@opengeni/api-router 0.30.3 → 1.0.0

package/src/routes/organization-model-providers.ts

@@ -0,0 +1,293 @@
+import { claudeProviderId } from "@opengeni/config";
+import {
+  CreateOrganizationProviderCustomModelRequest,
+  DeleteOrganizationProviderCustomModelRequest,
+  OrganizationModelProviderConnectionResponse,
+  OrganizationModelProviderKind,
+  OrganizationProviderCustomModel,
+  OrganizationProviderCustomModelsResponse,
+  RevokeOrganizationModelProviderConnectionRequest,
+  UpsertOrganizationModelProviderConnectionRequest,
+} from "@opengeni/contracts";
+import { requireEnvironmentEncryption, type ApiRouteDeps } from "@opengeni/core";
+import {
+  createOrganizationModelProviderCustomModel,
+  encryptEnvironmentValue,
+  getOrganizationModelProviderConnection,
+  listOrganizationModelProviderCustomModels,
+  organizationModelProviderCredentialDigest,
+  OrganizationModelProviderConflictError,
+  OrganizationModelProviderLimitError,
+  retireOrganizationModelProviderCustomModel,
+  revokeOrganizationModelProviderConnection,
+  upsertOrganizationModelProviderConnection,
+} from "@opengeni/db";
+import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+
+import { requireOrganizationCodexHuman, requireSameOriginBrowserMutation } from "./codex";
+
+const OrganizationId = z.string().uuid();
+
+function parseOrganizationId(value: string): string {
+  const parsed = OrganizationId.safeParse(value);
+  if (!parsed.success) throw new HTTPException(404, { message: "organization not found" });
+  return parsed.data;
+}
+
+async function jsonBody<T>(c: Context, schema: z.ZodType<T>, message: string): Promise<T> {
+  const parsed = schema.safeParse(await c.req.json().catch(() => null));
+  if (!parsed.success) throw new HTTPException(422, { message });
+  return parsed.data;
+}
+
+function providerKind(value: string) {
+  const parsed = OrganizationModelProviderKind.safeParse(value);
+  if (!parsed.success) throw new HTTPException(404, { message: "model provider not found" });
+  return parsed.data;
+}
+
+function connectionJson(connection: {
+  providerKind: "vercel_gateway" | "openrouter" | "anthropic" | "claude_subscription";
+  status: "active" | "revoked";
+  version: number;
+  createdAt: Date;
+  updatedAt: Date;
+}) {
+  return OrganizationModelProviderConnectionResponse.parse({
+    ...connection,
+    createdAt: connection.createdAt.toISOString(),
+    updatedAt: connection.updatedAt.toISOString(),
+  });
+}
+
+function modelJson(model: {
+  id: string;
+  upstreamModelId: string;
+  label: string | null;
+  version: number;
+  createdAt: Date;
+  updatedAt: Date;
+}) {
+  return OrganizationProviderCustomModel.parse({
+    ...model,
+    createdAt: model.createdAt.toISOString(),
+    updatedAt: model.updatedAt.toISOString(),
+  });
+}
+
+function conflict(error: unknown): never {
+  if (error instanceof OrganizationModelProviderConflictError) {
+    throw new HTTPException(409, { message: "organization model provider version conflict" });
+  }
+  if (error instanceof OrganizationModelProviderLimitError) {
+    throw new HTTPException(409, { message: "organization custom model limit reached" });
+  }
+  throw error;
+}
+
+export function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRouteDeps): void {
+  app.use("/v1/organizations/:organizationId/model-providers/:providerKind", async (c, next) => {
+    if (
+      c.req.param("providerKind") === "claude_subscription" &&
+      !deps.settings.claudeSubscriptionEnabled
+    )
+      throw new HTTPException(404, { message: "Claude subscriptions are not enabled" });
+    await next();
+  });
+  app.use("/v1/organizations/:organizationId/model-providers/:providerKind/*", async (c, next) => {
+    if (
+      c.req.param("providerKind") === "claude_subscription" &&
+      !deps.settings.claudeSubscriptionEnabled
+    )
+      throw new HTTPException(404, { message: "Claude subscriptions are not enabled" });
+    await next();
+  });
+  app.get("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
+    c.header("cache-control", "private, no-store");
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    if (c.req.param("providerKind") === "claude_subscription")
+      throw new HTTPException(410, { message: "Claude subscriptions use individual accounts." });
+    const connection = await getOrganizationModelProviderConnection(deps.db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+      providerKind: providerKind(c.req.param("providerKind")),
+    });
+    return connection ? c.json(connectionJson(connection)) : c.json(null);
+  });
+  const usagePath = "/v1/organizations/:organizationId/model-providers/:providerKind/usage";
+  async function usageScope(c: Context) {
+    c.header("cache-control", "private, no-store");
+    if (providerKind(c.req.param("providerKind")!) !== "claude_subscription")
+      throw new HTTPException(404, { message: "Usage not available for this provider" });
+    const organizationId = parseOrganizationId(c.req.param("organizationId")!);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    return {
+      accountId: organizationId,
+      workspaceId: null,
+      scope: "organization" as const,
+      actorSubjectId: human.subjectId,
+    };
+  }
+  app.get(usagePath, async (c) => {
+    await usageScope(c);
+    throw new HTTPException(410, { message: "Check usage on the individual Claude account." });
+  });
+  app.post(`${usagePath}/refresh`, async (c) => {
+    requireSameOriginBrowserMutation(c, deps);
+    await usageScope(c);
+    throw new HTTPException(410, { message: "Check usage on the individual Claude account." });
+  });
+
+  app.put("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
+    c.header("cache-control", "private, no-store");
+    requireSameOriginBrowserMutation(c, deps);
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const payload = await jsonBody(
+      c,
+      UpsertOrganizationModelProviderConnectionRequest,
+      "invalid organization model provider connection",
+    );
+    const kind = providerKind(c.req.param("providerKind"));
+    if (kind === "claude_subscription")
+      throw new HTTPException(410, { message: "Claude subscriptions use individual accounts." });
+    if (kind === "anthropic" && !/^sk-ant-api[0-9]+-\S+$/.test(payload.apiKey))
+      throw new HTTPException(422, {
+        message: "Enter an Anthropic API key. Use Claude subscription for setup tokens.",
+      });
+    if (payload.claudeIdentity)
+      throw new HTTPException(422, {
+        message: "Claude identity is only valid for subscription connections.",
+      });
+    const credential = payload.apiKey;
+    try {
+      const connection = await upsertOrganizationModelProviderConnection(deps.db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        providerKind: providerKind(c.req.param("providerKind")),
+        credentialEncrypted: encryptEnvironmentValue(
+          requireEnvironmentEncryption(deps.settings),
+          credential,
+        ),
+        credentialDigest: organizationModelProviderCredentialDigest(credential),
+        operationId: payload.operationId,
+        ...(payload.expectedVersion === undefined
+          ? {}
+          : { expectedVersion: payload.expectedVersion }),
+      });
+      return c.json(connectionJson(connection));
+    } catch (error) {
+      conflict(error);
+    }
+  });
+
+  app.delete("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
+    c.header("cache-control", "private, no-store");
+    requireSameOriginBrowserMutation(c, deps);
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const payload = await jsonBody(
+      c,
+      RevokeOrganizationModelProviderConnectionRequest,
+      "invalid organization model provider disconnect",
+    );
+    try {
+      if (c.req.param("providerKind") === "claude_subscription")
+        throw new HTTPException(410, { message: "Claude subscriptions use individual accounts." });
+      const connection = await revokeOrganizationModelProviderConnection(deps.db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        providerKind: providerKind(c.req.param("providerKind")),
+        ...payload,
+      });
+      return c.json(connectionJson(connection));
+    } catch (error) {
+      conflict(error);
+    }
+  });
+
+  app.get(
+    "/v1/organizations/:organizationId/model-providers/:providerKind/custom-models",
+    async (c) => {
+      c.header("cache-control", "private, no-store");
+      const organizationId = parseOrganizationId(c.req.param("organizationId"));
+      const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+      const models = await listOrganizationModelProviderCustomModels(deps.db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        providerKind: providerKind(c.req.param("providerKind")),
+      });
+      return c.json(
+        OrganizationProviderCustomModelsResponse.parse({ models: models.map(modelJson) }),
+      );
+    },
+  );
+
+  app.post(
+    "/v1/organizations/:organizationId/model-providers/:providerKind/custom-models",
+    async (c) => {
+      c.header("cache-control", "private, no-store");
+      requireSameOriginBrowserMutation(c, deps);
+      const organizationId = parseOrganizationId(c.req.param("organizationId"));
+      const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+      const payload = await jsonBody(
+        c,
+        CreateOrganizationProviderCustomModelRequest,
+        "invalid organization custom model",
+      );
+      const kind = providerKind(c.req.param("providerKind"));
+      if (
+        (kind === "anthropic" || kind === "claude_subscription") &&
+        `${claudeProviderId(kind)}/${payload.upstreamModelId}`.length > 256
+      )
+        throw new HTTPException(422, { message: "Claude model ID is too long" });
+      try {
+        const model = await createOrganizationModelProviderCustomModel(deps.db, {
+          organizationId,
+          actorSubjectId: human.subjectId,
+          providerKind: providerKind(c.req.param("providerKind")),
+          operationId: payload.operationId,
+          upstreamModelId: payload.upstreamModelId,
+          ...(payload.label === undefined ? {} : { label: payload.label }),
+        });
+        return c.json(modelJson(model), 201);
+      } catch (error) {
+        conflict(error);
+      }
+    },
+  );
+
+  app.delete(
+    "/v1/organizations/:organizationId/model-providers/:providerKind/custom-models/:customModelId",
+    async (c) => {
+      c.header("cache-control", "private, no-store");
+      requireSameOriginBrowserMutation(c, deps);
+      const organizationId = parseOrganizationId(c.req.param("organizationId"));
+      const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+      const payload = await jsonBody(
+        c,
+        DeleteOrganizationProviderCustomModelRequest,
+        "invalid organization custom model deletion",
+      );
+      const customModelId = z.string().uuid().safeParse(c.req.param("customModelId"));
+      if (!customModelId.success) {
+        throw new HTTPException(422, { message: "invalid organization custom model id" });
+      }
+      try {
+        const model = await retireOrganizationModelProviderCustomModel(deps.db, {
+          organizationId,
+          actorSubjectId: human.subjectId,
+          providerKind: providerKind(c.req.param("providerKind")),
+          customModelId: customModelId.data,
+          ...payload,
+        });
+        return c.json(modelJson(model));
+      } catch (error) {
+        conflict(error);
+      }
+    },
+  );
+}

package/src/routes/organization-recovery.ts

@@ -0,0 +1,325 @@
+import {
+  AcceptOrganizationRecoveryCustodyRequest,
+  ConfigureOrganizationRecoveryPolicyRequest,
+  DisableOrganizationRecoveryPolicyRequest,
+  OrganizationRecoveryMutationResponse,
+  OrganizationRecoveryOperationCommandRequest,
+  OrganizationRecoveryOverview,
+  StartOrganizationRecoveryOperationRequest,
+} from "@opengeni/contracts/organization-recovery";
+import {
+  getManagedAuthRequestActorAdmissionStamp,
+  getManagedAuthRequestActorLeaseStamp,
+  requireCanonicalHumanRequestIdentity,
+} from "@opengeni/core/canonical-human-identities";
+import type { ApiRouteDeps } from "@opengeni/core";
+import {
+  acceptOrganizationRecoveryCustody,
+  approveOrganizationRecoveryOperation,
+  cancelOrganizationRecoveryOperation,
+  configureOrganizationRecoveryPolicy,
+  disableOrganizationRecoveryPolicy,
+  executeOrganizationRecoveryOperation,
+  getOrganizationRecoveryOverview,
+  OrganizationRecoveryDeniedError,
+  OrganizationRecoveryOperationReuseError,
+  OrganizationRecoveryRevisionConflictError,
+  OrganizationRecoveryUnavailableError,
+  startOrganizationRecoveryOperation,
+} from "@opengeni/db";
+import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+import { ApiHttpError } from "../http/api-error";
+
+const OrganizationId = z.string().uuid();
+const RecoveryOperationId = z.string().uuid();
+
+export type OrganizationRecoveryRouteServices = {
+  requireCanonicalHumanRequestIdentity: typeof requireCanonicalHumanRequestIdentity;
+  getManagedAuthRequestActorAdmissionStamp: typeof getManagedAuthRequestActorAdmissionStamp;
+  getManagedAuthRequestActorLeaseStamp: typeof getManagedAuthRequestActorLeaseStamp;
+  getOrganizationRecoveryOverview: typeof getOrganizationRecoveryOverview;
+  configureOrganizationRecoveryPolicy: typeof configureOrganizationRecoveryPolicy;
+  acceptOrganizationRecoveryCustody: typeof acceptOrganizationRecoveryCustody;
+  disableOrganizationRecoveryPolicy: typeof disableOrganizationRecoveryPolicy;
+  startOrganizationRecoveryOperation: typeof startOrganizationRecoveryOperation;
+  approveOrganizationRecoveryOperation: typeof approveOrganizationRecoveryOperation;
+  cancelOrganizationRecoveryOperation: typeof cancelOrganizationRecoveryOperation;
+  executeOrganizationRecoveryOperation: typeof executeOrganizationRecoveryOperation;
+};
+
+const productionServices: OrganizationRecoveryRouteServices = {
+  requireCanonicalHumanRequestIdentity,
+  getManagedAuthRequestActorAdmissionStamp,
+  getManagedAuthRequestActorLeaseStamp,
+  getOrganizationRecoveryOverview,
+  configureOrganizationRecoveryPolicy,
+  acceptOrganizationRecoveryCustody,
+  disableOrganizationRecoveryPolicy,
+  startOrganizationRecoveryOperation,
+  approveOrganizationRecoveryOperation,
+  cancelOrganizationRecoveryOperation,
+  executeOrganizationRecoveryOperation,
+};
+
+async function requireRecoveryIdentity(
+  context: Context,
+  deps: ApiRouteDeps,
+  services: OrganizationRecoveryRouteServices,
+) {
+  // Recovery is a browser-session ceremony. Never let ambient API, bearer,
+  // service, or machine authority become a competing recovery identity.
+  if (
+    deps.settings.productAccessMode !== "managed" ||
+    !deps.managedAuth ||
+    !context.req.header("cookie") ||
+    context.req.header("authorization")
+  ) {
+    throw new HTTPException(401, {
+      message: "Managed human authentication required",
+    });
+  }
+  const identity = await services.requireCanonicalHumanRequestIdentity(context, {
+    db: deps.db,
+    managedAuth: deps.managedAuth,
+    managedAuthSessionAdapter: deps.managedAuthSessionAdapter,
+    managedAuthSessionSetMode: deps.settings.managedAuthSessionSetMode,
+    allowRecovery: false,
+  });
+  return { ...identity, actorSubjectId: `user:${identity.authUserId}` };
+}
+
+async function parseBody<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
+  const parsed = schema.safeParse(await context.req.json().catch(() => null));
+  if (!parsed.success) {
+    throw new HTTPException(422, {
+      message: "Invalid organization recovery request",
+    });
+  }
+  return parsed.data;
+}
+
+function parseId(schema: z.ZodString, value: string, label: string): string {
+  const parsed = schema.safeParse(value);
+  if (!parsed.success) throw new HTTPException(422, { message: `Invalid ${label}` });
+  return parsed.data;
+}
+
+function organizationId(context: Context): string {
+  return parseId(OrganizationId, context.req.param("organizationId") ?? "", "organization id");
+}
+
+function recoveryOperationId(context: Context): string {
+  return parseId(
+    RecoveryOperationId,
+    context.req.param("recoveryOperationId") ?? "",
+    "recovery operation id",
+  );
+}
+
+export function organizationRecoveryHttpError(error: unknown): Error {
+  if (error instanceof OrganizationRecoveryRevisionConflictError) {
+    return new ApiHttpError(409, {
+      code: "conflict",
+      message: "Recovery state changed; refresh before submitting a new action.",
+      retryable: false,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof OrganizationRecoveryOperationReuseError) {
+    return new ApiHttpError(409, {
+      code: "idempotency_conflict",
+      message: "Operation id was reused with different input.",
+      retryable: false,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof OrganizationRecoveryUnavailableError) {
+    return new ApiHttpError(409, {
+      code: "conflict",
+      message: "Organization recovery is unavailable.",
+      retryable: false,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof OrganizationRecoveryDeniedError) {
+    return new ApiHttpError(404, {
+      code: "not_found",
+      message: "Organization recovery not found.",
+      retryable: false,
+      outcomeUnknown: false,
+    });
+  }
+  if (error instanceof Error) return error;
+  return new Error("Organization recovery failed");
+}
+
+function requireActorFence(
+  context: Context,
+  deps: ApiRouteDeps,
+  services: OrganizationRecoveryRouteServices,
+) {
+  const actorFence = services.getManagedAuthRequestActorLeaseStamp(context.req.raw);
+  if (deps.settings.managedAuthSessionSetMode !== "legacy" && !actorFence) {
+    throw new HTTPException(409, {
+      message: "Managed actor mutation fence is unavailable",
+    });
+  }
+  if (!actorFence) {
+    throw new HTTPException(409, {
+      message: "Organization recovery requires provider-neutral browser login slots",
+    });
+  }
+  return actorFence;
+}
+
+async function mutationContext(
+  context: Context,
+  deps: ApiRouteDeps,
+  services: OrganizationRecoveryRouteServices,
+) {
+  const identity = await requireRecoveryIdentity(context, deps, services);
+  return {
+    organizationId: organizationId(context),
+    actorSubjectId: identity.actorSubjectId,
+    actorAuthUserId: identity.authUserId,
+    actorAuthSessionId: identity.authSessionId,
+    actorFence: requireActorFence(context, deps, services),
+  };
+}
+
+function mutationResponse(context: Context, value: unknown): Response {
+  return context.json(OrganizationRecoveryMutationResponse.parse(value));
+}
+
+export function registerOrganizationRecoveryRoutes(
+  app: Hono,
+  deps: ApiRouteDeps,
+  services: OrganizationRecoveryRouteServices = productionServices,
+): void {
+  const base = "/v1/organizations/:organizationId/recovery";
+
+  app.get(base, async (context) => {
+    const identity = await requireRecoveryIdentity(context, deps, services);
+    try {
+      return context.json(
+        OrganizationRecoveryOverview.parse(
+          await services.getOrganizationRecoveryOverview(deps.db, {
+            organizationId: organizationId(context),
+            actorSubjectId: identity.actorSubjectId,
+            actorAuthUserId: identity.authUserId,
+            actorAuthSessionId: identity.authSessionId,
+            actorFence: services.getManagedAuthRequestActorAdmissionStamp(context.req.raw) ?? null,
+          }),
+        ),
+      );
+    } catch (error) {
+      throw organizationRecoveryHttpError(error);
+    }
+  });
+
+  app.put(`${base}/policy`, async (context) => {
+    const authority = await mutationContext(context, deps, services);
+    const payload = await parseBody(context, ConfigureOrganizationRecoveryPolicyRequest);
+    try {
+      return mutationResponse(
+        context,
+        await services.configureOrganizationRecoveryPolicy(deps.db, {
+          ...authority,
+          operationId: payload.operationId,
+          expectedPolicyRevision: payload.expectedPolicyRevision,
+          custodianMembershipIds: payload.custodianMembershipIds,
+        }),
+      );
+    } catch (error) {
+      throw organizationRecoveryHttpError(error);
+    }
+  });
+
+  app.post(`${base}/policy/accept`, async (context) => {
+    const authority = await mutationContext(context, deps, services);
+    const payload = await parseBody(context, AcceptOrganizationRecoveryCustodyRequest);
+    try {
+      return mutationResponse(
+        context,
+        await services.acceptOrganizationRecoveryCustody(deps.db, {
+          ...authority,
+          operationId: payload.operationId,
+          expectedPolicyRevision: payload.expectedPolicyRevision,
+        }),
+      );
+    } catch (error) {
+      throw organizationRecoveryHttpError(error);
+    }
+  });
+
+  app.post(`${base}/policy/disable`, async (context) => {
+    const authority = await mutationContext(context, deps, services);
+    const payload = await parseBody(context, DisableOrganizationRecoveryPolicyRequest);
+    try {
+      return mutationResponse(
+        context,
+        await services.disableOrganizationRecoveryPolicy(deps.db, {
+          ...authority,
+          operationId: payload.operationId,
+          expectedPolicyRevision: payload.expectedPolicyRevision,
+        }),
+      );
+    } catch (error) {
+      throw organizationRecoveryHttpError(error);
+    }
+  });
+
+  app.post(`${base}/operations`, async (context) => {
+    const authority = await mutationContext(context, deps, services);
+    const payload = await parseBody(context, StartOrganizationRecoveryOperationRequest);
+    try {
+      return mutationResponse(
+        context,
+        await services.startOrganizationRecoveryOperation(deps.db, {
+          ...authority,
+          operationId: payload.operationId,
+          expectedPolicyRevision: payload.expectedPolicyRevision,
+          targetMembershipId: payload.targetMembershipId,
+        }),
+      );
+    } catch (error) {
+      throw organizationRecoveryHttpError(error);
+    }
+  });
+
+  async function mutateOperation(
+    context: Context,
+    command: typeof approveOrganizationRecoveryOperation,
+  ): Promise<Response> {
+    const authority = await mutationContext(context, deps, services);
+    const payload = await parseBody(context, OrganizationRecoveryOperationCommandRequest);
+    try {
+      return mutationResponse(
+        context,
+        await command(deps.db, {
+          ...authority,
+          recoveryOperationId: recoveryOperationId(context),
+          operationId: payload.operationId,
+          expectedOperationRevision: payload.expectedOperationRevision,
+        }),
+      );
+    } catch (error) {
+      throw organizationRecoveryHttpError(error);
+    }
+  }
+
+  app.post(`${base}/operations/:recoveryOperationId/approve`, async (context) =>
+    mutateOperation(context, services.approveOrganizationRecoveryOperation),
+  );
+  app.post(`${base}/operations/:recoveryOperationId/cancel`, async (context) =>
+    mutateOperation(context, services.cancelOrganizationRecoveryOperation),
+  );
+  app.post(`${base}/operations/:recoveryOperationId/execute`, async (context) =>
+    mutateOperation(context, services.executeOrganizationRecoveryOperation),
+  );
+}