@opengeni/api-router 1.3.0 → 1.4.2

package/src/http/api-error.ts

@@ -5,7 +5,11 @@ import {
   ScheduledTaskTargetAccessChange,
   type ErrorCode,
 } from "@opengeni/contracts";
-import { isDatabaseConnectionLoss, WorkspaceControlBusyError } from "@opengeni/db";
+import {
+  isDatabaseConnectionLoss,
+  nestedPostgresSqlState,
+  WorkspaceControlBusyError,
+} from "@opengeni/db";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
 import { HTTPException } from "hono/http-exception";
 
@@ -116,6 +120,37 @@ export function databaseUnavailableHttpError(error: unknown, method: string): Ap
   });
 }
 
+/** `details.code` of the retryable 503 for a deadlock/serialization victim. */
+export const DATABASE_CONTENTION_ERROR_DETAIL_CODE = "DATABASE_CONTENTION";
+
+/**
+ * PostgreSQL aborted the request's transaction as a deadlock (40P01) or
+ * serialization (40001) victim after any in-process retry was exhausted. The
+ * aborted transaction committed nothing, so this is transient contention, not
+ * an internal error. A read is safe to repeat. For a mutation the default is
+ * `outcomeUnknown` because an earlier transaction of the same request may have
+ * committed; a route whose only write is the aborted idempotent transaction
+ * passes `outcomeUnknown: false`.
+ */
+export function databaseContentionHttpError(
+  error: unknown,
+  method: string,
+  options: { outcomeUnknown?: boolean } = {},
+): ApiHttpError | null {
+  if (error instanceof ApiHttpError) return null;
+  if (error instanceof HTTPException && error.status < 500) return null;
+  const sqlState = nestedPostgresSqlState(error);
+  if (sqlState !== "40P01" && sqlState !== "40001") return null;
+  const safeMethod = method === "GET" || method === "HEAD" || method === "OPTIONS";
+  return new ApiHttpError(503, {
+    code: "upstream_unavailable",
+    message: "Opengeni hit transient database contention. Retry shortly.",
+    retryable: true,
+    outcomeUnknown: options.outcomeUnknown ?? !safeMethod,
+    details: { code: DATABASE_CONTENTION_ERROR_DETAIL_CODE, sqlState },
+  });
+}
+
 /**
  * A typed agent-configuration failure (capability unavailable, conflict,
  * widening, not enabled). Rendered as 422 validation_failed with the specific

package/src/integrations/oauth-client.ts

@@ -7,7 +7,11 @@ import {
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
-import { parseIntegrationsOauthClientsJson, type Settings } from "@opengeni/config";
+import {
+  findIntegrationsOauthClient,
+  parseIntegrationsOauthClientsJson,
+  type Settings,
+} from "@opengeni/config";
 import {
   OAuthStartResponse,
   selectCanonicalPersonalSlackConnection,
@@ -1799,7 +1803,6 @@ function operatorClientEntryFor(
   settings: Settings,
   candidates: string[],
 ): ReturnType<typeof parseIntegrationsOauthClientsJson>[string] | null {
-  const normalizedCandidates = new Set(candidates.map(normalizedIssuerKey));
   const candidateOrigins = candidates.flatMap((candidate) => {
     try {
       return [new URL(candidate).origin];
@@ -1816,22 +1819,10 @@ function operatorClientEntryFor(
       return resolved;
     }
   }
-  const configured = parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
-  const exactKeys = uniqueStrings(
-    candidates.flatMap((candidate) => [candidate, normalizedIssuerKey(candidate)]),
+  return findIntegrationsOauthClient(
+    parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson),
+    candidates,
   );
-  for (const key of exactKeys) {
-    const entry = configured[key];
-    if (entry) {
-      return entry;
-    }
-  }
-  for (const [key, entry] of Object.entries(configured)) {
-    if (normalizedCandidates.has(normalizedIssuerKey(key))) {
-      return entry;
-    }
-  }
-  return null;
 }
 
 /** Secret-free readiness for the exact registered client used by Gmail setup. */
@@ -2708,6 +2699,7 @@ async function verifyMcpToolsListNonFatal(
       providerIdentity = local.validateIdentity(payload);
       const verifiedTools = local.toolsForScopes(
         grantedScopes(token.scopeText, state.authorizeScopes, profile),
+        settings,
       );
       if (local.required && verifiedTools.length === 0)
         throw new Error("Connector verification did not report an authorized tool scope");

package/src/integrations/oauth-profiles.ts

@@ -7,7 +7,11 @@ import { OPENGENI_PERSONAL_SLACK_MCP_URL, type ConnectionOwnership } from "@open
 import type { Settings } from "@opengeni/config";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
-import { GMAIL_REST_MCP_TOOLS, gmailToolSupportsScopes } from "@opengeni/runtime/gmail-rest-mcp";
+import {
+  GMAIL_REST_MCP_TOOLS,
+  gmailToolAvailableOnDeployment,
+  gmailToolSupportsScopes,
+} from "@opengeni/runtime/gmail-rest-mcp";
 import { canonicalProviderDomain } from "./provider-domain";
 
 /**
@@ -132,7 +136,10 @@ export type OAuthProviderProfile = {
     /** Distinguish a rejected OAuth grant from a temporary verification failure. */
     isRejectedGrant?: (payload: Record<string, unknown>) => boolean;
     validateIdentity: (payload: Record<string, unknown>) => Record<string, string>;
-    toolsForScopes: (scopes: readonly string[]) => Array<{ name: string; description?: string }>;
+    toolsForScopes: (
+      scopes: readonly string[],
+      deployment: { gmailWatchTopicName?: string | undefined },
+    ) => Array<{ name: string; description?: string }>;
   };
 };
 
@@ -265,10 +272,14 @@ const OFFICIAL_GMAIL_PROFILE: OAuthProviderProfile = {
       }
       return { gmailEmail: payload.emailAddress };
     },
-    toolsForScopes: (scopes) => {
-      return GMAIL_REST_MCP_TOOLS.filter((tool) => gmailToolSupportsScopes(tool.name, scopes)).map(
-        ({ name, description }) => ({ name, ...(description ? { description } : {}) }),
-      );
+    toolsForScopes: (scopes, deployment) => {
+      return GMAIL_REST_MCP_TOOLS.filter(
+        (tool) =>
+          gmailToolSupportsScopes(tool.name, scopes) &&
+          gmailToolAvailableOnDeployment(tool.name, {
+            watchTopicName: deployment.gmailWatchTopicName,
+          }),
+      ).map(({ name, description }) => ({ name, ...(description ? { description } : {}) }));
     },
   },
 };

package/src/routes/editable-artifacts.ts

@@ -609,6 +609,14 @@ export function registerEditableArtifactRoutes(
     const body = await parseBoundedMaterializationRequest(context);
     const scope = editableArtifactScope({ accountId: grant.accountId, workspaceId });
     const actor = editableArtifactActorForGrant(grant, body.replicaId);
+    // Without a materializer workload the job would stay queued forever.
+    if (!deps.settings.artifactMaterializerDeployed) {
+      throw new ApiHttpError(503, {
+        code: "upstream_unavailable",
+        message: "File export is not available on this deployment.",
+        retryable: false,
+      });
+    }
     try {
       const result = await requireEditableArtifactExports(deps).enqueueMaterialization({
         scope,

package/src/routes/session-artifact-associations.ts

@@ -1,5 +1,6 @@
 import {
-  requireAccessGrant,
+  fileOwnerContextForAccess,
+  requireAccessGrantAuthorization,
   requirePermission,
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
@@ -7,10 +8,15 @@ import {
   type ApiRouteDeps,
 } from "@opengeni/core";
 import {
+  getGeneratedImageArtifact,
+  getGeneratedVideoArtifact,
+  getRetainedFileArtifact,
   hasEditableArtifactSessionLink,
   hasWorkspaceArtifactSessionLink,
+  listArtifactCatalogCandidates,
   transactionallyAuthorizeEditableArtifactActor,
   withRlsContext,
+  withSessionRlsActorContext,
 } from "@opengeni/db";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
@@ -27,16 +33,26 @@ export function registerSessionArtifactAssociationRoutes(app: Hono, deps: ApiRou
     "/v1/workspaces/:workspaceId/sessions/:sessionId/artifact-associations/:artifactId",
     async (context) => {
       const workspaceId = context.req.param("workspaceId");
-      const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
-      requirePermission(grant, "sessions:read");
       const sessionId = context.req.param("sessionId");
       const artifactId = context.req.param("artifactId");
+      const requestedKind = context.req.query("kind");
+      // A UUID names a Site unless the caller asks for a retained artifact
+      // (generated image or video, or a published sandbox file) explicitly.
       const kind = EditableArtifactId.safeParse(artifactId).success
         ? "editable"
         : SessionId.safeParse(artifactId).success
-          ? "site"
+          ? requestedKind === "retained"
+            ? "retained"
+            : "site"
           : null;
-      const requestedKind = context.req.query("kind");
+      const authorization = await requireAccessGrantAuthorization(
+        context,
+        deps,
+        workspaceId,
+        kind === "retained" ? "files:read" : "artifacts:read",
+      );
+      const grant = authorization.grant;
+      requirePermission(grant, "sessions:read");
       if (
         !SessionId.safeParse(sessionId).success ||
         !kind ||
@@ -55,7 +71,20 @@ export function registerSessionArtifactAssociationRoutes(app: Hono, deps: ApiRou
           const linked =
             kind === "editable"
               ? await hasEditableArtifactSessionLink(deps.db, scope, sessionId, artifactId)
-              : await hasWorkspaceArtifactSessionLink(deps.db, workspaceId, sessionId, artifactId);
+              : kind === "retained"
+                ? await hasRetainedArtifactSessionLink(
+                    deps,
+                    authorization,
+                    workspaceId,
+                    sessionId,
+                    artifactId.toLowerCase(),
+                  )
+                : await hasWorkspaceArtifactSessionLink(
+                    deps.db,
+                    workspaceId,
+                    sessionId,
+                    artifactId,
+                  );
           if (!linked) throw new HTTPException(404, { message: "Artifact association not found" });
           if (kind === "editable") {
             const decision = await withRlsContext(deps.db, scope, (tx) =>
@@ -85,3 +114,48 @@ export function registerSessionArtifactAssociationRoutes(app: Hono, deps: ApiRou
     },
   );
 }
+
+/**
+ * Whether a retained artifact originated in this exact session: a generated
+ * image or video the session produced, or a sandbox file it published. Never
+ * inferred from an artifact id appearing in a message.
+ */
+async function hasRetainedArtifactSessionLink(
+  deps: ApiRouteDeps,
+  authorization: Awaited<ReturnType<typeof requireAccessGrantAuthorization>>,
+  workspaceId: string,
+  sessionId: string,
+  artifactId: string,
+): Promise<boolean> {
+  const image = await getGeneratedImageArtifact(deps.db, workspaceId, artifactId);
+  if (image) return image.sessionId === sessionId;
+  const video = await getGeneratedVideoArtifact(deps.db, workspaceId, artifactId);
+  if (video) return !video.artifact.deletedAt && video.artifact.sessionId === sessionId;
+  const file = await getRetainedFileArtifact(deps.db, workspaceId, artifactId);
+  if (!file) return false;
+  // Publication receipts are private; the bounded catalog seam filters them
+  // by source session and this file's name, then the exact id must match.
+  const grant = authorization.grant;
+  const actor = await fileOwnerContextForAccess(deps, authorization, "files:read");
+  const candidates = await withSessionRlsActorContext(actor, () =>
+    listArtifactCatalogCandidates(
+      deps.db,
+      { accountId: grant.accountId, workspaceId },
+      {
+        query: {
+          sourceSessionId: sessionId,
+          q: file.file.filename.slice(0, 200),
+          sort: "newest",
+          status: "active",
+          limit: 100,
+        },
+        kinds: ["file", "image"],
+        snapshotAt: new Date().toISOString(),
+        limit: 201,
+      },
+    ),
+  );
+  return candidates.some(
+    (candidate) => candidate.origin === "sandbox_file" && candidate.id === artifactId,
+  );
+}