@opengeni/api-router 0.30.3 → 2.2.0-canary.0

package/src/routes/connection-authorities.ts

@@ -0,0 +1,139 @@
+import {
+  ConnectionUseGrantMutationResponse,
+  ConnectionUseGrantRevocationResponse,
+  IssueConnectionUseGrantRequest,
+  ListConnectionAuthoritiesQuery,
+  RevokeConnectionUseGrantQuery,
+} from "@opengeni/contracts/connection-authority";
+import {
+  issueManagedHumanUserResourceGrant,
+  listManagedHumanUserResourceAuthorities,
+  requireAccessGrantAuthorization,
+  revokeManagedHumanUserResourceGrant,
+  SessionAuthorizationDeniedError,
+  SessionAuthorizationUnavailableError,
+  SessionTenancyManagedHumanRequiredError,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import { nestedPostgresSqlState, SessionTenancyNotActivatedError } from "@opengeni/db";
+import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+import {
+  connectionUseGrantLifecycleInput,
+  projectSelfConnectionAuthorities,
+} from "../connection-authority-owner";
+
+async function body<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
+  const parsed = schema.safeParse(await context.req.json().catch(() => null));
+  if (!parsed.success) throw new HTTPException(422, { message: "invalid connection authority" });
+  return parsed.data;
+}
+
+function lifecycleError(error: unknown): never {
+  if (
+    error instanceof SessionAuthorizationDeniedError ||
+    error instanceof SessionTenancyManagedHumanRequiredError ||
+    error instanceof SessionTenancyNotActivatedError
+  ) {
+    throw new HTTPException(403, { message: "connection authority denied" });
+  }
+  if (error instanceof SessionAuthorizationUnavailableError) {
+    throw new HTTPException(503, { message: "session authorization unavailable" });
+  }
+  if (nestedPostgresSqlState(error) === "42501") {
+    throw new HTTPException(403, { message: "connection authority denied" });
+  }
+  if (nestedPostgresSqlState(error) === "22023") {
+    throw new HTTPException(422, { message: "invalid connection authority" });
+  }
+  throw error;
+}
+
+export function registerConnectionAuthorityRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const base = "/v1/workspaces/:workspaceId/connection-authorities";
+
+  app.get(base, async (context) => {
+    const query = ListConnectionAuthoritiesQuery.safeParse({
+      scope: context.req.query("scope"),
+      cursor: context.req.query("cursor"),
+      limit: context.req.query("limit"),
+    });
+    if (!query.success) throw new HTTPException(422, { message: "explicit scope=user required" });
+    const workspaceId = context.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "connections:read",
+    );
+    try {
+      return context.json(
+        projectSelfConnectionAuthorities(
+          await listManagedHumanUserResourceAuthorities(deps, access, workspaceId, {
+            resourceKind: "connection",
+            cursor: query.data.cursor,
+            limit: query.data.limit,
+          }),
+        ),
+      );
+    } catch (error) {
+      return lifecycleError(error);
+    }
+  });
+
+  app.post(`${base}/:authorityId/grants`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const authorityId = z.string().uuid().safeParse(context.req.param("authorityId"));
+    if (!authorityId.success) throw new HTTPException(422, { message: "invalid authority id" });
+    const request = await body(context, IssueConnectionUseGrantRequest);
+    const access = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "connections:read",
+    );
+    try {
+      const normalized = connectionUseGrantLifecycleInput(request);
+      return context.json(
+        ConnectionUseGrantMutationResponse.parse({
+          scope: "user",
+          grant: await issueManagedHumanUserResourceGrant(
+            deps,
+            access,
+            workspaceId,
+            authorityId.data,
+            { scope: "user", resourceKind: "connection", ...normalized },
+            "http",
+          ),
+        }),
+      );
+    } catch (error) {
+      return lifecycleError(error);
+    }
+  });
+
+  app.delete(`${base}/grants/:grantId`, async (context) => {
+    const query = RevokeConnectionUseGrantQuery.safeParse({ scope: context.req.query("scope") });
+    if (!query.success) throw new HTTPException(422, { message: "explicit scope=user required" });
+    const grantId = z.string().uuid().safeParse(context.req.param("grantId"));
+    if (!grantId.success) throw new HTTPException(422, { message: "invalid grant id" });
+    const workspaceId = context.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "workspace:read",
+    );
+    try {
+      return context.json(
+        ConnectionUseGrantRevocationResponse.parse({
+          scope: "user",
+          grant: await revokeManagedHumanUserResourceGrant(deps, access, workspaceId, grantId.data),
+        }),
+      );
+    } catch (error) {
+      return lifecycleError(error);
+    }
+  });
+}

package/src/routes/connections.ts

@@ -39,6 +39,12 @@ import {
   GoogleDriveOAuthStartRequest,
   GoogleDriveOAuthStartResponse,
 } from "@opengeni/contracts/google-drive";
+import {
+  PERSONAL_GITHUB_PROVIDER_DOMAIN,
+  PersonalGitHubDisconnectRequest,
+  hasReservedPersonalGitHubMetadata,
+  isPersonalGitHubConnection,
+} from "@opengeni/contracts/personal-github";
 import {
   fikenConnectionMetadata,
   hasPermission,
@@ -84,8 +90,10 @@ import {
 } from "../integrations/google-drive";
 import {
   completeApiIntegrationProviderOAuth,
+  isApiIntegrationProviderOAuthState,
   startApiIntegrationProviderOAuth,
 } from "../integrations/provider-oauth";
+import { disconnectPersonalGitHub } from "../integrations/personal-github";
 import {
   browseAtlassianSources,
   completeAtlassianOAuthCallback,
@@ -99,6 +107,10 @@ import {
   integrationBaseUrl,
   startMcpOAuth,
 } from "../integrations/oauth-client";
+import {
+  assertPersonalConnectionOwnerPrincipal,
+  isPersonalConnectionOwnerPrincipal,
+} from "../connection-ownership";
 import { canonicalProviderDomain } from "../integrations/provider-domain";
 import {
   exchangeOpenGeniSlackAuthorizationCode,
@@ -164,17 +176,23 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "connections:write");
+    const grant = access.grant;
     const payload = CreateConnectionRequest.parse(await c.req.json());
     assertNotReservedSlackBotMetadata(payload.metadata);
     assertNotReservedFikenMetadata(payload.metadata);
     assertNotReservedApiIntegrationOAuthMetadata(payload.metadata);
+    assertNotReservedPersonalGitHubMetadata(payload.metadata);
     const key = requireEnvironmentEncryption(settings);
     const subjectId = createConnectionSubjectId(payload, grant.subjectId);
+    if (subjectId !== null) {
+      assertPersonalConnectionOwnerPrincipal(access);
+    }
     const providerDomain = canonicalProviderDomain(payload.providerDomain);
     assertNotDirectPersonalSlackOAuth(providerDomain, payload.kind);
     assertNotDirectGoogleDriveOAuth(providerDomain, payload.kind, payload.metadata);
     assertNotDirectAtlassianOAuth(providerDomain, payload.kind, payload.metadata);
+    assertNotDirectPersonalGitHubOAuth(providerDomain, payload.kind, payload.metadata);
     const connection = await createConnection(db, {
       accountId: grant.accountId,
       workspaceId,
@@ -271,7 +289,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       }
       const slack = requireOpenGeniSlackOAuthSettings(settings);
       const redirectUri = `${baseUrl}/v1/integrations/slack/callback`;
-      const token = await exchangeOpenGeniSlackAuthorizationCode(
+      const authorization = await exchangeOpenGeniSlackAuthorizationCode(
         {
           code,
           clientId: slack.clientId,
@@ -281,14 +299,22 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
         deps.slackFetch ?? fetch,
       );
       stage = "credential_verification";
-      const verified = await verifyOpenGeniSlackBotCredential(token, deps.slackFetch ?? fetch);
+      const verified = await verifyOpenGeniSlackBotCredential(
+        authorization.accessToken,
+        {
+          appId: authorization.appId,
+          displayName: settings.slackBotDisplayName,
+        },
+        deps.slackFetch ?? fetch,
+        new Date(),
+      );
       stage = "permission_recheck";
       await requireSlackInstallCallbackGrant(db, state);
       stage = "persistence";
       const connection = await persistOpenGeniSlackBotConnection({
         deps,
         state,
-        token,
+        token: authorization.accessToken,
         verified,
       });
       return c.redirect(
@@ -439,7 +465,11 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/connections/google-drive/install", async (c) => {
     assertIntegrationsEnabled();
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    // The Drive connector writes only a personal Connection, so only a managed
+    // human may start it.
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "connections:write");
+    assertPersonalConnectionOwnerPrincipal(access, "Google Drive");
+    const grant = access.grant;
     const parsed = GoogleDriveOAuthStartRequest.safeParse(await c.req.json());
     if (!parsed.success) {
       throw new HTTPException(400, { message: "invalid Google Drive install request" });
@@ -460,7 +490,11 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/connections/atlassian/install", async (c) => {
     assertIntegrationsEnabled();
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    // The Atlassian connector writes only a personal Connection, so only a
+    // managed human may start it.
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "connections:write");
+    assertPersonalConnectionOwnerPrincipal(access, "Atlassian");
+    const grant = access.grant;
     const parsed = AtlassianOAuthStartRequest.safeParse(await c.req.json());
     if (!parsed.success) {
       throw new HTTPException(400, { message: "invalid Atlassian install request" });
@@ -663,6 +697,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     assertNotReservedSlackBotMetadata(payload.metadata);
     assertNotReservedFikenMetadata(payload.metadata);
     assertNotReservedApiIntegrationOAuthMetadata(payload.metadata);
+    assertNotReservedPersonalGitHubMetadata(payload.metadata);
     const existing = await getConnectionMetadata(
       db,
       workspaceId,
@@ -749,6 +784,11 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "use the dedicated Atlassian reconnect or source-selection flow",
       });
     }
+    if (existing && isPersonalGitHubConnection(existing)) {
+      throw new HTTPException(422, {
+        message: "use the dedicated personal GitHub reconnect flow to update this connection",
+      });
+    }
     if (existing) {
       const providerDomain = canonicalProviderDomain(
         payload.providerDomain ?? existing.providerDomain,
@@ -757,6 +797,11 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       assertNotDirectPersonalSlackOAuth(providerDomain, kind);
       assertNotDirectGoogleDriveOAuth(providerDomain, kind, payload.metadata ?? existing.metadata);
       assertNotDirectAtlassianOAuth(providerDomain, kind, payload.metadata ?? existing.metadata);
+      assertNotDirectPersonalGitHubOAuth(
+        providerDomain,
+        kind,
+        payload.metadata ?? existing.metadata,
+      );
     }
     // Status is not a free-form field: revocation goes through DELETE, and the
     // broker owns needs_reauth/error. Reactivating a connection is only
@@ -813,6 +858,17 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!existing) {
       throw new HTTPException(404, { message: "connection not found" });
     }
+    const isPersonalGitHub =
+      existing.subjectId === grant.subjectId && isPersonalGitHubConnection(existing);
+    if (isPersonalGitHub) {
+      const access = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "connections:write",
+      );
+      assertPersonalConnectionOwnerPrincipal(access, "My GitHub account");
+    }
     const isGoogleDrive =
       existing.subjectId === grant.subjectId &&
       existing.providerDomain === GOOGLE_DRIVE_PROVIDER_DOMAIN &&
@@ -843,7 +899,17 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
           atlassianDisconnect.error.issues[0]?.message ?? "invalid Atlassian disconnect request",
       });
     }
-    if (existing.status === "revoked" && !isGoogleDrive && !isAtlassian) {
+    const personalGitHubDisconnect = isPersonalGitHub
+      ? PersonalGitHubDisconnectRequest.safeParse(disconnectPayload)
+      : null;
+    if (personalGitHubDisconnect && !personalGitHubDisconnect.success) {
+      throw new HTTPException(400, {
+        message:
+          personalGitHubDisconnect.error.issues[0]?.message ??
+          "invalid personal GitHub disconnect request",
+      });
+    }
+    if (existing.status === "revoked" && !isGoogleDrive && !isAtlassian && !isPersonalGitHub) {
       return c.json(ConnectionResponse.parse({ connection: existing }));
     }
     const connection = isGoogleDrive
@@ -860,24 +926,31 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
             connection: existing,
             payload: atlassianDisconnect!.data,
           })
-        : isOpenGeniSlackBotConnection(existing)
-          ? await revokeConnectionWithSlackBotSuccessAudit(db, {
-              accountId: grant.accountId,
+        : isPersonalGitHub
+          ? await disconnectPersonalGitHub(deps, {
               workspaceId,
               subjectId: grant.subjectId,
               connectionId,
-              expectedVersion: existing.version,
-              credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
-              credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
-              slackTeamId: openGeniSlackBotMetadata(existing.metadata)!.slackTeamId,
+              payload: personalGitHubDisconnect!.data,
             })
-          : await revokeConnection(
-              db,
-              workspaceId,
-              connectionId,
-              grant.subjectId,
-              existing.version,
-            );
+          : isOpenGeniSlackBotConnection(existing)
+            ? await revokeConnectionWithSlackBotSuccessAudit(db, {
+                accountId: grant.accountId,
+                workspaceId,
+                subjectId: grant.subjectId,
+                connectionId,
+                expectedVersion: existing.version,
+                credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
+                credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
+                slackTeamId: openGeniSlackBotMetadata(existing.metadata)!.slackTeamId,
+              })
+            : await revokeConnection(
+                db,
+                workspaceId,
+                connectionId,
+                grant.subjectId,
+                existing.version,
+              );
     if (!connection) {
       throw new HTTPException(409, { message: "connection changed during disconnect; try again" });
     }
@@ -887,7 +960,8 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/connections/oauth/start", async (c) => {
     assertIntegrationsEnabled();
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "connections:write");
+    const grant = access.grant;
     const parsed = OAuthStartRequest.safeParse(await c.req.json());
     if (!parsed.success) {
       throw new HTTPException(400, {
@@ -901,6 +975,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
         accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
+        personalOwnershipAllowed: isPersonalConnectionOwnerPrincipal(access),
         requestUrl: c.req.url,
         payload,
       },
@@ -911,7 +986,8 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/integrations/oauth/start", async (c) => {
     assertIntegrationsEnabled();
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "connections:write");
+    const grant = access.grant;
     const parsed = ApiIntegrationOAuthStartRequest.safeParse(await c.req.json());
     if (!parsed.success) {
       throw new HTTPException(400, {
@@ -924,6 +1000,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
           accountId: grant.accountId,
           workspaceId,
           subjectId: grant.subjectId,
+          personalOwnershipAllowed: isPersonalConnectionOwnerPrincipal(access),
           requestUrl: c.req.url,
           payload: parsed.data,
         }),
@@ -933,15 +1010,22 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/integrations/oauth/callback", async (c) => {
     assertIntegrationsEnabled();
-    const result = await completeMcpOAuthCallback(
-      { db, settings, observability, oauthCallbackDeadlineMs: deps.oauthCallbackDeadlineMs },
-      {
-        code: c.req.query("code"),
-        state: c.req.query("state"),
-        requestUrl: c.req.url,
-      },
-    );
-    return c.redirect(result.redirectTo, 302);
+    const input = {
+      ...(c.req.query("code") ? { code: c.req.query("code") } : {}),
+      ...(c.req.query("state") ? { state: c.req.query("state") } : {}),
+      ...(c.req.query("error") ? { error: c.req.query("error") } : {}),
+      requestUrl: c.req.url,
+    };
+    const result = isApiIntegrationProviderOAuthState(input.state, deps.settings)
+      ? await completeApiIntegrationProviderOAuth(deps, input)
+      : await completeMcpOAuthCallback(
+          { db, settings, observability, oauthCallbackDeadlineMs: deps.oauthCallbackDeadlineMs },
+          input,
+        );
+    const redirectTo = settings.webBaseUrl
+      ? new URL(result.redirectTo, settings.webBaseUrl).toString()
+      : result.redirectTo;
+    return c.redirect(redirectTo, 302);
   });
 
   app.get("/v1/integrations/provider-oauth/callback", async (c) => {
@@ -1074,10 +1158,11 @@ function requireOpenGeniSlackOAuthSettings(settings: ApiRouteDeps["settings"]):
 } {
   const clientId = settings.slackClientId?.trim();
   const clientSecret = settings.slackClientSecret?.trim();
-  if (!clientId || !clientSecret) {
+  const signingSecret = settings.slackSigningSecret?.trim();
+  if (!clientId || !clientSecret || !signingSecret) {
     throw new HTTPException(503, {
       message:
-        "OpenGeni Slack installation requires OPENGENI_SLACK_CLIENT_ID and OPENGENI_SLACK_CLIENT_SECRET",
+        "OpenGeni Slack bot installation requires OPENGENI_SLACK_CLIENT_ID, OPENGENI_SLACK_CLIENT_SECRET, and OPENGENI_SLACK_SIGNING_SECRET",
     });
   }
   return { clientId, clientSecret };
@@ -1257,6 +1342,31 @@ function assertNotDirectAtlassianOAuth(
   }
 }
 
+function assertNotDirectPersonalGitHubOAuth(
+  providerDomain: string,
+  kind: string,
+  metadata: Record<string, unknown> | undefined,
+): void {
+  if (
+    (providerDomain === PERSONAL_GITHUB_PROVIDER_DOMAIN && kind === "oauth2") ||
+    hasReservedPersonalGitHubMetadata(metadata)
+  ) {
+    throw new HTTPException(422, {
+      message: "personal GitHub credentials must use the dedicated OAuth connection flow",
+    });
+  }
+}
+
+function assertNotReservedPersonalGitHubMetadata(
+  metadata: Record<string, unknown> | undefined,
+): void {
+  if (hasReservedPersonalGitHubMetadata(metadata)) {
+    throw new HTTPException(422, {
+      message: "personal GitHub metadata is reserved for the dedicated OAuth connection flow",
+    });
+  }
+}
+
 function assertNotReservedSlackBotMetadata(metadata: Record<string, unknown> | undefined): void {
   if (hasReservedOpenGeniSlackBotMetadata(metadata)) {
     throw new HTTPException(422, {