@opengeni/api-router 2.1.0-canary.0 → 2.2.0-canary.0

package/src/integrations/slack-routing.ts

@@ -175,11 +175,24 @@ function labelFor(
  * override beats configuration beats derivation beats asking.
  */
 export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteResolution {
+  // A personal workspace is only ever a destination for that person's own bot
+  // DM. Offering it in a channel would be wrong twice over: routing a shared
+  // conversation into one member's private space hides it from everyone else
+  // in the channel, and - because managed tenancy provisions a personal
+  // workspace for every member - counting it as a candidate means nobody ever
+  // has exactly one. That defeats the sole-candidate rule below, so an
+  // organization with a single shared workspace would be asked to choose in
+  // every channel despite having no choice to make.
+  const directMessage = isSlackDirectMessageConversation(input.entry);
+  const candidates = directMessage
+    ? input.candidates
+    : input.candidates.filter((candidate) => !candidate.personal);
+
   const installation = {
     kind: "resolved" as const,
     accountId: input.home.accountId,
     workspaceId: input.home.workspaceId,
-    label: labelFor(input.candidates, input.home.workspaceId),
+    label: labelFor(candidates, input.home.workspaceId),
     source: "installation" as const,
   };
 
@@ -206,7 +219,7 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
       kind: "resolved",
       accountId: input.threadTenancy.accountId,
       workspaceId: input.threadTenancy.workspaceId,
-      label: labelFor(input.candidates, input.threadTenancy.workspaceId),
+      label: labelFor(candidates, input.threadTenancy.workspaceId),
       source: "thread",
     };
   }
@@ -221,13 +234,13 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
     ? parseSlackWorkspacePrefix(splitSlackLeadingMention(input.entry.text, input.botUserId).rest)
     : null;
   if (prefix) {
-    const named = matchCandidate(input.candidates, prefix.requested);
+    const named = matchCandidate(candidates, prefix.requested);
     if (named === "ambiguous" || !named) {
       return {
         kind: "denied",
         reason: "no_access_to_named",
         requested: prefix.requested,
-        candidates: input.candidates,
+        candidates: candidates,
       };
     }
     return {
@@ -245,7 +258,7 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
       kind: "resolved",
       accountId: input.channelRoute.targetAccountId,
       workspaceId: input.channelRoute.targetWorkspaceId,
-      label: labelFor(input.candidates, input.channelRoute.targetWorkspaceId),
+      label: labelFor(candidates, input.channelRoute.targetWorkspaceId),
       source: "channel",
     };
   }
@@ -254,13 +267,13 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
   //    lands in their own workspace unless they chose otherwise. The personal
   //    workspace id is DERIVED from an active organization membership pointer;
   //    it is never accepted from a Slack payload or a route row.
-  if (isSlackDirectMessageConversation(input.entry)) {
+  if (directMessage) {
     if (input.dmRoute) {
       return {
         kind: "resolved",
         accountId: input.dmRoute.targetAccountId,
         workspaceId: input.dmRoute.targetWorkspaceId,
-        label: labelFor(input.candidates, input.dmRoute.targetWorkspaceId),
+        label: labelFor(candidates, input.dmRoute.targetWorkspaceId),
         source: "dm_route",
       };
     }
@@ -269,7 +282,7 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
         kind: "resolved",
         accountId: input.home.accountId,
         workspaceId: input.personalWorkspaceId,
-        label: labelFor(input.candidates, input.personalWorkspaceId),
+        label: labelFor(candidates, input.personalWorkspaceId),
         source: "dm_personal",
       };
     }
@@ -280,8 +293,8 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
 
   // 5. One workspace is not a choice. This is what keeps the flag quiet for
   //    installs that only ever had one workspace.
-  const sole = input.candidates[0];
-  if (input.candidates.length === 1 && sole) {
+  const sole = candidates[0];
+  if (candidates.length === 1 && sole) {
     return {
       kind: "resolved",
       accountId: sole.accountId,
@@ -291,13 +304,13 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
     };
   }
 
-  if (input.candidates.length === 0) {
+  if (candidates.length === 0) {
     return { kind: "denied", reason: "no_candidates", requested: null, candidates: [] };
   }
 
   // 6. Genuinely ambiguous. Until the picker exists, keep the installation's
   //    workspace rather than inventing an answer.
-  return input.askEnabled ? { kind: "ask", candidates: input.candidates } : installation;
+  return input.askEnabled ? { kind: "ask", candidates: candidates } : installation;
 }
 
 /**

package/src/routes/documents.ts

@@ -7,6 +7,8 @@ import {
   DocumentAuthorityReclassification,
   DocumentBase,
   DocumentDefaultCollectionBackfill,
+  DocumentDefaultCollectionBackfillAudit,
+  GetDocumentDefaultCollectionBackfillAuditQuery,
   DocumentSearchRequest,
   DocumentSearchResponse,
   FileAsset,
@@ -15,6 +17,9 @@ import {
   KnowledgeMemorySearchRequest,
   ListDocumentAuthorityReclassificationsQuery,
   ListDocumentAuthorityReclassificationsResponse,
+  ListDocumentDefaultCollectionBackfillRunsResponse,
+  ListDocumentMigrationAuditQuery,
+  ListOrganizationDocumentAuthorityReclassificationsResponse,
   MoveDocumentRequest,
   ReclassifyDocumentAuthorityRequest,
   RunDocumentDefaultCollectionBackfillRequest,
@@ -40,10 +45,13 @@ import {
   getDocument,
   getDocumentOriginalFile,
   getDocumentBase,
+  getDocumentDefaultCollectionBackfillAudit,
   listAccessibleDocuments,
   listDocumentAuthorityReclassifications,
+  listDocumentDefaultCollectionBackfillRuns,
   listDocumentBasesEnsuringDefault,
   listDocuments,
+  listOrganizationDocumentAuthorityReclassifications,
   moveDocumentToBase,
   queueDocumentForReindex,
   reclassifyDocumentAuthority,
@@ -132,6 +140,106 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
   });
 
+  app.get("/v1/workspaces/:workspaceId/document-default-collection-backfills", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "documents:manage",
+    );
+    if (!hasAccountAdminAuthority(authorization)) {
+      throw new HTTPException(403, { message: "missing permission: account:admin" });
+    }
+    const query = ListDocumentMigrationAuditQuery.safeParse(c.req.query());
+    if (!query.success) {
+      throw new HTTPException(400, { message: "invalid document migration audit query" });
+    }
+    try {
+      return c.json(
+        ListDocumentDefaultCollectionBackfillRunsResponse.parse(
+          await listDocumentDefaultCollectionBackfillRuns(db, {
+            accountId: authorization.grant.accountId,
+            workspaceId,
+            actorSubjectId: authorization.grant.subjectId,
+            accountAdminAuthorization: requireAccountAdminAuthorizationStamp(authorization),
+            ...query.data,
+          }),
+        ),
+      );
+    } catch (error) {
+      throw documentHttpException(error);
+    }
+  });
+
+  app.get("/v1/workspaces/:workspaceId/document-default-collection-backfills/:runId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "documents:manage",
+    );
+    if (!hasAccountAdminAuthority(authorization)) {
+      throw new HTTPException(403, { message: "missing permission: account:admin" });
+    }
+    const runId = RunDocumentDefaultCollectionBackfillRequest.shape.runId.safeParse(
+      c.req.param("runId"),
+    );
+    const query = GetDocumentDefaultCollectionBackfillAuditQuery.safeParse(c.req.query());
+    if (!runId.success || !query.success) {
+      throw new HTTPException(400, { message: "invalid document migration audit query" });
+    }
+    try {
+      return c.json(
+        DocumentDefaultCollectionBackfillAudit.parse(
+          await getDocumentDefaultCollectionBackfillAudit(db, {
+            accountId: authorization.grant.accountId,
+            workspaceId,
+            actorSubjectId: authorization.grant.subjectId,
+            accountAdminAuthorization: requireAccountAdminAuthorizationStamp(authorization),
+            runId: runId.data,
+            ...query.data,
+          }),
+        ),
+      );
+    } catch (error) {
+      throw documentHttpException(error);
+    }
+  });
+
+  app.get("/v1/workspaces/:workspaceId/document-authority-reclassifications", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "documents:manage",
+    );
+    if (!hasAccountAdminAuthority(authorization)) {
+      throw new HTTPException(403, { message: "missing permission: account:admin" });
+    }
+    const query = ListDocumentMigrationAuditQuery.safeParse(c.req.query());
+    if (!query.success) {
+      throw new HTTPException(400, { message: "invalid document migration audit query" });
+    }
+    try {
+      return c.json(
+        ListOrganizationDocumentAuthorityReclassificationsResponse.parse(
+          await listOrganizationDocumentAuthorityReclassifications(db, {
+            accountId: authorization.grant.accountId,
+            workspaceId,
+            actorSubjectId: authorization.grant.subjectId,
+            accountAdminAuthorization: requireAccountAdminAuthorizationStamp(authorization),
+            ...query.data,
+          }),
+        ),
+      );
+    } catch (error) {
+      throw documentHttpException(error);
+    }
+  });
+
   app.post("/v1/workspaces/:workspaceId/document-bases/:baseId/documents", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "documents:manage");
@@ -879,13 +987,16 @@ function dropFilename(preferred: string | undefined): string {
 }
 
 function documentHttpException(error: unknown): HTTPException {
-  const message = error instanceof Error ? error.message : String(error);
+  const message = documentDomainErrorMessage(error);
   if (message.includes("organization document") && message.includes("exact account authority")) {
     return new HTTPException(403, { message: "missing permission: account:admin" });
   }
   if (message.includes("not found")) {
     return new HTTPException(404, { message });
   }
+  if (message.includes("document Default collection backfill audit run is unavailable")) {
+    return new HTTPException(404, { message });
+  }
   if (message.includes("already exists")) {
     return new HTTPException(409, { message });
   }
@@ -898,7 +1009,9 @@ function documentHttpException(error: unknown): HTTPException {
   }
   if (
     message.includes("reclassification requires") ||
-    message.includes("backfill requires organization administration")
+    message.includes("backfill requires organization administration") ||
+    message.includes("document migration audit requires organization administration") ||
+    message.includes("document migration audit scope is invalid")
   ) {
     return new HTTPException(403, { message });
   }
@@ -906,7 +1019,12 @@ function documentHttpException(error: unknown): HTTPException {
     message.includes("reclassification input is invalid") ||
     message.includes("reclassification authority is invalid") ||
     message.includes("invalid document authority receipt cursor") ||
-    message.includes("document authority receipt limit")
+    message.includes("document authority receipt limit") ||
+    message.includes("invalid document migration audit cursor") ||
+    message.includes("document migration audit cursor is invalid") ||
+    message.includes("document migration audit limit") ||
+    message.includes("document migration audit authority is incomplete") ||
+    message.includes("document Default collection backfill audit run id is required")
   ) {
     return new HTTPException(400, { message });
   }
@@ -929,6 +1047,19 @@ function documentHttpException(error: unknown): HTTPException {
   return new HTTPException(500, { message });
 }
 
+function documentDomainErrorMessage(error: unknown): string {
+  let current: unknown = error;
+  let message = error instanceof Error ? error.message : String(error);
+  const seen = new Set<unknown>();
+  while (current && typeof current === "object" && !seen.has(current) && seen.size < 8) {
+    seen.add(current);
+    const record = current as { cause?: unknown; message?: unknown };
+    if (typeof record.message === "string") message = record.message;
+    current = record.cause;
+  }
+  return message;
+}
+
 function hasAccountAdminAuthority(
   authorization: Awaited<ReturnType<typeof requireAccessGrantAuthorization>>,
 ): boolean {