@opengeni/api-router 2.11.3 → 2.12.3-canary.0

package/src/routes/documents.ts

@@ -1006,9 +1006,9 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
       // (migration 0427); a missing row resolves to no Memory tools.
       const memory =
         sessionId !== undefined
-          ? ((await resolveSessionMemoryAgentScope(db, workspaceId, sessionId)) ?? {
+          ? ((await resolveSessionMemoryAgentScope(db, workspaceId, sessionId, grant.metadata)) ?? {
               mode: "off" as const,
-              endUserSubjectId: null,
+              userSubjectId: null,
               rootSessionId: null,
             })
           : null;

package/src/routes/external-identity-links.ts

@@ -0,0 +1,200 @@
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+import {
+  BeginExternalIdentityLinkRequest,
+  ConfirmExternalIdentityLinkRequest,
+} from "@opengeni/contracts/external-identities";
+import {
+  beginExternalIdentityLink,
+  confirmExternalIdentityLink,
+  getExternalIdentityLink,
+  listExternalIdentityLinks,
+  previewExternalIdentityLink,
+  revokeExternalIdentityLink,
+  ensureExternalIdentity,
+  ExternalIdentityLinkConflictError,
+  withWorkspaceSubjectRls,
+  lockExternalWorkspaceMembershipLifecycle,
+  getWorkspaceGrant,
+  namedSubjectPersonalWorkspaceId,
+  managedPersonalWorkspacePermissions,
+} from "@opengeni/db";
+import {
+  requireAccessGrantAuthorization,
+  externalActorContinuationForAuthorization,
+  externalContinuationCommitAuthorizer,
+  hasPermission,
+  type AccessGrantAuthorization,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+
+function nativeConfirmation(authorization: AccessGrantAuthorization) {
+  if (
+    !authorization.contextIntegrity ||
+    !authorization.canonicalManagedHumanSession ||
+    authorization.authenticatedSubjectId !== authorization.grant.subjectId ||
+    !authorization.grant.subjectId.startsWith("user:")
+  )
+    throw new HTTPException(403, { message: "Confirm using your authenticated OpenGeni account" });
+}
+
+/** Both products address the link through a workspace they already own. The
+ * link itself is organization-local; the host's Personal workspace need not be
+ * exposed to the native human, and neither side names the other's subject. */
+export function registerExternalIdentityLinkRoutes(app: Hono, deps: ApiRouteDeps) {
+  const base = "/v1/workspaces/:workspaceId/identity-links";
+  app.get(base, async (c) => {
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      c.req.param("workspaceId"),
+      "workspace:read",
+    );
+    if (!externalActorContinuationForAuthorization(authorization))
+      nativeConfirmation(authorization);
+    const parsedCursor = z.string().uuid().optional().safeParse(c.req.query("cursor"));
+    if (!parsedCursor.success) throw new HTTPException(400, { message: "Invalid link cursor" });
+    const cursor = parsedCursor.data;
+    const grant = authorization.grant;
+    return c.json(
+      await withWorkspaceSubjectRls(deps.db, grant.workspaceId, grant.subjectId, async (tx) => {
+        await externalContinuationCommitAuthorizer(authorization)?.(tx);
+        return listExternalIdentityLinks(tx, {
+          accountId: grant.accountId,
+          subjectId: grant.subjectId,
+          ...(cursor ? { cursor } : {}),
+        });
+      }),
+    );
+  });
+  app.post(base, async (c) => {
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      c.req.param("workspaceId"),
+      "workspace:read",
+    );
+    const continuation = externalActorContinuationForAuthorization(authorization);
+    if (!continuation || continuation.actor.actingMode !== "external")
+      throw new HTTPException(403, { message: "Start linking as the external product user" });
+    const input = BeginExternalIdentityLinkRequest.parse(await c.req.json());
+    if (input.expiresAt !== null && Date.parse(input.expiresAt) <= Date.now())
+      throw new HTTPException(422, { message: "Link expiry must be in the future" });
+    const commit = externalContinuationCommitAuthorizer(authorization)!;
+    try {
+      const result = await withWorkspaceSubjectRls(
+        deps.db,
+        authorization.grant.workspaceId,
+        authorization.grant.subjectId,
+        async (tx) => {
+          await commit(tx);
+          const identity = await ensureExternalIdentity(tx, {
+            accountId: authorization.grant.accountId,
+            ...continuation.identity,
+          });
+          return beginExternalIdentityLink(tx, identity, input);
+        },
+      );
+      return c.json(result, 201);
+    } catch (error) {
+      if (error instanceof ExternalIdentityLinkConflictError)
+        throw new HTTPException(409, { message: error.message });
+      throw error;
+    }
+  });
+  app.on(["GET", "POST"], [base + "/:linkId", base + "/:linkId/:operation"], async (c) => {
+    const workspaceId = c.req.param("workspaceId")!;
+    const linkId = z.string().uuid().parse(c.req.param("linkId"));
+    const operation = c.req.param("operation");
+    if (
+      !(
+        (c.req.method === "GET" && !operation) ||
+        (c.req.method === "POST" && ["preview", "confirm", "revoke"].includes(operation ?? ""))
+      )
+    )
+      throw new HTTPException(404, { message: "Not found" });
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "workspace:read",
+    );
+    const external = externalActorContinuationForAuthorization(authorization);
+    if (operation === "preview" || operation === "confirm" || !external)
+      nativeConfirmation(authorization);
+    const grant = authorization.grant;
+    const input = c.req.method === "POST" ? await c.req.json() : null;
+    try {
+      const result = await withWorkspaceSubjectRls(
+        deps.db,
+        workspaceId,
+        grant.subjectId,
+        async (tx) => {
+          await externalContinuationCommitAuthorizer(authorization)?.(tx);
+          if (operation === "preview") {
+            const request = z
+              .object({ challenge: ConfirmExternalIdentityLinkRequest.shape.challenge })
+              .strict()
+              .parse(input);
+            const preview = await previewExternalIdentityLink(tx, {
+              accountId: grant.accountId,
+              linkId,
+              ...request,
+            });
+            return preview
+              ? { ...preview, nativeSubjectId: grant.subjectId, organizationId: grant.accountId }
+              : null;
+          }
+          if (operation === "confirm") {
+            const request = ConfirmExternalIdentityLinkRequest.parse(input);
+            await lockExternalWorkspaceMembershipLifecycle(tx, grant.accountId);
+            const personalWorkspaceId = await namedSubjectPersonalWorkspaceId(tx, {
+              accountId: grant.accountId,
+              subjectId: grant.subjectId,
+            });
+            const current =
+              personalWorkspaceId === workspaceId
+                ? { accountId: grant.accountId, permissions: managedPersonalWorkspacePermissions }
+                : await getWorkspaceGrant(tx, grant.subjectId, workspaceId, {
+                    principalKind: "human_session",
+                  });
+            if (
+              !current ||
+              current.accountId !== grant.accountId ||
+              request.permissions.some(
+                (permission) =>
+                  !hasPermission(grant.permissions, permission) ||
+                  !hasPermission(current.permissions, permission),
+              )
+            )
+              throw new HTTPException(403, {
+                message: "Link permissions exceed your authority in this workspace",
+              });
+            return confirmExternalIdentityLink(tx, {
+              accountId: grant.accountId,
+              linkId,
+              nativeSubjectId: grant.subjectId,
+              request,
+            });
+          }
+          const scope = { accountId: grant.accountId, linkId, subjectId: grant.subjectId };
+          if (operation === "revoke") {
+            const request = z
+              .object({ expectedRevision: z.number().int().positive().safe() })
+              .strict()
+              .parse(input);
+            return revokeExternalIdentityLink(tx, { ...scope, ...request });
+          }
+          return getExternalIdentityLink(tx, scope);
+        },
+      );
+      if (!result) throw new HTTPException(404, { message: "Identity link not found or expired" });
+      return c.json(result);
+    } catch (error) {
+      if (error instanceof ExternalIdentityLinkConflictError)
+        throw new HTTPException(409, { message: error.message });
+      throw error;
+    }
+  });
+}

package/src/routes/github.ts

@@ -5,7 +5,6 @@ import {
   UpdateGitHubActionPolicyRequest,
   type AccessGrant,
   type GitHubInstallationBindingCandidate,
-  type GitHubInstallationBindingProof,
 } from "@opengeni/contracts";
 import { PersonalGitHubConnectionMetadata } from "@opengeni/contracts/personal-github";
 import {
@@ -50,6 +49,7 @@ import {
   personalGitHubActionPolicyActor,
   requireAccessGrant,
   requireAccessGrantAuthorization,
+  externalActorContinuationForAuthorization,
   updateGitHubActionPolicyGroup,
 } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
@@ -67,8 +67,19 @@ import {
   listWorkspaceGitHubRepositoryBranches,
   listWorkspaceGitHubRepositories,
 } from "../github-access";
-import { assertPersonalConnectionOwnerPrincipal } from "../connection-ownership";
+import {
+  assertPersonalConnectionOwnerPrincipal,
+  requireLegacyOAuthActor,
+} from "../connection-ownership";
 import { listPersonalGitHubConnections } from "../integrations/personal-github";
+import {
+  isConsistentGitHubBindingCandidates,
+  isConsistentGitHubBindingProof,
+} from "../integrations/github-installation-proof";
+import {
+  completeGitHubAppConnect,
+  isGitHubAppConnectState,
+} from "../integrations/github-app-connect";
 
 const githubStateCookie = "opengeni_github_state";
 const githubBindingStateMaxAgeSeconds = 10 * 60;
@@ -79,7 +90,8 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/github/app", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "github:use");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "github:use");
+    const grant = access.grant;
     const missing = githubAppMissingSettings(settings);
     const slug = settings.githubAppSlug?.trim() || null;
     const installations =
@@ -88,7 +100,9 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
         : [];
     const status = githubBindingStatus(missing.length === 0, installations);
     const setupMode = settings.productAccessMode === "managed" ? "platform" : "operator";
-    const canManage = hasPermission(grant.permissions, "github:manage");
+    const canManage =
+      !externalActorContinuationForAuthorization(access) &&
+      hasPermission(grant.permissions, "github:manage");
     const returnPath = githubSessionReturnPath(c.req.query("returnPath"), grant.workspaceId);
     const connectState =
       missing.length === 0 && slug && canManage
@@ -414,7 +428,9 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/github/app-manifest", async (c) => {
     assertOperatorGitHubAppSetup(settings);
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "github:manage");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "github:manage");
+    requireLegacyOAuthActor(access);
+    const grant = access.grant;
     const payload = GitHubAppManifestCreate.parse(await c.req.json());
     const baseUrl = (settings.githubAppManifestBaseUrl ?? new URL(c.req.url).origin).replace(
       /\/+$/,
@@ -465,6 +481,14 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 
   const handleGitHubInstallCallback = async (c: Context) => {
+    if (isGitHubAppConnectState(deps, c.req.query("state")))
+      return completeGitHubAppConnect(deps, {
+        state: c.req.query("state"),
+        installationId: c.req.query("installation_id"),
+        setupAction: c.req.query("setup_action"),
+        error: c.req.query("error"),
+        requestUrl: c.req.url,
+      });
     const state =
       c.req.query("state") ??
       allCookieValues(c, githubStateCookie).find((candidate) => {
@@ -542,6 +566,13 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/github/install/callback", handleGitHubInstallCallback);
 
   app.get("/v1/github/oauth/callback", async (c) => {
+    if (isGitHubAppConnectState(deps, c.req.query("state")))
+      return completeGitHubAppConnect(deps, {
+        state: c.req.query("state"),
+        code: c.req.query("code"),
+        error: c.req.query("error"),
+        requestUrl: c.req.url,
+      });
     const code = c.req.query("code");
     const state = c.req.query("state");
     if (!code) {
@@ -884,7 +915,9 @@ async function requireGitHubManageGrant(
   expectedState: GitHubSignedStatePayload,
 ): Promise<AccessGrant> {
   try {
-    return await requireAccessGrant(c, deps, workspaceId, "github:manage");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "github:manage");
+    requireLegacyOAuthActor(access);
+    return access.grant;
   } catch (error) {
     if (!(error instanceof HTTPException) || error.status !== 401) {
       throw error;
@@ -1022,29 +1055,6 @@ function githubSetupPendingHtml(): string {
   return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>GitHub App Requested</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:8px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px;line-height:1.2}p{margin:0;color:#d4d4d8}</style></head><body><main><h1>GitHub App request sent</h1><p>A GitHub organization owner must approve the installation. OpenGeni has not created a workspace binding.</p></main></body></html>`;
 }
 
-function isConsistentGitHubBindingCandidates(
-  candidates: GitHubInstallationBindingCandidate[],
-): boolean {
-  const ids = new Set<number>();
-  return candidates.every(({ installation, authorityKind }) => {
-    if (
-      !Number.isSafeInteger(installation.installationId) ||
-      installation.installationId <= 0 ||
-      !Number.isSafeInteger(installation.accountId) ||
-      installation.accountId <= 0 ||
-      !installation.accountLogin?.trim() ||
-      installation.suspended ||
-      ids.has(installation.installationId)
-    ) {
-      return false;
-    }
-    ids.add(installation.installationId);
-    return authorityKind === "personal_owner"
-      ? installation.accountType === "User"
-      : installation.accountType === "Organization";
-  });
-}
-
 function parsePositiveInteger(value: string | undefined | null): number | null {
   if (!value || !/^\d+$/.test(value)) {
     return null;
@@ -1058,41 +1068,6 @@ function isFreshGitHubBindingState(payload: GitHubSignedStatePayload): boolean {
   return age >= 0 && age < githubBindingStateMaxAgeSeconds;
 }
 
-function isConsistentGitHubBindingProof(
-  proof: GitHubInstallationBindingProof,
-  installationId: number,
-): boolean {
-  const installation = proof.installation;
-  if (
-    installation.installationId !== installationId ||
-    !Number.isSafeInteger(installation.accountId) ||
-    installation.accountId <= 0 ||
-    !installation.accountLogin?.trim() ||
-    installation.suspended ||
-    !Number.isSafeInteger(proof.actorId) ||
-    proof.actorId <= 0 ||
-    !proof.actorLogin.trim() ||
-    proof.repositories.length === 0
-  ) {
-    return false;
-  }
-  if (
-    proof.authorityKind === "personal_owner"
-      ? installation.accountType !== "User" || proof.actorId !== installation.accountId
-      : installation.accountType !== "Organization"
-  ) {
-    return false;
-  }
-  return proof.repositories.every(
-    (repository) =>
-      Number.isSafeInteger(repository.id) &&
-      repository.id > 0 &&
-      repository.installationId === installationId &&
-      repository.accountLogin === installation.accountLogin &&
-      repository.accountType === installation.accountType,
-  );
-}
-
 function escapeHtml(value: string): string {
   return value.replace(
     /[&<>"']/g,

package/src/routes/host-mcp-bindings.ts

@@ -0,0 +1,122 @@
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+import {
+  CreateHostMcpBindingRequest,
+  IssueHostMcpDelegationRequest,
+} from "@opengeni/contracts/host-mcp-bindings";
+import {
+  createHostMcpBinding,
+  getHostMcpBinding,
+  revokeHostMcpBinding,
+  issueHostMcpDelegation,
+  getHostMcpDelegation,
+  revokeHostMcpDelegation,
+  HostMcpDelegationAuthorityError,
+  HostMcpBindingConflictError,
+  withWorkspaceSubjectRls,
+} from "@opengeni/db";
+import {
+  requireAccessGrantAuthorization,
+  prepareHostMcpOwnerAuthorization,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+
+/** Registration is not an execution grant. The durable runtime must separately
+ * validate the exact binding generation and accepted execution context. */
+export function registerHostMcpBindingRoutes(app: Hono, deps: ApiRouteDeps): void {
+  for (const entity of ["bindings", "delegations"] as const) {
+    app.on(
+      ["GET", "POST"],
+      [
+        `/v1/workspaces/:workspaceId/host-mcp-${entity}`,
+        `/v1/workspaces/:workspaceId/host-mcp-${entity}/:bindingId`,
+        `/v1/workspaces/:workspaceId/host-mcp-${entity}/:bindingId/revoke`,
+      ],
+      async (c) => {
+        const workspaceId = c.req.param("workspaceId")!;
+        const bindingId = c.req.param("bindingId");
+        const method = c.req.method;
+        const revoke = c.req.path.endsWith("/revoke");
+        if (
+          !(
+            (method === "POST" && !bindingId) ||
+            (method === "GET" && bindingId && !revoke) ||
+            (method === "POST" && bindingId && revoke)
+          )
+        )
+          throw new HTTPException(404, { message: "not found" });
+        const permission = method === "GET" ? "connections:read" : "connections:write";
+        const authorization = await requireAccessGrantAuthorization(
+          c,
+          deps,
+          workspaceId,
+          permission,
+        );
+        const authorizeCommit = prepareHostMcpOwnerAuthorization(
+          authorization,
+          workspaceId,
+          permission,
+        );
+        if (bindingId) z.string().uuid().parse(bindingId);
+        const createInput =
+          method === "POST" && !bindingId
+            ? (entity === "bindings"
+                ? CreateHostMcpBindingRequest
+                : IssueHostMcpDelegationRequest
+              ).parse(await c.req.json())
+            : null;
+        const revokeInput = revoke
+          ? z
+              .object({ expectedGeneration: z.number().int().positive().safe() })
+              .strict()
+              .parse(await c.req.json())
+          : null;
+        const owner = {
+          accountId: authorization.grant.accountId,
+          workspaceId,
+          subjectId: authorization.grant.subjectId,
+        };
+        try {
+          const result = await withWorkspaceSubjectRls(
+            deps.db,
+            workspaceId,
+            owner.subjectId,
+            async (tx) => {
+              const effectiveOwner = await authorizeCommit(tx);
+              if (createInput)
+                return entity === "bindings"
+                  ? createHostMcpBinding(tx, effectiveOwner, createInput)
+                  : issueHostMcpDelegation(tx, effectiveOwner, createInput);
+              const existing = await (
+                entity === "bindings" ? getHostMcpBinding : getHostMcpDelegation
+              )(tx, effectiveOwner, bindingId!);
+              if (!existing)
+                throw new HTTPException(404, {
+                  message:
+                    entity === "bindings" ? "Host binding not found" : "Host delegation not found",
+                });
+              return revokeInput
+                ? (entity === "bindings" ? revokeHostMcpBinding : revokeHostMcpDelegation)(
+                    tx,
+                    effectiveOwner,
+                    bindingId!,
+                    revokeInput.expectedGeneration,
+                  )
+                : existing;
+            },
+          );
+          return c.json(result, createInput ? 201 : 200);
+        } catch (error) {
+          if (error instanceof HostMcpDelegationAuthorityError)
+            throw new HTTPException(403, { message: "Host delegation authority unavailable" });
+          if (error instanceof HostMcpBindingConflictError)
+            throw new HTTPException(409, {
+              message: "Host binding changed; reload before retrying",
+            });
+          throw error;
+        }
+      },
+    );
+  }
+}

package/src/routes/organization-memberships.ts

@@ -36,6 +36,7 @@ import {
   getManagedSession,
   organizationMembershipHttpStatus,
   requireCanonicalLocalAccountAdministrator,
+  updateExternalIdentityMembershipForRequest,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import {
@@ -164,6 +165,28 @@ function rethrowMembershipError(error: unknown, resourceLimitMessage?: string):
 }
 
 export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDeps): void {
+  app.patch("/v1/organizations/:organizationId/external-members/:membershipId", async (context) => {
+    const organizationId = parseId(
+      OrganizationId,
+      context.req.param("organizationId"),
+      "organization id",
+    );
+    const membershipId = parseId(MembershipId, context.req.param("membershipId"), "membership id");
+    try {
+      return context.json(
+        await updateExternalIdentityMembershipForRequest(
+          context,
+          deps,
+          organizationId,
+          membershipId,
+          await context.req.json().catch(() => null),
+        ),
+      );
+    } catch (error) {
+      if (error instanceof HTTPException) throw error;
+      rethrowMembershipError(error);
+    }
+  });
   app.post("/v1/organizations", async (context) => {
     const { session, subjectId } = await requireManagedHuman(context, deps);
     const payload = await parseBody(context, CreateOrganizationRequest);

package/src/routes/organization-sessions.ts

@@ -294,8 +294,8 @@ async function listWorkspaceSessionPage(
         limit,
         materializeSnapshot: true,
         ...(cursor ? { cursor } : {}),
-        ...(input.query.endUserSource !== undefined && input.query.endUserId !== undefined
-          ? { endUser: { source: input.query.endUserSource, id: input.query.endUserId } }
+        ...(input.query.scopeSubjectId !== undefined
+          ? { scopeSubjectId: input.query.scopeSubjectId }
           : {}),
         ...(authorizationScope ? { authorizationScope } : {}),
         personalWorkspaceOwnerException: authorization.canonicalManagedHumanSession,

package/src/routes/personal-github.ts

@@ -28,7 +28,10 @@ import {
   type PersonalGitHubRepositorySelectionState as DbPersonalGitHubRepositorySelectionState,
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
-import { assertPersonalConnectionOwnerPrincipal } from "../connection-ownership";
+import {
+  assertPersonalConnectionOwnerPrincipal,
+  requireLegacyOAuthActor,
+} from "../connection-ownership";
 import {
   completePersonalGitHubOAuthCallback,
   listPersonalGitHubConnections,
@@ -64,6 +67,7 @@ export function registerPersonalGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
   app.post("/v1/workspaces/:workspaceId/connections/github/oauth/start", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "connections:write");
+    requireLegacyOAuthActor(access);
     assertPersonalConnectionOwnerPrincipal(access, "My GitHub account");
     const payload = PersonalGitHubOAuthStartRequest.parse(await c.req.json().catch(() => ({})));
     return c.json(
@@ -79,6 +83,7 @@ export function registerPersonalGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
   app.post("/v1/workspaces/:workspaceId/connections/:connectionId/github/reconnect", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "connections:write");
+    requireLegacyOAuthActor(access);
     assertPersonalConnectionOwnerPrincipal(access, "My GitHub account");
     const payload = PersonalGitHubOAuthStartRequest.omit({ connectionId: true }).parse(
       await c.req.json().catch(() => ({})),
@@ -288,6 +293,8 @@ export function registerPersonalGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
       ...(state ? { state } : {}),
       ...(error ? { error } : {}),
     });
+    if (result.exactReturn)
+      return new Response(null, { status: 302, headers: { Location: result.redirectTo } });
     return c.redirect(result.redirectTo, 302);
   });
 }

package/src/routes/pr-review-github.ts

@@ -14,7 +14,8 @@ import {
   PR_REVIEW_AUTOMATION_TEMPLATE_ID,
   prReviewPackConnectorId,
   requireAutomationAdapter,
-  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  externalActorContinuationForAuthorization,
   requirePermission,
   verifyPrReviewWebhook,
   type ApiRouteDeps,
@@ -47,10 +48,15 @@ import {
   type GitHubSignedStatePayload,
 } from "@opengeni/github";
 import type { Context, Hono } from "hono";
+import { requireLegacyOAuthActor } from "../connection-ownership";
 import { deleteCookie, setCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
 import { githubBrowserBaseUrl } from "../github-browser-flow";
 import { acceptAutomationEvent, readAutomationWebhookBody } from "./automations";
+import {
+  completeGitHubAppConnect,
+  isGitHubAppConnectState,
+} from "../integrations/github-app-connect";
 
 const stateCookie = "opengeni_pr_review_github_state";
 const bindingStateMaxAgeSeconds = 10 * 60;
@@ -123,7 +129,8 @@ export function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
 
   app.get("/v1/workspaces/:workspaceId/pr-review/github", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:read");
+    const grant = access.grant;
     await requireActivePack(deps, workspaceId);
     const missing = prReviewGitHubAppMissingSettings(deps.settings);
     const configured = missing.length === 0;
@@ -136,6 +143,7 @@ export function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
       workspaceId,
     );
     const canManage =
+      !externalActorContinuationForAuthorization(access) &&
       hasPermission(grant.permissions, "workspace:admin") &&
       hasPermission(grant.permissions, "secrets:write");
     const connectState =
@@ -252,6 +260,15 @@ export function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
   );
 
   const handleInstallCallback = async (c: Context) => {
+    if (isGitHubAppConnectState(deps, c.req.query("state")))
+      return completeGitHubAppConnect(deps, {
+        expectedProvider: "github-lens",
+        state: c.req.query("state"),
+        installationId: c.req.query("installation_id"),
+        setupAction: c.req.query("setup_action"),
+        error: c.req.query("error"),
+        requestUrl: c.req.url,
+      });
     const state =
       c.req.query("state") ??
       allCookieValues(c, stateCookie).find((candidate) => {
@@ -303,6 +320,14 @@ export function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
   app.get("/v1/pr-review/github/install/callback", handleInstallCallback);
 
   app.get("/v1/pr-review/github/oauth/callback", async (c) => {
+    if (isGitHubAppConnectState(deps, c.req.query("state")))
+      return completeGitHubAppConnect(deps, {
+        expectedProvider: "github-lens",
+        state: c.req.query("state"),
+        code: c.req.query("code"),
+        error: c.req.query("error"),
+        requestUrl: c.req.url,
+      });
     const code = c.req.query("code");
     const state = c.req.query("state");
     if (!code || !state) {
@@ -517,7 +542,9 @@ async function requirePrReviewManageGrant(
 ): Promise<AccessGrant> {
   let grant: AccessGrant;
   try {
-    grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:admin");
+    requireLegacyOAuthActor(access);
+    grant = access.grant;
   } catch (error) {
     if (!(error instanceof HTTPException) || error.status !== 401) throw error;
     const handedOff = prReviewBrowserGrantFromState(deps, state, workspaceId);