@opengeni/api-router 2.10.0-canary.3 → 2.10.0-canary.5

package/dist/app.js

@@ -24,7 +24,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-CZGPIPDA.js";
+} from "./chunk-NWSVDE7O.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,

package/dist/{chunk-CZGPIPDA.js → chunk-NWSVDE7O.js}

@@ -27892,7 +27892,7 @@ function registerCodexRoutes(app, deps) {
         accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
-        mode: sourceBeforeConnect.workspaceKind === "personal" ? "automatic" : "workspace",
+        mode: "workspace",
         effectiveSourceBeforeMutation: sourceBeforeConnect.effectiveSource
       });
       const rotation = await getCodexRotationSettings(tx, workspaceId);
@@ -57013,6 +57013,7 @@ import {
   hasPermission as hasPermission20,
   requireAccessContext as requireAccessContext3,
   requireAccessGrant as requireAccessGrant32,
+  requireWorkspaceSettingsGrant,
   requireFreshAccessGrant as requireFreshAccessGrant3,
   resolveWorkspaceCatalogSettings as resolveWorkspaceCatalogSettings7
 } from "@opengeni/core";
@@ -57361,7 +57362,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.patch("/v1/workspaces/:workspaceId/settings", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const parsed = UpdateWorkspaceSettingsRequest.safeParse(await c.req.json());
     if (!parsed.success) {
       throw new HTTPException60(400, {
@@ -57461,7 +57462,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/gateway-custom-models", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const parsed = CreateWorkspaceGatewayCustomModelRequest.safeParse(
       await c.req.json().catch(() => null)
     );
@@ -57533,7 +57534,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/gateway-custom-models/:customModelId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const customModelId = c.req.param("customModelId");
     if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
       customModelId
@@ -57590,7 +57591,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/openrouter-custom-models", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const parsed = CreateWorkspaceOpenRouterCustomModelRequest.safeParse(
       await c.req.json().catch(() => null)
     );
@@ -57662,7 +57663,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/openrouter-custom-models/:customModelId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const customModelId = c.req.param("customModelId");
     if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
       customModelId
@@ -57766,7 +57767,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.put("/v1/workspaces/:workspaceId/model-policy", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const payload = UpdateWorkspaceModelPolicyRequest.parse(await c.req.json());
     const catalog = await resolveWorkspaceCatalogSettings7(deps.db, deps.settings, {
       accountId: grant.accountId,
@@ -57782,7 +57783,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/pause-timer", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     if (workspaceControlUtf8Bytes2(grant.subjectId) > WORKSPACE_CONTROL_ACTOR_MAX_BYTES2) {
       throw new HTTPException60(400, { message: "workspace-control actor is too large" });
     }
@@ -57812,7 +57813,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/inference-control", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     if (workspaceControlUtf8Bytes2(grant.subjectId) > WORKSPACE_CONTROL_ACTOR_MAX_BYTES2) {
       throw new HTTPException60(400, {
         message: "workspace-control actor is too large"
@@ -58455,7 +58456,8 @@ import {
 } from "@opengeni/contracts";
 import {
   publishGovernedLearningEventToSlack,
-  requireAccessGrant as requireAccessGrant34
+  requireAccessGrant as requireAccessGrant34,
+  requireWorkspaceSettingsGrant as requireWorkspaceSettingsGrant2
 } from "@opengeni/core";
 import {
   activateWorkspaceLearningPolicyRevision,
@@ -58548,7 +58550,7 @@ function registerWorkspaceLearningRoutes(app, deps) {
   });
   app.post(`${base}/revisions`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant34(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant2(context, deps, workspaceId);
     const request = await parseBody2(context, CreateWorkspaceLearningPolicyRevisionRequest);
     try {
       return context.json(
@@ -58574,7 +58576,7 @@ function registerWorkspaceLearningRoutes(app, deps) {
     const workspaceId = context.req.param("workspaceId");
     const revisionId2 = z18.string().uuid().safeParse(context.req.param("revisionId"));
     if (!revisionId2.success) throw new HTTPException62(422, { message: "Invalid revision id" });
-    const grant = await requireAccessGrant34(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant2(context, deps, workspaceId);
     const request = await parseBody2(context, ActivateWorkspaceLearningPolicyRevisionRequest);
     try {
       return context.json(
@@ -58598,7 +58600,7 @@ function registerWorkspaceLearningRoutes(app, deps) {
   });
   app.post(`${base}/rollback`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant34(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant2(context, deps, workspaceId);
     const request = await parseBody2(context, RollbackWorkspaceLearningPolicyRevisionRequest);
     try {
       return context.json(
@@ -58626,7 +58628,7 @@ function registerWorkspaceLearningRoutes(app, deps) {
     if (!activationReceiptId.success) {
       throw new HTTPException62(422, { message: "Invalid activation receipt id" });
     }
-    const grant = await requireAccessGrant34(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant2(context, deps, workspaceId);
     const request = await parseBody2(context, UndoGovernedLearningActivationHttpRequest);
     try {
       const undo = await undoGovernedLearningActivation(deps.db, {
@@ -60221,7 +60223,9 @@ function registerWorkspaceArtifactRoutes(app, deps) {
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant39(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
-      throw new HTTPException67(503, { message: "Object storage is not configured" });
+      throw new HTTPException67(503, {
+        message: "Object storage is not configured"
+      });
     const ref = await getWorkspaceArtifactContentRef2(
       deps.db,
       workspaceId,
@@ -60232,13 +60236,17 @@ function registerWorkspaceArtifactRoutes(app, deps) {
   });
   app.get(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    await requireAccessGrant39(context, deps, workspaceId, "artifacts:read");
+    const grant = await requireAccessGrant39(context, deps, workspaceId, "artifacts:read");
     const query = WorkspaceArtifactListQuery.safeParse({
       limit: context.req.query("limit"),
       cursor: context.req.query("cursor"),
-      status: context.req.query("status")
+      status: context.req.query("status"),
+      sourceSessionId: context.req.query("sourceSessionId")
     });
     if (!query.success) throw new HTTPException67(422, { message: "Invalid artifact list query" });
+    if (query.data.sourceSessionId && !await canReadProvenanceSession(deps, grant, query.data.sourceSessionId)) {
+      throw new HTTPException67(404, { message: "Session not found" });
+    }
     try {
       return context.json(
         WorkspaceArtifactListResponse.parse(
@@ -60246,7 +60254,8 @@ function registerWorkspaceArtifactRoutes(app, deps) {
             await listWorkspaceArtifacts2(deps.db, workspaceId, {
               limit: query.data.limit,
               ...query.data.cursor ? { cursor: query.data.cursor } : {},
-              ...query.data.status ? { status: query.data.status } : {}
+              ...query.data.status ? { status: query.data.status } : {},
+              ...query.data.sourceSessionId ? { sourceSessionId: query.data.sourceSessionId } : {}
             })
           )
         )
@@ -60318,7 +60327,9 @@ function registerWorkspaceArtifactRoutes(app, deps) {
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant39(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
-      throw new HTTPException67(503, { message: "Object storage is not configured" });
+      throw new HTTPException67(503, {
+        message: "Object storage is not configured"
+      });
     const ref = await getWorkspaceArtifactContentRef2(
       deps.db,
       workspaceId,
@@ -62030,6 +62041,7 @@ import {
 } from "@opengeni/db";
 import {
   requireAccessGrant as requireAccessGrant44,
+  requireWorkspaceSettingsGrant as requireWorkspaceSettingsGrant3,
   VIDEO_GENERATION_MODEL_CATALOG,
   videoGenerationModelSupportsFundingSource,
   videoGenerationCapabilitiesForPolicy
@@ -62066,7 +62078,7 @@ function registerVideoGenerationRoutes(app, deps) {
   });
   app.put("/v1/workspaces/:workspaceId/video-generation/policy", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant44(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant3(c, deps, workspaceId);
     const payload = UpdateVideoGenerationPolicyRequest.parse(await c.req.json());
     const [connection, supergrokConfigured] = await Promise.all([
       getWorkspaceVercelAiGatewayConnectionMetadata(deps.db, workspaceId),
@@ -71890,4 +71902,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-CZGPIPDA.js.map
+//# sourceMappingURL=chunk-NWSVDE7O.js.map