@opengeni/api-router 0.30.3 → 2.2.0-canary.0

package/src/model-catalog.ts

@@ -36,6 +36,8 @@ export const MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS = 5 * 60_000;
 
 /** Static, client-safe definition projection. No provider secret is reachable. */
 export function projectClientModel(model: ConfiguredModel): ClientModel {
+  const anonymousProvider =
+    model.credentialSource.kind === "deployment" && model.credentialSource.mechanism === "none";
   const source =
     model.credentialSource.kind === "connected_subscription"
       ? model.credentialSource.provider === "xai"
@@ -43,9 +45,12 @@ export function projectClientModel(model: ConfiguredModel): ClientModel {
         : "codex"
       : model.credentialSource.kind === "workspace_connection"
         ? "workspace_gateway"
-        : "opengeni";
-  const publicProvider =
-    source === "codex"
+        : anonymousProvider
+          ? undefined
+          : "opengeni";
+  const publicProvider = anonymousProvider
+    ? { provider: model.providerId, providerLabel: model.providerLabel }
+    : source === "codex"
       ? { provider: "codex", providerLabel: "Codex" }
       : source === "supergrok"
         ? { provider: "supergrok", providerLabel: "SuperGrok" }
@@ -57,7 +62,7 @@ export function projectClientModel(model: ConfiguredModel): ClientModel {
     label: model.label,
     ...(model.shortLabel ? { shortLabel: model.shortLabel } : {}),
     ...publicProvider,
-    source,
+    ...(source === undefined ? {} : { source }),
     api: model.api,
     ...(model.contextWindowTokens === undefined
       ? {}
@@ -165,6 +170,9 @@ function credentialReadinessFor(input: {
           checkedAt: null,
         };
   }
+  if (source.kind === "deployment" && source.mechanism === "none") {
+    return { status: "ready", reason: null, basis: "configuration", checkedAt: null };
+  }
   if (source.kind === "deployment" && source.mechanism === "api_key") {
     return input.provider?.apiKey
       ? { status: "ready", reason: null, basis: "configuration", checkedAt: null }
@@ -237,7 +245,7 @@ function xaiGrokAvailabilityFor(input: {
 function availabilityFor(input: {
   model: ConfiguredModel;
   credentialReadiness: ModelCredentialReadinessV1;
-  policy: WorkspaceModelPolicyContract | null;
+  policyAllowed: boolean;
   observation?: ModelAvailabilityObservation | undefined;
   nowMs: number;
   maxAgeMs: number;
@@ -263,12 +271,7 @@ function availabilityFor(input: {
       checkedAt: input.credentialReadiness.checkedAt,
     };
   }
-  if (
-    !evaluateWorkspaceModelPolicy(input.policy, {
-      providerId: input.model.providerId,
-      modelId: input.model.id,
-    }).allowed
-  ) {
+  if (!input.policyAllowed) {
     return {
       status: "unavailable",
       selectable: false,
@@ -349,6 +352,10 @@ export function buildWorkspaceModelCatalog(input: {
       : MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS;
   const models = configuredModels(catalogSettings).map((model) => {
     const provider = providers.get(model.providerId);
+    const policyAllowed = evaluateWorkspaceModelPolicy(input.policy, {
+      providerId: model.providerId,
+      modelId: model.id,
+    }).allowed;
     const credentialReadiness = credentialReadinessFor({
       model,
       provider,
@@ -362,10 +369,11 @@ export function buildWorkspaceModelCatalog(input: {
     return {
       ...projectClientModel(model),
       credentialReadiness,
+      policyAllowed,
       availability: availabilityFor({
         model,
         credentialReadiness,
-        policy: input.policy,
+        policyAllowed,
         observation: input.observations?.[model.definitionVersion],
         nowMs,
         maxAgeMs,

package/src/routes/api-integrations.ts

@@ -1,5 +1,6 @@
 import {
   CORE_INTEGRATION_DEFINITIONS,
+  INTEGRATION_DEFINITION_PRESENTATIONS,
   createPinnedIntegrationTransport,
   integrationFacetDefinitions,
   type IntegrationCredentialResolver,
@@ -70,6 +71,9 @@ export function registerApiIntegrationRoutes(
             kind: definition.authentication.kind,
             scopes: [...definition.authentication.scopes],
           },
+          ...(INTEGRATION_DEFINITION_PRESENTATIONS[definition.id]
+            ? { presentation: INTEGRATION_DEFINITION_PRESENTATIONS[definition.id] }
+            : {}),
           facets: definition.facets.map((facet) => ({
             facetKey: facet.facetKey,
             kind: facet.kind,

package/src/routes/api-keys.ts

@@ -36,6 +36,7 @@ export function registerApiKeyRoutes(app: Hono, deps: ApiRouteDeps): void {
         accountId: grant.accountId,
         workspaceId: grant.workspaceId,
         name: body.name,
+        description: body.description ?? null,
         prefix,
         keyHash: await sha256Hex(token),
         permissions,

package/src/routes/automations.ts

@@ -0,0 +1,534 @@
+import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import {
+  AUTOMATION_WEBHOOK_MAX_BYTES,
+  AUTOMATION_MAX_MATCHED_TRIGGERS,
+  AutomationNormalizedEvent,
+  AutomationWebhookResult,
+  CreateAutomationSourceRequest,
+  CreateAutomationTriggerRequest,
+  TriggerAutomationManuallyRequest,
+  UpdateAutomationSourceRequest,
+  UpdateAutomationTriggerRequest,
+  stableJson,
+} from "@opengeni/contracts";
+import {
+  AutomationDeliveryConflictError,
+  AutomationRevisionConflictError,
+  createAutomationRun,
+  createAutomationSource,
+  createAutomationTrigger,
+  decryptVariableSetValue,
+  encryptVariableSetValue,
+  getAutomationSourceSecret,
+  getAutomationTriggerRevisions,
+  listActiveAutomationTriggersForSource,
+  listAutomationRuns,
+  listAutomationSources,
+  listAutomationTriggers,
+  recordAutomationEvent,
+  resolveAutomationWebhookEndpoint,
+  updateAutomationSource,
+  updateAutomationTrigger,
+  type AutomationSourceSecret,
+} from "@opengeni/db";
+import {
+  automationRequestDigest,
+  buildAutomationAcceptedExecution,
+  requireAccessGrant,
+  requireAutomationAdapter,
+  requirePermission,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+
+export function registerAutomationRoutes(app: Hono, deps: ApiRouteDeps): void {
+  app.get("/v1/workspaces/:workspaceId/automations/sources", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    return c.json({
+      sources: await listAutomationSources(deps.db, workspaceId),
+    });
+  });
+
+  app.post("/v1/workspaces/:workspaceId/automations/sources", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    requirePermission(grant, "secrets:write");
+    const request = CreateAutomationSourceRequest.parse(await c.req.json());
+    requireAutomationAdapter(request.adapterId).validateSourceConfiguration(request.configuration);
+    const key = requireEncryptionKey(deps);
+    const source = await createAutomationSource(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      createdBySubjectId: grant.subjectId,
+      request,
+      webhookSecretEncrypted: encryptVariableSetValue(key, request.webhookSecret),
+    });
+    return c.json(source, 201);
+  });
+
+  app.patch("/v1/workspaces/:workspaceId/automations/sources/:sourceId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const request = UpdateAutomationSourceRequest.parse(await c.req.json());
+    const current = await requireSource(
+      deps,
+      grant.accountId,
+      workspaceId,
+      c.req.param("sourceId"),
+    );
+    assertGenericSourceMutable(current);
+    if (request.configuration) {
+      requireAutomationAdapter(current.adapterId).validateSourceConfiguration(
+        request.configuration,
+      );
+    }
+    let webhookSecretEncrypted: string | undefined;
+    if (request.webhookSecret !== undefined) {
+      requirePermission(grant, "secrets:write");
+      webhookSecretEncrypted = encryptVariableSetValue(
+        requireEncryptionKey(deps),
+        request.webhookSecret,
+      );
+    }
+    const source = await updateAutomationSource(deps.db, {
+      workspaceId,
+      sourceId: current.id,
+      request,
+      ...(webhookSecretEncrypted ? { webhookSecretEncrypted } : {}),
+    });
+    if (!source)
+      throw new HTTPException(404, {
+        message: "automation source not found",
+      });
+    return c.json(source);
+  });
+
+  app.delete("/v1/workspaces/:workspaceId/automations/sources/:sourceId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const current = await requireSource(
+      deps,
+      grant.accountId,
+      workspaceId,
+      c.req.param("sourceId"),
+    );
+    assertGenericSourceMutable(current);
+    const source = await updateAutomationSource(deps.db, {
+      workspaceId,
+      sourceId: c.req.param("sourceId"),
+      request: { status: "disabled" },
+    });
+    if (!source)
+      throw new HTTPException(404, {
+        message: "automation source not found",
+      });
+    return c.body(null, 204);
+  });
+
+  app.get("/v1/workspaces/:workspaceId/automations/triggers", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    return c.json({
+      triggers: await listAutomationTriggers(deps.db, workspaceId),
+    });
+  });
+
+  app.post("/v1/workspaces/:workspaceId/automations/triggers", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const request = CreateAutomationTriggerRequest.parse(await c.req.json());
+    if (request.packInstallationId || request.packTemplateId) {
+      throw new HTTPException(409, {
+        message: "Pack-owned automation triggers must be created through their Pack setup API",
+      });
+    }
+    const source = await requireSource(deps, grant.accountId, workspaceId, request.sourceId);
+    assertGenericSourceMutable(source);
+    if (source.status !== "active") {
+      throw new HTTPException(409, {
+        message: "automation source is disabled",
+      });
+    }
+    const adapter = requireAutomationAdapter(source.adapterId);
+    adapter.validateTriggerConfiguration(request.configuration);
+    adapter.validateTriggerParameters(request.parameters);
+    for (const permission of request.sessionTemplate.firstPartyMcpPermissions) {
+      requirePermission(grant, permission);
+    }
+    return c.json(
+      await createAutomationTrigger(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        createdBySubjectId: grant.subjectId,
+        request,
+        adapterId: adapter.id,
+      }),
+      201,
+    );
+  });
+
+  app.patch("/v1/workspaces/:workspaceId/automations/triggers/:triggerId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const request = UpdateAutomationTriggerRequest.parse(await c.req.json());
+    const existing = (await listAutomationTriggers(deps.db, workspaceId)).find(
+      (trigger) => trigger.id === c.req.param("triggerId"),
+    );
+    if (!existing)
+      throw new HTTPException(404, {
+        message: "automation trigger not found",
+      });
+    assertGenericTriggerMutable(existing);
+    if (request.configuration) {
+      requireAutomationAdapter(existing.adapterId).validateTriggerConfiguration(
+        request.configuration,
+      );
+    }
+    if (request.parameters) {
+      requireAutomationAdapter(existing.adapterId).validateTriggerParameters(request.parameters);
+    }
+    if (request.sessionTemplate) {
+      for (const permission of request.sessionTemplate.firstPartyMcpPermissions) {
+        requirePermission(grant, permission);
+      }
+    }
+    try {
+      const trigger = await updateAutomationTrigger(deps.db, {
+        workspaceId,
+        triggerId: c.req.param("triggerId"),
+        subjectId: grant.subjectId,
+        request,
+      });
+      if (!trigger)
+        throw new HTTPException(404, {
+          message: "automation trigger not found",
+        });
+      return c.json(trigger);
+    } catch (error) {
+      if (error instanceof AutomationRevisionConflictError) {
+        throw new HTTPException(409, { message: error.message });
+      }
+      throw error;
+    }
+  });
+
+  app.delete("/v1/workspaces/:workspaceId/automations/triggers/:triggerId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const expectedRevision = Number(c.req.query("expectedRevision"));
+    if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 1) {
+      throw new HTTPException(400, {
+        message: "expectedRevision must be a positive integer",
+      });
+    }
+    const existing = (await listAutomationTriggers(deps.db, workspaceId)).find(
+      (trigger) => trigger.id === c.req.param("triggerId"),
+    );
+    if (!existing)
+      throw new HTTPException(404, {
+        message: "automation trigger not found",
+      });
+    assertGenericTriggerMutable(existing);
+    try {
+      const trigger = await updateAutomationTrigger(deps.db, {
+        workspaceId,
+        triggerId: c.req.param("triggerId"),
+        subjectId: grant.subjectId,
+        request: { expectedRevision, status: "disabled" },
+      });
+      if (!trigger)
+        throw new HTTPException(404, {
+          message: "automation trigger not found",
+        });
+      return c.body(null, 204);
+    } catch (error) {
+      if (error instanceof AutomationRevisionConflictError) {
+        throw new HTTPException(409, { message: error.message });
+      }
+      throw error;
+    }
+  });
+
+  app.get("/v1/workspaces/:workspaceId/automations/runs", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    return c.json({ runs: await listAutomationRuns(deps.db, workspaceId) });
+  });
+
+  app.post("/v1/workspaces/:workspaceId/automations/sources/:sourceId/events", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const request = TriggerAutomationManuallyRequest.parse(await c.req.json());
+    const source = await requireSource(deps, grant.accountId, workspaceId, c.req.param("sourceId"));
+    if (source.status !== "active") {
+      throw new HTTPException(409, {
+        message: "automation source is disabled",
+      });
+    }
+    const normalizedEvent = AutomationNormalizedEvent.parse({
+      adapterId: source.adapterId,
+      eventType: request.eventType,
+      occurrenceKey: request.occurrenceKey,
+      occurredAt: request.occurredAt,
+      subject: request.subject,
+      resource: request.resource,
+      payload: request.payload,
+    });
+    const bytes = new TextEncoder().encode(stableJson(request));
+    return c.json(
+      await acceptEvent(deps, source, {
+        deliveryKey:
+          request.deliveryId ?? `manual:${automationRequestDigest(source.adapterId, bytes)}`,
+        requestDigest: automationRequestDigest(source.adapterId, bytes),
+        normalizedEvent,
+      }),
+      202,
+    );
+  });
+
+  app.post("/v1/webhooks/automations/:endpointId", async (c) => {
+    const endpointId = c.req.param("endpointId");
+    if (
+      !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+        endpointId,
+      )
+    ) {
+      throw new HTTPException(404, {
+        message: "automation endpoint not found",
+      });
+    }
+    const endpoint = await resolveAutomationWebhookEndpoint(deps.db, endpointId);
+    if (!endpoint)
+      throw new HTTPException(404, {
+        message: "automation endpoint not found",
+      });
+    const source = await requireSource(
+      deps,
+      endpoint.accountId,
+      endpoint.workspaceId,
+      endpoint.sourceId,
+    );
+    if (source.status !== "active") {
+      throw new HTTPException(410, {
+        message: "automation source is disabled",
+      });
+    }
+    const rawBody = await readAutomationWebhookBody(c.req.raw, AUTOMATION_WEBHOOK_MAX_BYTES);
+    const adapter = requireAutomationAdapter(source.adapterId);
+    const secret = decryptVariableSetValue(
+      requireEncryptionKey(deps),
+      source.webhookSecretEncrypted,
+    );
+    if (
+      !adapter.verify({
+        rawBody,
+        headers: c.req.raw.headers,
+        secret,
+        sourceConfiguration: source.configuration,
+      })
+    ) {
+      throw new HTTPException(401, {
+        message: "automation signature is invalid",
+      });
+    }
+    const requestDigest = automationRequestDigest(source.adapterId, rawBody);
+    try {
+      const result = await acceptEvent(deps, source, {
+        deliveryKey: adapter.deliveryKey({
+          headers: c.req.raw.headers,
+          requestDigest,
+        }),
+        requestDigest,
+        normalizedEvent: adapter.normalize({
+          rawBody,
+          headers: c.req.raw.headers,
+          sourceConfiguration: source.configuration,
+        }),
+      });
+      return c.json(result, 202);
+    } catch (error) {
+      if (error instanceof AutomationDeliveryConflictError) {
+        throw new HTTPException(409, { message: error.message });
+      }
+      throw error;
+    }
+  });
+}
+
+async function acceptEvent(
+  deps: ApiRouteDeps,
+  source: AutomationSourceSecret,
+  input: {
+    deliveryKey: string;
+    requestDigest: string;
+    normalizedEvent: AutomationNormalizedEvent;
+  },
+) {
+  if (input.normalizedEvent.adapterId !== source.adapterId) {
+    throw new HTTPException(422, {
+      message: "automation event adapter does not match source",
+    });
+  }
+  const adapter = requireAutomationAdapter(source.adapterId);
+  const triggers = await listActiveAutomationTriggersForSource(deps.db, {
+    accountId: source.accountId,
+    workspaceId: source.workspaceId,
+    sourceId: source.id,
+  });
+  const matchingAtAcceptance = triggers.filter((trigger) =>
+    adapter.matches({ event: input.normalizedEvent, trigger }),
+  );
+  if (matchingAtAcceptance.length > AUTOMATION_MAX_MATCHED_TRIGGERS) {
+    throw new HTTPException(422, {
+      message: `automation event matches more than ${AUTOMATION_MAX_MATCHED_TRIGGERS} triggers`,
+    });
+  }
+  const stored = await recordAutomationEvent(deps.db, {
+    accountId: source.accountId,
+    workspaceId: source.workspaceId,
+    sourceId: source.id,
+    sourceVersion: source.version,
+    sourceConfiguration: source.configuration,
+    matchedTriggerRevisions: matchingAtAcceptance.map((trigger) => ({
+      triggerId: trigger.id,
+      revision: trigger.revision,
+    })),
+    deliveryKey: input.deliveryKey,
+    requestDigest: input.requestDigest,
+    normalizedEvent: input.normalizedEvent,
+    ignoredReason: matchingAtAcceptance.length === 0 ? "no_matching_triggers" : null,
+  });
+  const matching = await getAutomationTriggerRevisions(deps.db, {
+    workspaceId: source.workspaceId,
+    refs: stored.event.matchedTriggerRevisions,
+  });
+  const acceptedSource = {
+    ...source,
+    version: stored.event.sourceVersion,
+    configuration: stored.event.sourceConfiguration,
+  };
+  const runIds: string[] = [];
+  const triggerAutomationRun = deps.workflowClient.triggerAutomationRun;
+  if (matching.length > 0 && !triggerAutomationRun) {
+    throw new HTTPException(503, {
+      message: "automation dispatcher is unavailable",
+    });
+  }
+  for (const trigger of matching) {
+    const render = adapter.render({
+      event: stored.event.normalizedEvent,
+      trigger,
+      source: acceptedSource,
+    });
+    const acceptedExecution = buildAutomationAcceptedExecution({
+      accountId: source.accountId,
+      workspaceId: source.workspaceId,
+      source: acceptedSource,
+      trigger,
+      eventId: stored.event.id,
+      event: stored.event.normalizedEvent,
+      render,
+    });
+    const { run } = await createAutomationRun(deps.db, {
+      accountId: source.accountId,
+      workspaceId: source.workspaceId,
+      sourceId: source.id,
+      triggerId: trigger.id,
+      triggerRevision: trigger.revision,
+      eventId: stored.event.id,
+      occurrenceKey: stored.event.normalizedEvent.occurrenceKey,
+      acceptedExecution,
+    });
+    runIds.push(run.id);
+    await triggerAutomationRun!({
+      accountId: source.accountId,
+      workspaceId: source.workspaceId,
+      runId: run.id,
+    });
+  }
+  return AutomationWebhookResult.parse({
+    accepted: true,
+    duplicate: stored.duplicate,
+    ignoredReason: stored.event.ignoredReason,
+    eventId: stored.event.id,
+    runIds,
+  });
+}
+
+async function requireSource(
+  deps: ApiRouteDeps,
+  accountId: string,
+  workspaceId: string,
+  sourceId: string,
+): Promise<AutomationSourceSecret> {
+  const source = await getAutomationSourceSecret(deps.db, {
+    accountId,
+    workspaceId,
+    sourceId,
+  });
+  if (!source) throw new HTTPException(404, { message: "automation source not found" });
+  return source;
+}
+
+function assertGenericSourceMutable(source: AutomationSourceSecret): void {
+  if (source.packInstallationId) {
+    throw new HTTPException(409, {
+      message: "Pack-owned automation sources must be managed through their Pack setup API",
+    });
+  }
+}
+
+function assertGenericTriggerMutable(trigger: { packInstallationId: string | null }): void {
+  if (trigger.packInstallationId) {
+    throw new HTTPException(409, {
+      message: "Pack-owned automation triggers must be managed through their Pack setup API",
+    });
+  }
+}
+
+function requireEncryptionKey(deps: ApiRouteDeps): Uint8Array {
+  const key = environmentsEncryptionKeyBytes(deps.settings);
+  if (!key) {
+    throw new HTTPException(503, {
+      message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is required for automations",
+    });
+  }
+  return key;
+}
+
+export async function readAutomationWebhookBody(
+  request: Request,
+  maxBytes: number,
+): Promise<Uint8Array> {
+  const declared = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maxBytes) {
+    throw new HTTPException(413, {
+      message: "automation webhook payload is too large",
+    });
+  }
+  if (!request.body) return new Uint8Array();
+  const reader = request.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let length = 0;
+  while (true) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    length += value.byteLength;
+    if (length > maxBytes) {
+      await reader.cancel();
+      throw new HTTPException(413, {
+        message: "automation webhook payload is too large",
+      });
+    }
+    chunks.push(value);
+  }
+  const result = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return result;
+}