@opengeni/api-router 0.30.3 → 2.2.0-canary.0

package/src/routes/workspaces.ts

@@ -16,6 +16,7 @@ import {
   workspaceControlUtf8Bytes,
   type AccessContext,
   type Permission,
+  type WorkspaceMember as WorkspaceMemberValue,
 } from "@opengeni/contracts";
 import {
   allWorkspacePermissions,
@@ -25,6 +26,7 @@ import {
   getWorkspaceModelPolicy,
   grantWorkspaceAccess,
   listWorkspaceMembers,
+  normalizeWorkspaceMembershipPermissions,
   listWorkspaceControlEvents,
   listWorkspacesForSubject,
   removeWorkspaceMember,
@@ -35,13 +37,19 @@ import {
   updateWorkspaceSettings,
   upsertWorkspaceModelPolicy,
   workspaceCodexSubscriptionActive,
+  workspaceControlRequestLockTimeoutMs,
   workspaceXaiSubscriptionActive,
   workspaceVercelAiGatewayConnectionActive,
 } from "@opengeni/db";
 import { boundWorkspaceControlHttpPage } from "@opengeni/events";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { hasPermission, requireAccessContext, requireAccessGrant } from "@opengeni/core";
+import {
+  hasPermission,
+  requireAccessContext,
+  requireAccessGrant,
+  requireFreshAccessGrant,
+} from "@opengeni/core";
 import { requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
@@ -71,6 +79,24 @@ export function canonicalWorkspacePolicyModelIds(
   return [...new Set(modelIds.map((modelId) => canonicalizeConfiguredModelId(settings, modelId)))];
 }
 
+type WorkspaceMemberProjectionInput = Omit<WorkspaceMemberValue, "permissions"> & {
+  permissions: unknown;
+};
+
+/**
+ * Keep the roster readable across stored-permission contract changes. Unknown
+ * values are never re-authorized: they are omitted from the public projection,
+ * while every currently recognized permission is preserved in stored order.
+ */
+export function workspaceMembersResponse(members: readonly WorkspaceMemberProjectionInput[]) {
+  return ListWorkspaceMembersResponse.parse({
+    members: members.map((member) => ({
+      ...member,
+      permissions: normalizeWorkspaceMembershipPermissions(member.permissions),
+    })),
+  });
+}
+
 export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/access/me", async (c) => {
     return c.json(await requireAccessContext(c, deps));
@@ -157,7 +183,11 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!parsed.success) {
       throw new HTTPException(400, { message: "invalid workspace settings patch" });
     }
-    const workspace = await updateWorkspaceSettings(deps.db, workspaceId, parsed.data);
+    // Request-scoped: bound the exclusive control-prefix wait so a busy
+    // workspace yields the retryable 503 instead of parking this request.
+    const workspace = await updateWorkspaceSettings(deps.db, workspaceId, parsed.data, {
+      controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs(),
+    });
     return c.json(Workspace.parse(workspace));
   });
 
@@ -290,7 +320,14 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
     return c.json(
       await controlHumanWorkspace(
-        { db: deps.db, bus: deps.bus, workflowClient: deps.workflowClient },
+        {
+          db: deps.db,
+          bus: deps.bus,
+          workflowClient: deps.workflowClient,
+          ...(deps.schedulePromptPostCommit
+            ? { schedulePromptPostCommit: deps.schedulePromptPostCommit }
+            : {}),
+        },
         { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
         parsed.data,
       ),
@@ -324,7 +361,12 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
       workspaceId,
       after,
       c.req.raw.signal,
-      { observability: deps.observability },
+      {
+        observability: deps.observability,
+        reauthorize: async () => {
+          await requireFreshAccessGrant(c, deps, workspaceId, "workspace:read");
+        },
+      },
     );
   });
 
@@ -369,6 +411,11 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "wait for the workspace's active video generations to finish before deleting it",
       });
     }
+    if (deleted.status === "active_background_commands") {
+      throw new HTTPException(409, {
+        message: "pause or cancel the workspace's background commands before deleting it",
+      });
+    }
     if (deleted.status === "live_sandboxes") {
       throw new HTTPException(409, {
         message: "wait for the workspace's active sandboxes to finish draining before deleting it",
@@ -399,7 +446,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:read");
     const members = await listWorkspaceMembers(deps.db, workspaceId);
-    return c.json(ListWorkspaceMembersResponse.parse({ members }));
+    return c.json(workspaceMembersResponse(members));
   });
 
   app.post("/v1/workspaces/:workspaceId/members", async (c) => {
@@ -458,8 +505,14 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
     const subjectId = decodeURIComponent(c.req.param("subjectId"));
     const members = await listWorkspaceMembers(deps.db, workspaceId);
     // Never remove yourself, and never remove the last administering member.
+    // The fenced removal command re-enforces both guards fail-closed.
     assertWorkspaceMemberRemovable({ members, subjectId, callerSubjectId: grant.subjectId });
-    await removeWorkspaceMember(deps.db, workspaceId, subjectId);
+    await removeWorkspaceMember(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      actorSubjectId: grant.subjectId,
+      targetSubjectId: subjectId,
+    });
     return c.body(null, 204);
   });
 }

package/src/sandbox/auth-callout.ts

@@ -12,15 +12,15 @@
 //      resolveEnrollmentSigningSecret) — an invalid/expired/forged bearer is denied;
 //   3. confirms the enrollment is still ACTIVE in the DB at the exact credential
 //      generation (a revoked or re-enrolled machine denies an old bearer);
-//   4. signs a NATS user JWT granting pub/sub ONLY `agent.<ws>.>` + `_INBOX.>`
-//      (deny-all-else by an allow-list) and returns it inside a signed
+//   4. atomically claims the daemon instance named in CONNECT;
+//   5. signs a NATS user JWT granting pub/sub ONLY that exact process subtree +
+//      `_INBOX.>` (deny-all-else by an allow-list) and returns it inside a signed
 //      authorization-response JWT.
 //
-// That per-subject scope is the per-workspace ISOLATION: workspace A's agent is
-// cryptographically incapable of pub/sub on `agent.B.>`. nats-server enforces the
-// signed permission set; the boundary does not rely on subject naming alone (the M4
-// transport test proved the CODE constructs scoped subjects; THIS proves the SERVER
-// refuses cross-workspace access).
+// That exact scope is both the tenancy boundary and routing fence: workspace A
+// cannot reach B, and an old/duplicate process cannot subscribe to its successor's
+// work. nats-server enforces the signed permission set; the boundary does not rely
+// on naming alone.
 //
 // SECURITY (§18): the bearer value + the account signing seed are NEVER logged. A
 // validation failure → a DENIAL response (the server refuses the connection); a
@@ -34,23 +34,24 @@ import {
   type Settings,
 } from "@opengeni/config";
 import { verifyEnrollmentBearer } from "@opengeni/contracts";
-import { getEnrollment, type Database } from "@opengeni/db";
+import { claimEnrollmentConnection, getEnrollment, type Database } from "@opengeni/db";
 import {
   createResponderConnection,
   decodeAuthRequest,
   mintAuthResponse,
   mintUserJwt,
+  parseAgentConnectionName,
   workspaceAgentPermissions,
   type ResponderConnection,
 } from "@opengeni/events";
 import type { Observability } from "@opengeni/observability";
 import { observabilityEventLogger } from "../observability";
+import { AGENT_CONNECTION_LEASE_MS } from "./connection-authority";
 
 /** The NATS subject nats-server publishes authorization requests on (ADR-26). */
 export const AUTH_CALLOUT_SUBJECT = "$SYS.REQ.USER.AUTH";
 /** Keep live NATS credentials short-lived while never outliving the bearer. */
 export const NATS_USER_JWT_TTL_SECONDS = 5 * 60;
-
 export interface AuthCalloutDeps {
   db: Database;
   settings: Settings;
@@ -138,9 +139,33 @@ export async function handleAuthorizationRequest(
     return deny("enrollment credential generation mismatch");
   }
 
-  // GRANT: a user JWT scoped to ONLY this workspace's agent subtree + the reply
-  // inbox. This allow-list IS the per-workspace isolation boundary.
-  const permissions = workspaceAgentPermissions(claims.workspaceId);
+  const connectionInstanceId = parseAgentConnectionName(decoded.name);
+  if (!connectionInstanceId) {
+    return deny("missing or invalid agent connection instance");
+  }
+  const claim = await claimEnrollmentConnection(deps.db, {
+    workspaceId: claims.workspaceId,
+    enrollmentId: claims.enrollmentId,
+    credentialGeneration: claims.credentialGeneration,
+    connectionInstanceId,
+    leaseMs: AGENT_CONNECTION_LEASE_MS,
+  });
+  if (!claim.claimed) {
+    deps.observability?.warn?.("auth-callout: denied a duplicate live runner", {
+      workspaceId: claims.workspaceId,
+      agentId: claims.agentId,
+    });
+    return deny("another runner instance currently owns this enrollment");
+  }
+
+  // GRANT: the operational subject includes the exact claimed process instance.
+  // A previous socket may remain open until its short JWT expires, but no control
+  // request is routed to its old subject after a successor claims authority.
+  const permissions = workspaceAgentPermissions(
+    claims.workspaceId,
+    claims.agentId,
+    connectionInstanceId,
+  );
   const nowSeconds = Math.floor(Date.now() / 1000);
   const userJwt = mintUserJwt({
     userPublicKey: decoded.userNkey,
@@ -165,6 +190,7 @@ export async function handleAuthorizationRequest(
   deps.observability?.info?.("auth-callout: granted a workspace-scoped NATS credential", {
     workspaceId: claims.workspaceId,
     agentId: claims.agentId,
+    connectionGeneration: claim.connectionGeneration,
   });
   return Buffer.from(response, "utf8");
 }