@opengeni/api-router 0.30.3 → 2.1.0-canary.0

package/src/routes/documents.ts

@@ -4,17 +4,26 @@ import {
   CreateKnowledgeMemoryRequest,
   CreateDocumentBaseRequest,
   Document,
+  DocumentAuthorityReclassification,
   DocumentBase,
+  DocumentDefaultCollectionBackfill,
   DocumentSearchRequest,
   DocumentSearchResponse,
+  FileAsset,
+  FileDownloadUrlResponse,
   KnowledgeMemory,
   KnowledgeMemorySearchRequest,
+  ListDocumentAuthorityReclassificationsQuery,
+  ListDocumentAuthorityReclassificationsResponse,
   MoveDocumentRequest,
+  ReclassifyDocumentAuthorityRequest,
+  RunDocumentDefaultCollectionBackfillRequest,
   UpdateKnowledgeMemoryRequest,
   WorkspaceMemorySearchRequest,
   WorkspaceMemorySearchResponse,
 } from "@opengeni/contracts";
 import {
+  recordAuditEvent,
   completeFileUpload,
   createFileUpload,
   createKnowledgeMemory,
@@ -29,11 +38,16 @@ import {
   deleteDocumentFromBase,
   ensureDefaultBase,
   getDocument,
+  getDocumentOriginalFile,
   getDocumentBase,
+  listAccessibleDocuments,
+  listDocumentAuthorityReclassifications,
   listDocumentBasesEnsuringDefault,
   listDocuments,
   moveDocumentToBase,
   queueDocumentForReindex,
+  reclassifyDocumentAuthority,
+  runDocumentDefaultCollectionBackfill,
   searchEffectiveDocuments,
 } from "@opengeni/documents";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
@@ -41,6 +55,7 @@ import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import {
   requireAccessGrant,
+  requireAccountAdminAuthorizationStamp,
   requireAccessGrantAuthorization,
   saveWorkspaceMemoryWithSlackPublication,
 } from "@opengeni/core";
@@ -87,6 +102,36 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.json(DocumentBase.parse(base));
   });
 
+  app.post("/v1/workspaces/:workspaceId/document-default-collection-backfills", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "documents:manage",
+    );
+    if (!hasAccountAdminAuthority(authorization)) {
+      throw new HTTPException(403, { message: "missing permission: account:admin" });
+    }
+    const accountAdminAuthorization = requireAccountAdminAuthorizationStamp(authorization);
+    const payload = RunDocumentDefaultCollectionBackfillRequest.parse(await c.req.json());
+    try {
+      return c.json(
+        DocumentDefaultCollectionBackfill.parse(
+          await runDocumentDefaultCollectionBackfill(db, {
+            ...payload,
+            accountId: authorization.grant.accountId,
+            workspaceId,
+            actorSubjectId: authorization.grant.subjectId,
+            accountAdminAuthorization,
+          }),
+        ),
+      );
+    } catch (error) {
+      throw documentHttpException(error);
+    }
+  });
+
   app.post("/v1/workspaces/:workspaceId/document-bases/:baseId/documents", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "documents:manage");
@@ -161,6 +206,148 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
   });
 
+  app.get("/v1/workspaces/:workspaceId/documents", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "documents:search");
+    return c.json(
+      (
+        await listAccessibleDocuments(db, workspaceId, {
+          viewerSubjectId: grant.subjectId,
+        })
+      ).map((document) => Document.parse(document)),
+    );
+  });
+
+  app.post(
+    "/v1/workspaces/:workspaceId/documents/:documentId/authority-reclassifications",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const authorization = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "documents:manage",
+      );
+      const payload = ReclassifyDocumentAuthorityRequest.parse(await c.req.json());
+      const accountAdminAuthorized = hasAccountAdminAuthority(authorization);
+      const accountAdminAuthorization = accountAdminAuthorized
+        ? requireAccountAdminAuthorizationStamp(authorization)
+        : null;
+      try {
+        const document = await getDocument(db, workspaceId, c.req.param("documentId"), {
+          viewerSubjectId: authorization.grant.subjectId,
+        });
+        if (!document) throw new HTTPException(404, { message: "document not found" });
+        if (
+          (document.authorityKind === "organization" ||
+            payload.targetAuthorityKind === "organization") &&
+          !accountAdminAuthorization
+        ) {
+          throw new HTTPException(403, { message: "missing permission: account:admin" });
+        }
+        return c.json(
+          DocumentAuthorityReclassification.parse(
+            await reclassifyDocumentAuthority(db, {
+              ...payload,
+              accountId: authorization.grant.accountId,
+              workspaceId,
+              documentId: document.id,
+              actorSubjectId: authorization.grant.subjectId,
+              accountAdminAuthorization,
+            }),
+          ),
+        );
+      } catch (error) {
+        if (error instanceof HTTPException) throw error;
+        throw documentHttpException(error);
+      }
+    },
+  );
+
+  app.get(
+    "/v1/workspaces/:workspaceId/documents/:documentId/authority-reclassifications",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "documents:manage");
+      try {
+        const query = ListDocumentAuthorityReclassificationsQuery.parse(c.req.query());
+        return c.json(
+          ListDocumentAuthorityReclassificationsResponse.parse(
+            await listDocumentAuthorityReclassifications(db, {
+              accountId: grant.accountId,
+              workspaceId,
+              documentId: c.req.param("documentId"),
+              actorSubjectId: grant.subjectId,
+              ...query,
+            }),
+          ),
+        );
+      } catch (error) {
+        throw documentHttpException(error);
+      }
+    },
+  );
+
+  app.get("/v1/workspaces/:workspaceId/documents/:documentId/original-file", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "documents:search");
+    await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const file = await getDocumentOriginalFile(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      documentId: c.req.param("documentId"),
+      access: { viewerSubjectId: grant.subjectId },
+    });
+    if (!file) {
+      throw new HTTPException(404, { message: "document file not found" });
+    }
+    return c.json(FileAsset.parse(file));
+  });
+
+  app.post(
+    "/v1/workspaces/:workspaceId/documents/:documentId/original-file/download-url",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "documents:search");
+      await requireAccessGrant(c, deps, workspaceId, "files:read");
+      if (!objectStorage) {
+        throw new HTTPException(503, { message: "object storage is not configured" });
+      }
+      const file = await getDocumentOriginalFile(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        documentId: c.req.param("documentId"),
+        access: { viewerSubjectId: grant.subjectId },
+      });
+      if (!file) {
+        throw new HTTPException(404, { message: "document file not found" });
+      }
+      if (file.status !== "ready") {
+        throw new HTTPException(409, { message: `file is ${file.status}` });
+      }
+      const signed = await objectStorage.createGetUrl({ key: file.objectKey });
+      await recordAuditEvent(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        action: "file.signed_url.issued",
+        targetType: "workspace_document",
+        targetId: c.req.param("documentId"),
+        metadata: {
+          fileId: file.id,
+          kind: "document_original",
+          expiresAt: signed.expiresAt.toISOString(),
+        },
+      });
+      return c.json(
+        FileDownloadUrlResponse.parse({
+          url: signed.url,
+          expiresAt: signed.expiresAt.toISOString(),
+        }),
+      );
+    },
+  );
+
   app.delete(
     "/v1/workspaces/:workspaceId/document-bases/:baseId/documents/:documentId",
     async (c) => {
@@ -212,7 +399,9 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
       const { grant } = authorization;
       const organizationAuthorityGranted = hasAccountAdminAuthority(authorization);
       if (!objectStorage) {
-        throw new HTTPException(503, { message: "object storage is not configured" });
+        throw new HTTPException(503, {
+          message: "object storage is not configured",
+        });
       }
       await requireLimit(deps, {
         accountId: grant.accountId,
@@ -246,7 +435,9 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
         const indexed =
           (await documentIndexer.indexDocument({
             accountId: grant.accountId,
-            workspaceId,
+            // The requested workspace authorizes the human operation; the
+            // immutable ingestion workspace remains the indexing authority.
+            workspaceId: queued.workspaceId,
             documentId: document.id,
             authorityKind: document.authorityKind,
             authorityWorkspaceId: document.authorityWorkspaceId,
@@ -651,13 +842,19 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
     const grant = await requireAccessGrant(c, deps, workspaceId, "documents:search");
     const sessionId =
       typeof grant.metadata?.sessionId === "string" ? grant.metadata.sessionId : undefined;
+    const attemptId =
+      typeof grant.metadata?.attemptId === "string" ? grant.metadata.attemptId : undefined;
     const transport = new WebStandardStreamableHTTPServerTransport({ enableJsonResponse: true });
     const server = buildDocumentsMcpServer(
       db,
       grant.accountId,
       workspaceId,
       getDocumentServices(),
-      { createdBySessionId: sessionId, initiatingSubjectId: grant.subjectId },
+      {
+        createdBySessionId: sessionId,
+        attemptId,
+        initiatingSubjectId: grant.subjectId,
+      },
     );
     await server.connect(transport);
     return await transport.handleRequest(c.req.raw);
@@ -692,6 +889,27 @@ function documentHttpException(error: unknown): HTTPException {
   if (message.includes("already exists")) {
     return new HTTPException(409, { message });
   }
+  if (
+    message.includes("operation id was reused") ||
+    message.includes("authority changed before reclassification") ||
+    message.includes("run identity mismatch")
+  ) {
+    return new HTTPException(409, { message });
+  }
+  if (
+    message.includes("reclassification requires") ||
+    message.includes("backfill requires organization administration")
+  ) {
+    return new HTTPException(403, { message });
+  }
+  if (
+    message.includes("reclassification input is invalid") ||
+    message.includes("reclassification authority is invalid") ||
+    message.includes("invalid document authority receipt cursor") ||
+    message.includes("document authority receipt limit")
+  ) {
+    return new HTTPException(400, { message });
+  }
   if (message.includes("no suggested base")) {
     return new HTTPException(422, { message });
   }

package/src/routes/editable-artifacts.ts

@@ -78,9 +78,13 @@ const ListEditableArtifactsQuery = z
 const MintEditableArtifactLiveTicketRequest = z
   .object({
     replicaId: ReplicaId,
-    protocolVersion: PositiveProtocolVersion,
+    modality: z.enum(["document", "spreadsheet", "presentation"]),
+    liveProtocolVersion: PositiveProtocolVersion,
     kernelVersion: VersionName,
     modelSchemaVersion: PositiveModelSchemaVersion,
+    snapshotVersion: PositiveProtocolVersion,
+    commandProtocolVersion: PositiveProtocolVersion,
+    committedTransactionProtocolVersion: PositiveProtocolVersion,
   })
   .strict();
 
@@ -482,9 +486,13 @@ export function registerEditableArtifactRoutes(
         scope,
         actor,
         artifactId,
-        protocolVersion: body.protocolVersion,
+        modality: body.modality,
+        liveProtocolVersion: body.liveProtocolVersion,
         kernelVersion: body.kernelVersion,
         modelSchemaVersion: body.modelSchemaVersion,
+        snapshotVersion: body.snapshotVersion,
+        commandProtocolVersion: body.commandProtocolVersion,
+        committedTransactionProtocolVersion: body.committedTransactionProtocolVersion,
         allowEdit: hasPermission(grant.permissions, "artifacts:publish"),
       });
     } catch (error) {
@@ -496,7 +504,7 @@ export function registerEditableArtifactRoutes(
       !parsedTicket.success ||
       parsedTicket.data.artifactId !== artifactId ||
       parsedTicket.data.replicaId !== actor.replicaId ||
-      parsedTicket.data.protocolVersion !== body.protocolVersion ||
+      parsedTicket.data.protocolVersion !== body.liveProtocolVersion ||
       Date.parse(parsedTicket.data.expiresAt) <= Date.now()
     ) {
       throw new Error("Editable artifact application returned an invalid live ticket");

package/src/routes/enrollments.ts

@@ -50,7 +50,11 @@ import {
 } from "@opengeni/db";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { requireAccessGrant } from "@opengeni/core";
+import {
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  requirePermission,
+} from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   approveDeviceEnrollment,
@@ -88,7 +92,10 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
   const lookupLimiter = new TokenBucket({ capacity: 30, refillPerSecond: 1 });
   // The headless token exchange (UNAUTHENTICATED — the token is the auth). Bounded
   // against an enroll-token brute force; the `oget_` HMAC is the real boundary.
-  const exchangeLimiter = new TokenBucket({ capacity: 20, refillPerSecond: 0.5 });
+  const exchangeLimiter = new TokenBucket({
+    capacity: 20,
+    refillPerSecond: 0.5,
+  });
 
   function rateLimit(c: Context, limiter: TokenBucket): void {
     const ip = clientIp(c);
@@ -123,8 +130,10 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
         machineName: body.machineName ?? null,
         canOfferDisplay: body.canOfferDisplay,
         requestsScreenControl: body.requestsScreenControl,
-        // The approve page is served at the SAME origin as this request.
-        verificationOrigin: new URL(c.req.url).origin,
+        // Prefer the externally configured deployment origin. Behind a TLS-
+        // terminating proxy c.req.url can carry the internal http scheme, which
+        // must never leak into the device-flow command shown to the operator.
+        verificationOrigin: settings.publicBaseUrl ?? new URL(c.req.url).origin,
       },
     );
     return c.json(result, 201);
@@ -156,7 +165,9 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     rateLimit(c, lookupLimiter);
     const parsed = DeviceEnrollmentLookupRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException(400, { message: "invalid device-lookup request" });
+      throw new HTTPException(400, {
+        message: "invalid device-lookup request",
+      });
     }
     const record = await lookupDeviceEnrollment(
       { db, settings },
@@ -165,7 +176,9 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!record) {
       // Unknown / terminal / expired code → 404 (indistinguishable from an
       // unauthorized one below, by design).
-      throw new HTTPException(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException(404, {
+        message: "no pending enrollment for that code",
+      });
     }
     // Authorize the caller against the RESOLVED workspace. A missing grant throws
     // 403/404 from requireAccessGrant; we normalize that to 404 so a caller cannot
@@ -173,7 +186,9 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     try {
       await requireAccessGrant(c, deps, record.workspaceId, "enrollments:read");
     } catch {
-      throw new HTTPException(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException(404, {
+        message: "no pending enrollment for that code",
+      });
     }
     return c.json(DeviceEnrollmentLookupResponse.parse(toLookupResponse(record)), 200);
   });
@@ -189,7 +204,9 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     rateLimit(c, exchangeLimiter);
     const parsed = EnrollTokenExchangeRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException(400, { message: "invalid enroll-token-exchange request" });
+      throw new HTTPException(400, {
+        message: "invalid enroll-token-exchange request",
+      });
     }
     const body = parsed.data;
     const result = await exchangeEnrollToken(
@@ -206,10 +223,14 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!result.ok) {
       if (result.reason === "disabled") {
         // The credential plane is off for this deployment (no signing secret).
-        throw new HTTPException(503, { message: "enrollment credential plane is not configured" });
+        throw new HTTPException(503, {
+          message: "enrollment credential plane is not configured",
+        });
       }
       // An invalid / expired / wrong-typ token — the token is the auth, so 401.
-      throw new HTTPException(401, { message: "invalid or expired enroll token" });
+      throw new HTTPException(401, {
+        message: "invalid or expired enroll token",
+      });
     }
     return c.json(EnrollTokenExchangeResponse.parse({ credentials: result.credentials }), 201);
   });
@@ -218,18 +239,48 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
   // The LOUD CONSENT step. requireAccessGrant BEFORE the Zod parse.
   app.post("/v1/workspaces/:workspaceId/enrollments/device/approve", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "enrollments:manage");
+    const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+    const grant = authorization.grant;
+    requirePermission(grant, "enrollments:manage");
     assertSelfhostedEnabled();
-    const parsed = DeviceEnrollmentApproveRequest.safeParse(await c.req.json().catch(() => null));
+    const rawBody = await c.req.json().catch(() => null);
+    const parsed = DeviceEnrollmentApproveRequest.safeParse(rawBody);
     if (!parsed.success) {
-      throw new HTTPException(400, { message: "invalid device-approve request" });
+      throw new HTTPException(400, {
+        message: "invalid device-approve request",
+      });
     }
     const body = parsed.data;
+    const scopeWasExplicit =
+      typeof rawBody === "object" &&
+      rawBody !== null &&
+      Object.prototype.hasOwnProperty.call(rawBody, "scope");
+    // Managed browser humans get the personal default. Legacy/delegated
+    // principals predate organization-user ownership and retain the compatible
+    // workspace default when the caller omitted scope; an explicit scope is
+    // never silently rewritten.
+    const effectiveScope =
+      scopeWasExplicit ||
+      (grant.principalKind === "human_session" &&
+        authorization.contextIntegrity &&
+        grant.metadata?.delegated !== true)
+        ? body.scope
+        : undefined;
+    const allowOrganization =
+      effectiveScope === "organization" &&
+      authorization.accountGrant?.permissions.includes("account:admin") === true;
+    if (effectiveScope === "organization" && !allowOrganization) {
+      throw new HTTPException(403, {
+        message: "missing permission: account:admin",
+      });
+    }
     const approved = await approveDeviceEnrollment(
       { db, settings },
       {
         accountId: grant.accountId,
         workspaceId,
+        ...(effectiveScope ? { scope: effectiveScope } : {}),
+        allowOrganization,
         userCode: body.userCode,
         allowScreenControl: body.allowScreenControl,
         // The LOUD consent record: WHO consented (the authenticated subject + label).
@@ -239,7 +290,9 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
     if (!approved) {
       // An unknown / expired / already-terminal user_code in this workspace.
-      throw new HTTPException(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException(404, {
+        message: "no pending enrollment for that code",
+      });
     }
     return c.json(
       DeviceEnrollmentApproveResponse.parse({
@@ -286,7 +339,9 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     // allowScreenControl=false). Coalesce a missing/empty body to {} before parse.
     const parsed = MintEnrollTokenRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException(400, { message: "invalid mint-enroll-token request" });
+      throw new HTTPException(400, {
+        message: "invalid mint-enroll-token request",
+      });
     }
     const minted = await mintEnrollToken(
       { db, settings },
@@ -298,7 +353,9 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
     if (!minted) {
       // The credential plane is off (no signing secret) — mirror poll's disabled path.
-      throw new HTTPException(503, { message: "enrollment credential plane is not configured" });
+      throw new HTTPException(503, {
+        message: "enrollment credential plane is not configured",
+      });
     }
     return c.json(MintEnrollTokenResponse.parse(minted), 201);
   });
@@ -306,13 +363,15 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
   // ── GET /workspaces/:workspaceId/enrollments (user-authed) ──────────────────
   app.get("/v1/workspaces/:workspaceId/enrollments", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "enrollments:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "enrollments:read");
     assertSelfhostedEnabled();
     const statusFilter = c.req.query("status");
     if (statusFilter !== undefined && statusFilter !== "active" && statusFilter !== "revoked") {
-      throw new HTTPException(400, { message: "status must be active or revoked" });
+      throw new HTTPException(400, {
+        message: "status must be active or revoked",
+      });
     }
-    const rows = await listEnrollments(db, workspaceId, {
+    const rows = await listEnrollments(db, grant, {
       status: statusFilter === "revoked" ? "revoked" : "active",
     });
     return c.json(
@@ -320,6 +379,8 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
         enrollments: rows.map((row) =>
           EnrollmentSummary.parse({
             id: row.id,
+            scope: row.scope,
+            generation: row.generation,
             pubkey: row.pubkey,
             exposure: row.exposure,
             hasDisplay: row.hasDisplay,
@@ -340,19 +401,40 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
   // ── POST /workspaces/:workspaceId/enrollments/:id/revoke (user-authed) ──────
   app.post("/v1/workspaces/:workspaceId/enrollments/:enrollmentId/revoke", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "enrollments:manage");
+    const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+    const grant = authorization.grant;
+    requirePermission(grant, "enrollments:manage");
     assertSelfhostedEnabled();
     const parsed = RemoveEnrollmentRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException(400, { message: "invalid machine removal request" });
+      throw new HTTPException(400, {
+        message: "invalid machine removal request",
+      });
     }
     const idempotencyKey =
       parsed.data.idempotencyKey?.trim() || c.req.header("idempotency-key")?.trim() || randomUUID();
     try {
+      const enrollmentId = c.req.param("enrollmentId");
+      const enrollment = (await listEnrollments(db, grant, { status: "active" })).find(
+        (candidate) => candidate.id === enrollmentId,
+      );
+      if (!enrollment) {
+        throw new HTTPException(404, {
+          message: "machine enrollment not found",
+        });
+      }
+      if (
+        enrollment.scope === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") !== true
+      ) {
+        throw new HTTPException(403, {
+          message: "missing permission: account:admin",
+        });
+      }
       const result = await removeEnrollment(db, {
         accountId: grant.accountId,
-        workspaceId,
-        enrollmentId: c.req.param("enrollmentId"),
+        workspaceId: enrollment.workspaceId,
+        enrollmentId,
         operationKey: idempotencyKey,
         ...(parsed.data.expectedUpdatedAt
           ? { expectedUpdatedAt: parsed.data.expectedUpdatedAt }
@@ -360,7 +442,9 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
         subjectId: grant.subjectId,
       });
       if (!result) {
-        throw new HTTPException(404, { message: "machine enrollment not found" });
+        throw new HTTPException(404, {
+          message: "machine enrollment not found",
+        });
       }
       return c.json(
         RevokeEnrollmentResponse.parse({
@@ -376,7 +460,10 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
       if (error instanceof MachineRemovalRevisionConflictError) {
         throw new HTTPException(409, {
           message: error.message,
-          cause: { code: "stale_revision", currentUpdatedAt: error.currentUpdatedAt },
+          cause: {
+            code: "stale_revision",
+            currentUpdatedAt: error.currentUpdatedAt,
+          },
         });
       }
       throw error;
@@ -410,7 +497,10 @@ class TokenBucket {
   }
 
   take(key: string, now = Date.now()): boolean {
-    const bucket = this.buckets.get(key) ?? { tokens: this.capacity, updatedAt: now };
+    const bucket = this.buckets.get(key) ?? {
+      tokens: this.capacity,
+      updatedAt: now,
+    };
     const elapsedSeconds = Math.max(0, (now - bucket.updatedAt) / 1000);
     bucket.tokens = Math.min(this.capacity, bucket.tokens + elapsedSeconds * this.refillPerSecond);
     bucket.updatedAt = now;