            );
+            const preview = await previewExternalIdentityLink(tx, {
+              accountId: grant.accountId,
+              linkId,
+              ...request,
+            });
+            return preview
+              ? { ...preview, nativeSubjectId: grant.subjectId, organizationId: grant.accountId }
+              : null;
+          }
+          if (operation === "confirm") {
+            const request = parseRequestBody(ConfirmExternalIdentityLinkRequest, input);
+            await lockExternalWorkspaceMembershipLifecycle(tx, grant.accountId);
+            const personalWorkspaceId = await namedSubjectPersonalWorkspaceId(tx, {
+              accountId: grant.accountId,
+              subjectId: grant.subjectId,
+            });
+            const current =
+              personalWorkspaceId === workspaceId
+                ? { accountId: grant.accountId, permissions: managedPersonalWorkspacePermissions }
+                : await getWorkspaceGrant(tx, grant.subjectId, workspaceId, {
+                    principalKind: "human_session",
+                  });
+            if (
+              !current ||
+              current.accountId !== grant.accountId ||
+              request.permissions.some(
+                (permission) =>
+                  !hasPermission(grant.permissions, permission) ||
+                  !hasPermission(current.permissions, permission),
+              )
+            )
+              throw new HTTPException(403, {
+                message: "Link permissions exceed your authority in this workspace",
+              });
+            return confirmExternalIdentityLink(tx, {
+              accountId: grant.accountId,
+              linkId,
+              nativeSubjectId: grant.subjectId,
+              request,
+            });
+          }
+          const scope = { accountId: grant.accountId, linkId, subjectId: grant.subjectId };
+          if (operation === "revoke") {
+            const request = parseRequestBody(
+              z.object({ expectedRevision: z.number().int().positive().safe() }).strict(),
+              input,
+            );
+            return revokeExternalIdentityLink(tx, { ...scope, ...request });
+          }
+          return getExternalIdentityLink(tx, scope);
+        },
+      );
+      if (!result) throw new HTTPException(404, { message: "Identity link not found or expired" });
+      return c.json(result);
+    } catch (error) {
+      if (error instanceof ExternalIdentityLinkConflictError)
+        throw new HTTPException(409, { message: error.message });
+      throw error;
+    }
+  });
+}

package/src/routes/feedback.ts

@@ -0,0 +1,113 @@
+import { CreateFeedbackRequest } from "@opengeni/contracts";
+import {
+  requireAccessGrant,
+  requireSessionAuthorization,
+  withResolvedSessionAuthorization,
+  SessionAuthorizationDeniedError,
+  SessionAuthorizationUnavailableError,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import {
+  createFeedback,
+  listOwnFeedback,
+  FeedbackConflictError,
+  FeedbackTargetNotFoundError,
+} from "@opengeni/db";
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+
+export function registerFeedbackRoutes(app: Hono, deps: ApiRouteDeps): void {
+  app.post("/v1/workspaces/:workspaceId/feedback", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    await requireAccessGrant(c, deps, workspaceId, "sessions:create");
+    const parsed = CreateFeedbackRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success)
+      throw new HTTPException(400, {
+        message: parsed.error.issues[0]?.message ?? "Invalid feedback",
+      });
+    // Agent turns must not manufacture user satisfaction evidence. Product SDK
+    // credentials are allowed but retain their own authenticated author/kind.
+    if (
+      grant.principalKind === "agent_attempt" ||
+      grant.metadata?.["turnId"] !== undefined ||
+      grant.metadata?.["attemptId"] !== undefined
+    )
+      throw new HTTPException(403, { message: "Agent attempts cannot submit feedback" });
+    try {
+      const save = () =>
+        createFeedback(deps.db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          principalKind: grant.principalKind ?? null,
+          request: parsed.data,
+        });
+      let result;
+      if (parsed.data.sessionId) {
+        await requireAccessGrant(c, deps, workspaceId, "sessions:read");
+        const authorization = await requireSessionAuthorization(deps, grant, {
+          sessionId: parsed.data.sessionId,
+          operation: "session.feedback.write",
+          surface: "http",
+        });
+        result = authorization
+          ? await withResolvedSessionAuthorization(authorization, save)
+          : await save();
+      } else result = await save();
+      c.header("cache-control", "private, no-store");
+      return c.json(result, result.replayed ? 200 : 201);
+    } catch (error) {
+      throw feedbackHttpError(error);
+    }
+  });
+  app.get("/v1/workspaces/:workspaceId/feedback", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const query = z
+      .object({
+        sessionId: z.string().uuid().optional(),
+        includeTurns: z
+          .enum(["true", "false"])
+          .default("true")
+          .transform((value) => value === "true"),
+        limit: z.coerce.number().int().min(1).max(100).default(50),
+      })
+      .safeParse(c.req.query());
+    if (!query.success) throw new HTTPException(400, { message: "Invalid feedback query" });
+    try {
+      const read = () =>
+        listOwnFeedback(deps.db, { workspaceId, subjectId: grant.subjectId, ...query.data });
+      let feedback;
+      if (query.data.sessionId) {
+        await requireAccessGrant(c, deps, workspaceId, "sessions:read");
+        const authorization = await requireSessionAuthorization(deps, grant, {
+          sessionId: query.data.sessionId,
+          operation: "session.read",
+          surface: "http",
+        });
+        feedback = authorization
+          ? await withResolvedSessionAuthorization(authorization, read)
+          : await read();
+      } else feedback = await read();
+      c.header("cache-control", "private, no-store");
+      return c.json({ feedback });
+    } catch (error) {
+      throw feedbackHttpError(error);
+    }
+  });
+}
+function feedbackHttpError(error: unknown): Error {
+  if (error instanceof FeedbackConflictError)
+    return new HTTPException(409, { message: error.message });
+  if (
+    error instanceof FeedbackTargetNotFoundError ||
+    error instanceof SessionAuthorizationDeniedError
+  )
+    return new HTTPException(404, { message: "Feedback target not found" });
+  if (error instanceof SessionAuthorizationUnavailableError)
+    return new HTTPException(503, { message: "Session authorization unavailable" });
+  if (error instanceof Error) return error;
+  return new Error("Feedback request failed");
+}