@opengeni/api-router 0.30.3 → 2.2.0-canary.0

package/src/integrations/atlassian.ts

@@ -53,17 +53,31 @@ import {
   updateScheduledTask,
   upsertKnowledgeProvider,
   upsertKnowledgeSource,
+  withWorkspaceSubjectRls,
 } from "@opengeni/db";
 import { atlassianKnowledgeSourceIdentity } from "@opengeni/documents/atlassian";
 import { createSignedState, readSignedState } from "@opengeni/github";
 import { readResponseJsonBounded, type FetchLike } from "@opengeni/network";
 import { HTTPException } from "hono/http-exception";
+import {
+  personalOnlyConnectionPrincipalMessage,
+  personalOwnerStateAccepted,
+  personalOwnerVerifiedInState,
+  PERSONAL_OWNER_VERIFIED_STATE_CLAIM,
+} from "../connection-ownership";
 import {
   integrationBaseUrl,
   oauthStateTtlMs,
   requireIntegrationsStateSecret,
 } from "./oauth-client";
 
+/**
+ * Flow discriminator for this connector's signed OAuth state. See the matching
+ * constant in `google-drive.ts`: this state carries no `ownership` field and no
+ * provider identity, and its return path is byte-identical to one the MCP OAuth
+ * start signs from caller input, so the flow kind is what binds a state here.
+ */
+const ATLASSIAN_OAUTH_STATE_KIND = "atlassian_oauth";
 const ATLASSIAN_AUTHORIZATION_URL = "https://auth.atlassian.com/authorize";
 const ATLASSIAN_TOKEN_URL = "https://auth.atlassian.com/oauth/token";
 const ATLASSIAN_RESOURCES_URL = "https://api.atlassian.com/oauth/token/accessible-resources";
@@ -76,6 +90,8 @@ type AtlassianOAuthState = {
   accountId: string;
   workspaceId: string;
   subjectId: string;
+  /** Signed proof that a live managed human started this personal-only flow. */
+  personalOwnerVerified: boolean;
   returnPath: string;
   connectionId?: string;
   connectionVersion?: number;
@@ -121,6 +137,10 @@ export async function startAtlassianOAuth(
     accountId: input.accountId,
     workspaceId: input.workspaceId,
     subjectId: input.subjectId,
+    kind: ATLASSIAN_OAUTH_STATE_KIND,
+    // The route admits only a managed human, so reaching here is the proof; the
+    // callback has no live principal and enforces exactly this claim.
+    [PERSONAL_OWNER_VERIFIED_STATE_CLAIM]: true,
     returnPath: ATLASSIAN_RETURN_PATH(input.workspaceId),
     ...(existing ? { connectionId: existing.id, connectionVersion: existing.version } : {}),
   });
@@ -719,7 +739,7 @@ export async function disconnectAtlassian(
   }
 }
 
-export async function revokeAtlassianScheduleAuthorization(
+export async function preflightAtlassianScheduleAuthorization(
   deps: ApiRouteDeps,
   input: { task: ScheduledTask; subjectId: string },
 ): Promise<void> {
@@ -737,50 +757,118 @@ export async function revokeAtlassianScheduleAuthorization(
   if (!externalSourceId) {
     throw new HTTPException(409, { message: "Atlassian schedule identity is incomplete" });
   }
-  const connection = await getConnectionMetadata(
-    deps.db,
-    task.workspaceId,
-    task.action.connection.connectionId,
-    input.subjectId,
-  );
-  if (!connection) throw new HTTPException(409, { message: "Atlassian connection is unavailable" });
-  const metadata = requireAtlassianConnection(connection, input.subjectId);
-  const selected = metadata.selectedSources.find((source) => source.id === externalSourceId);
-  let authorityVersion = connection.version;
-  if (selected?.syncEnabled) {
-    const updated = await transitionConnectionState(deps.db, {
-      workspaceId: task.workspaceId,
-      connectionId: connection.id,
-      visibleToSubjectId: input.subjectId,
-      expectedVersion: connection.version,
-      metadata: AtlassianConnectionMetadata.parse({
-        ...metadata,
-        selectedSources: metadata.selectedSources.map((source) =>
-          source.id === externalSourceId
-            ? { ...source, syncEnabled: false, configGeneration: source.configGeneration + 1 }
-            : source,
-        ),
-      }),
-      updatedBySubjectId: input.subjectId,
+  // Current connector attachment is not deletion authority. The frozen task
+  // revision and generation-fenced cleanup descriptor are.
+}
+
+export async function revokeAtlassianScheduleAuthorization(
+  deps: ApiRouteDeps,
+  input: { task: ScheduledTask; subjectId: string },
+): Promise<void> {
+  const { task } = input;
+  if (task.action.kind !== "knowledge_source_sync") return;
+  if (
+    task.action.initiatingSubjectId !== input.subjectId ||
+    task.action.connection.ownerSubjectId !== input.subjectId
+  ) {
+    throw new HTTPException(403, {
+      message: "knowledge source schedule requires the exact initiating subject",
     });
-    if (!updated) throw new HTTPException(409, { message: "Atlassian connection changed" });
-    authorityVersion = updated.version;
   }
-  const resolved = await getKnowledgeSourceForSyncAuthority(deps.db, {
+  const externalSourceId = optionalString(task.metadata.externalSourceId);
+  if (!externalSourceId) {
+    throw new HTTPException(409, { message: "Atlassian schedule identity is incomplete" });
+  }
+  await cleanupAtlassianScheduleAuthorization(deps, {
+    taskId: task.id,
     accountId: task.accountId,
     workspaceId: task.workspaceId,
+    connectionId: task.action.connection.connectionId,
+    connectionVersion: task.action.connection.connectionVersion,
     sourceId: task.action.sourceId,
+    sourceLifecycleGeneration: task.action.sourceLifecycleGeneration,
+    sourceConfigGeneration: task.action.sourceConfigGeneration,
+    externalSourceId,
+    subjectId: input.subjectId,
+  });
+}
+
+export async function cleanupAtlassianScheduleAuthorization(
+  deps: ApiRouteDeps,
+  input: {
+    taskId: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    connectionVersion: number;
+    sourceId: string;
+    sourceLifecycleGeneration: number;
+    sourceConfigGeneration: number;
+    externalSourceId: string;
+    subjectId: string;
+  },
+): Promise<void> {
+  const resolvedBeforeLock = await getKnowledgeSourceForSyncAuthority(deps.db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    sourceId: input.sourceId,
     initiatingSubjectId: input.subjectId,
   });
-  if (resolved?.source.lifecycleState === "active") {
-    await recordKnowledgeLifecycleEvent(deps.db, {
-      accountId: task.accountId,
-      workspaceId: task.workspaceId,
+  if (
+    resolvedBeforeLock?.source.lifecycleState !== "active" ||
+    resolvedBeforeLock.source.lifecycleGeneration !== input.sourceLifecycleGeneration
+  ) {
+    return;
+  }
+  await withWorkspaceSubjectRls(deps.db, input.workspaceId, input.subjectId, async (tx) => {
+    const connection = await getConnectionMetadata(
+      tx,
+      input.workspaceId,
+      input.connectionId,
+      input.subjectId,
+    );
+    let authorityVersion = input.connectionVersion;
+    if (connection) {
+      const metadata = requireAtlassianConnection(connection, input.subjectId);
+      authorityVersion = connection.version;
+      const updated = await transitionConnectionState(tx, {
+        workspaceId: input.workspaceId,
+        connectionId: connection.id,
+        visibleToSubjectId: input.subjectId,
+        expectedVersion: connection.version,
+        metadata: AtlassianConnectionMetadata.parse({
+          ...metadata,
+          selectedSources: metadata.selectedSources.map((source) =>
+            source.id === input.externalSourceId
+              ? { ...source, syncEnabled: false, configGeneration: source.configGeneration + 1 }
+              : source,
+          ),
+        }),
+        updatedBySubjectId: input.subjectId,
+      });
+      if (!updated) throw new HTTPException(409, { message: "Atlassian connection changed" });
+      authorityVersion = updated.version;
+    }
+    const resolved = await getKnowledgeSourceForSyncAuthority(tx, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      sourceId: input.sourceId,
+      initiatingSubjectId: input.subjectId,
+    });
+    if (
+      resolved?.source.lifecycleState !== "active" ||
+      resolved.source.lifecycleGeneration !== input.sourceLifecycleGeneration
+    ) {
+      throw new HTTPException(409, { message: "Atlassian knowledge source changed" });
+    }
+    await recordKnowledgeLifecycleEvent(tx, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
       targetKind: "source",
       targetId: resolved.source.id,
       eventType: "deleted",
       expectedGeneration: resolved.source.lifecycleGeneration,
-      operationId: `atlassian-schedule-delete:${task.id}:${authorityVersion}`,
+      operationId: `atlassian-schedule-delete:${input.taskId}:${authorityVersion}`,
       reasonCode: "schedule_deleted",
       actor: {
         kind: "human",
@@ -788,7 +876,7 @@ export async function revokeAtlassianScheduleAuthorization(
         initiatingHumanSubjectId: input.subjectId,
       },
     });
-  }
+  });
 }
 
 async function materializeSchedules(
@@ -972,6 +1060,7 @@ async function materializeSchedules(
           action,
           runMode: "new_session_per_run",
           targetSessionId: null,
+          connectionAuthorities: [],
           agentConfig: {
             prompt: "Knowledge source synchronization",
             resources: [],
@@ -1409,6 +1498,12 @@ function readAtlassianOAuthState(raw: string | undefined, settings: Settings): A
   if (iat === undefined || now < iat || now - iat > oauthStateTtlMs / 1_000) {
     throw new HTTPException(400, { message: "expired Atlassian OAuth state" });
   }
+  // Reject a state minted by any other flow before reading anything else. A
+  // pre-cutover state carries no kind and is refused; that is the same bounded
+  // `oauthStateTtlMs` window the personal-owner claim already fails closed on.
+  if (payload.kind !== ATLASSIAN_OAUTH_STATE_KIND) {
+    throw new HTTPException(400, { message: "invalid Atlassian OAuth state" });
+  }
   const accountId = requiredString(payload.accountId, "state.accountId");
   const workspaceId = requiredString(payload.workspaceId, "state.workspaceId");
   const subjectId = requiredString(payload.subjectId, "state.subjectId");
@@ -1425,6 +1520,7 @@ function readAtlassianOAuthState(raw: string | undefined, settings: Settings): A
     accountId,
     workspaceId,
     subjectId,
+    personalOwnerVerified: personalOwnerVerifiedInState(payload),
     returnPath,
     ...(connectionId ? { connectionId, connectionVersion: connectionVersion! } : {}),
     nonce: requiredString(payload.nonce, "state.nonce"),
@@ -1433,6 +1529,21 @@ function readAtlassianOAuthState(raw: string | undefined, settings: Settings): A
 }
 
 async function requireCallbackGrant(deps: ApiRouteDeps, state: AtlassianOAuthState): Promise<void> {
+  // This connector is personal-only by construction: its start request carries
+  // no ownership and the callback always writes `subjectId: state.subjectId`.
+  // A state minted before the start-side principal fence existed carries no
+  // `personalOwnerVerified` claim and must not land a personal Connection.
+  if (
+    !personalOwnerStateAccepted({
+      ownership: "personal",
+      subjectId: state.subjectId,
+      personalOwnerVerified: state.personalOwnerVerified,
+    })
+  ) {
+    throw new HTTPException(422, {
+      message: personalOnlyConnectionPrincipalMessage("Atlassian"),
+    });
+  }
   const grant = await getWorkspaceGrant(deps.db, state.subjectId, state.workspaceId);
   if (
     !grant ||

package/src/integrations/fiken.ts

@@ -27,6 +27,7 @@ import {
   getConnectionMetadata,
   getWorkspaceGrant,
   listConnectionsMetadata,
+  loadConnectionCredentialForBroker,
   recordAuditEvent,
   setConnectionStatus,
   updateConnection,
@@ -102,6 +103,8 @@ type FikenContext = {
   sessionId: string | null;
 };
 
+type FikenProviderAuthorization = () => Promise<boolean | void>;
+
 /**
  * Fiken allows only a single concurrent API request per credential; concurrent
  * requests can 429 and repeated violations can get the token banned. Serialize
@@ -281,6 +284,7 @@ export type FikenListInput = {
 
 export class FikenClient {
   private readonly resolveCredential: ReturnType<typeof buildConnectionTokenResolver>;
+  private expectedConnectionVersion: number;
 
   constructor(
     private readonly db: Database,
@@ -289,11 +293,22 @@ export class FikenClient {
     private readonly metadata: FikenConnectionMetadata,
     private readonly context: FikenContext,
     private readonly fetchImpl: FetchLike = fetch,
+    private readonly authorizeProviderRequest?: FikenProviderAuthorization,
   ) {
+    this.expectedConnectionVersion = connection.version;
     // OAuth-kind connections refresh through the generic broker; route that
-    // token-endpoint transport through the same injectable Fiken fetch.
+    // token-endpoint transport through the same injectable Fiken fetch. Keep
+    // the optional authorization immediately before actual refresh I/O.
+    const refreshFetch: FetchLike = this.authorizeProviderRequest
+      ? async (input, init) => {
+          if ((await this.authorizeProviderRequest?.()) === false) {
+            throw new Error("the Fiken credential refresh is no longer authorized");
+          }
+          return await this.fetchImpl(input, init);
+        }
+      : fetchImpl;
     this.resolveCredential = buildConnectionTokenResolver(db, settings, undefined, {
-      refreshTransport: { fetchImpl },
+      refreshTransport: { fetchImpl: refreshFetch },
     });
   }
 
@@ -619,17 +634,27 @@ export class FikenClient {
       for (const [key, value] of Object.entries(input.query ?? {})) {
         url.searchParams.set(key, value);
       }
-      // Credential resolution (DB read + possible broker refresh) happens
-      // outside the serialization chain: only the provider HTTP call itself
-      // must obey Fiken's single-concurrent-request rule.
-      const headers = await this.headersFor(operation, url.toString());
       const result = await serializedPerConnection(this.connection.id, async () => {
+        const authority = await this.currentAuthority(this.expectedConnectionVersion);
+        const credential = await this.credentialFor(operation, url.toString());
+        await this.currentAuthority(credential.connectionVersion, authority.authorityGeneration);
+        // The adapter callback is a fallible preflight. The canonical
+        // credential callback below records the physical-use fact, so it must
+        // be the final await before the target fetch.
+        if (this.authorizeProviderRequest && (await this.authorizeProviderRequest()) === false) {
+          throw new Error("the Fiken provider request is no longer authorized");
+        }
+        await this.currentAuthority(credential.connectionVersion, authority.authorityGeneration);
+        if (credential.authorizeProviderRequest && !(await credential.authorizeProviderRequest())) {
+          throw new Error("the Fiken provider request is no longer authorized");
+        }
+        this.expectedConnectionVersion = credential.connectionVersion;
         let response: Response;
         try {
           response = await this.fetchImpl(url, {
             method,
             headers: {
-              ...headers,
+              ...credential.headers,
               accept: "application/json",
               ...(input.body !== undefined ? { "content-type": "application/json" } : {}),
             },
@@ -642,7 +667,7 @@ export class FikenClient {
         } catch {
           throw new FikenProviderError("transport_error");
         }
-        return await this.readResponse(operation, response);
+        return await this.readResponse(operation, response, credential.connectionVersion);
       });
       await this.recordAudit(operation, "succeeded");
       return result;
@@ -655,15 +680,14 @@ export class FikenClient {
   private async readResponse(
     operation: FikenOperation,
     response: Response,
+    credentialVersion: number,
   ): Promise<{ payload: unknown; page: FikenPage | null; locationId: number | null }> {
     if (response.status === 401) {
       await response.body?.cancel().catch(() => undefined);
-      // A 401 after resolution means the credential is genuinely rejected
-      // (revoked token or revoked OAuth grant). setConnectionStatus is a
-      // strict version CAS and a broker refresh may have bumped the version
-      // since this client resolved the row, so re-read the current version
-      // instead of using the resolution-time snapshot.
-      await this.markNeedsReauth().catch(() => undefined);
+      // Only the exact active credential generation sent on this request may
+      // transition. A late 401 must not poison a reconnect or revocation that
+      // became current while the provider response was in flight.
+      await this.markNeedsReauth(credentialVersion).catch(() => undefined);
       throw new FikenProviderError("credential_rejected", 401);
     }
     if (response.status === 429) {
@@ -699,27 +723,67 @@ export class FikenClient {
     return { payload, page: pageFromHeaders(response.headers), locationId };
   }
 
-  private async markNeedsReauth(): Promise<void> {
+  private async markNeedsReauth(credentialVersion: number): Promise<void> {
     const current = await getConnectionMetadata(
       this.db,
       this.context.workspaceId,
       this.connection.id,
       null,
     );
-    if (!current || current.status === "needs_reauth") return;
+    if (
+      !current ||
+      current.status !== "active" ||
+      current.version !== credentialVersion ||
+      !isFikenConnection(current)
+    ) {
+      return;
+    }
     await setConnectionStatus(
       this.db,
       this.context.workspaceId,
       "needs_reauth",
       "Fiken rejected the credential",
-      { id: current.id, version: current.version, subjectId: null },
+      { id: current.id, version: credentialVersion, subjectId: null },
     );
   }
 
-  private async headersFor(
+  private async currentAuthority(
+    expectedVersion: number,
+    expectedAuthorityGeneration?: number,
+  ): Promise<{ version: number; authorityGeneration: number }> {
+    const current = await loadConnectionCredentialForBroker(this.db, this.settings, {
+      workspaceId: this.context.workspaceId,
+      connectionId: this.connection.id,
+      providerDomain: FIKEN_PROVIDER_DOMAIN,
+      kind: this.connection.kind === "oauth2" ? "oauth2" : "api_key",
+      subjectId: null,
+      ...(expectedAuthorityGeneration !== undefined ? { expectedAuthorityGeneration } : {}),
+    });
+    if (
+      !current ||
+      current.accountId !== this.context.accountId ||
+      current.workspaceId !== this.context.workspaceId ||
+      current.subjectId !== null ||
+      current.providerDomain !== FIKEN_PROVIDER_DOMAIN ||
+      current.kind !== this.connection.kind ||
+      current.status !== "active" ||
+      current.version !== expectedVersion ||
+      current.authorityGeneration === undefined ||
+      !fikenConnectionMetadata(current.metadata)
+    ) {
+      throw new Error("the Fiken connection authority changed");
+    }
+    return { version: current.version, authorityGeneration: current.authorityGeneration };
+  }
+
+  private async credentialFor(
     operation: FikenOperation,
     destinationUrl: string,
-  ): Promise<Record<string, string>> {
+  ): Promise<{
+    headers: Record<string, string>;
+    connectionVersion: number;
+    authorizeProviderRequest?: () => Promise<boolean>;
+  }> {
     const result = await this.resolveCredential({
       workspaceId: this.context.workspaceId,
       serverId: "opengeni-fiken",
@@ -732,10 +796,20 @@ export class FikenClient {
       },
       destinationUrl,
     });
-    if (result.status !== "ok" || result.connectionId !== this.connection.id) {
+    if (
+      result.status !== "ok" ||
+      result.connectionId !== this.connection.id ||
+      result.connectionVersion === undefined
+    ) {
       throw new Error("the Fiken connection needs to be reconnected");
     }
-    return result.headers;
+    return {
+      headers: result.headers,
+      connectionVersion: result.connectionVersion,
+      ...(result.authorizeProviderRequest
+        ? { authorizeProviderRequest: result.authorizeProviderRequest }
+        : {}),
+    };
   }
 
   private receipt(operation: FikenOperation, operationId?: string) {
@@ -771,7 +845,12 @@ export class FikenClient {
 }
 
 export function createFikenClient(
-  deps: { db: Database; settings: Settings; fikenFetch?: typeof fetch },
+  deps: {
+    db: Database;
+    settings: Settings;
+    fikenFetch?: typeof fetch;
+    authorizeProviderRequest?: FikenProviderAuthorization;
+  },
   resolved: Awaited<ReturnType<typeof resolveFikenConnectionForTool>>,
 ): FikenClient {
   return new FikenClient(
@@ -781,6 +860,7 @@ export function createFikenClient(
     resolved.metadata,
     resolved.context,
     deps.fikenFetch,
+    deps.authorizeProviderRequest,
   );
 }