@opengeni/api-router 2.13.0-canary.0 → 2.13.0-canary.1

package/dist/app.js

@@ -24,7 +24,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-BJWHVMOL.js";
+} from "./chunk-V4IDX7VJ.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,

package/dist/{chunk-BJWHVMOL.js → chunk-V4IDX7VJ.js}

@@ -156,6 +156,7 @@ function feedbackHttpError(error) {
 }
 
 // src/codemode.ts
+import { siteRequestHeaders } from "@opengeni/contracts/site-session-http";
 import {
   codemodeDispatchSubject,
   decodeCodemodeDispatchAck,
@@ -476,14 +477,9 @@ async function codemodeSessionRequest(deps, grant, request, path) {
   const target = new URL(request.url);
   const rewritten = siteSessionPath(path, authority.workspaceId, request.method);
   const url = new URL(rewritten, target.origin);
-  const headers = new Headers({
-    authorization: `Bearer ${token}`,
-    [OPENGENI_API_CONTRACT_HEADER]: OPENGENI_API_CONTRACT_REVISION
-  });
-  for (const name of ["content-type", "accept", "last-event-id"]) {
-    const value = request.headers.get(name);
-    if (value) headers.set(name, value);
-  }
+  const headers = siteRequestHeaders(request.headers);
+  headers.set("authorization", `Bearer ${token}`);
+  headers.set(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
   return new Request(url, {
     method: request.method,
     headers,
@@ -6143,8 +6139,8 @@ import {
   upsertSessionGoalWithEvent,
   RigChangeTransitionError,
   createWorkspaceArtifact,
-  getWorkspaceArtifact as getWorkspaceArtifact3,
-  getWorkspaceArtifactContentRef,
+  getWorkspaceArtifact as getWorkspaceArtifact2,
+  getWorkspaceArtifactContentRef as getWorkspaceArtifactContentRef2,
   listWorkspaceArtifacts,
   publishWorkspaceArtifactVersion,
   rollbackWorkspaceArtifact,
@@ -7980,7 +7976,7 @@ import {
   requireWorkspace,
   withCodexAppsRequestAuthorization,
   consumeToolGatewayApproval,
-  getWorkspaceArtifact,
+  getWorkspaceArtifactContentRef,
   issueToolGatewayApproval,
   ToolGatewayApprovalOperationStartedError,
   ToolGatewayApprovalRateLimitError,
@@ -9016,14 +9012,18 @@ function throwWorkspaceToolGatewayHttpError(error) {
   }
   throw error;
 }
-async function requireWorkspaceSiteToolAuthorization(db, grant, context) {
+async function requireWorkspaceSiteToolAuthorization(db, grant, context, resolveVersion = getWorkspaceArtifactContentRef) {
   try {
-    const detail = await getWorkspaceArtifact(db, grant.workspaceId, context.siteArtifactId);
-    const currentVersion = detail.artifact.currentVersion;
-    const requested = currentVersion?.requestedTools.some(
+    const { status, version: version2 } = await resolveVersion(
+      db,
+      grant.workspaceId,
+      context.siteArtifactId,
+      context.siteVersionId
+    );
+    const requested = version2.requestedTools.some(
       (identity) => identity.serverId === context.identity.serverId && identity.toolName === context.identity.toolName
     );
-    if (detail.artifact.status !== "active" || currentVersion?.id !== context.siteVersionId || !requested) {
+    if (status !== "active" || version2.id !== context.siteVersionId || !requested) {
       throw new HTTPException8(403, { message: "site_tool_not_authorized" });
     }
   } catch (error) {
@@ -9816,7 +9816,7 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant5(c, deps, workspaceId, "files:read");
     const artifactId2 = retainedArtifactId(c.req.param("artifactId"));
-    const artifact = await getWorkspaceArtifact2(db, {
+    const artifact = await getWorkspaceArtifact(db, {
       accountId: grant.accountId,
       workspaceId,
       subjectId: await fileAuthoritySubjectIdForGrant(deps, grant),
@@ -9831,7 +9831,7 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant5(c, deps, workspaceId, "files:read");
     const artifactId2 = retainedArtifactId(c.req.param("artifactId"));
-    const artifact = await getWorkspaceArtifact2(db, {
+    const artifact = await getWorkspaceArtifact(db, {
       accountId: grant.accountId,
       workspaceId,
       subjectId: await fileAuthoritySubjectIdForGrant(deps, grant),
@@ -10116,7 +10116,7 @@ function retainedArtifactMetadata(artifact) {
   }
   return retainedArtifactUnavailable(file.id, "unsupported");
 }
-async function getWorkspaceArtifact2(db, input) {
+async function getWorkspaceArtifact(db, input) {
   const generated = await getGeneratedImageArtifact(db, input.workspaceId, input.artifactId);
   if (generated) {
     return { file: generated.file, metadata: retainedGeneratedImageMetadata(generated) };
@@ -27187,8 +27187,8 @@ function registerWorkspaceArtifactTools(server, deps, grant, sessionId, json) {
       await authorize();
       if (!deps.objectStorage) throw new Error("Object storage is not configured");
       const [rawDetail, ref] = await Promise.all([
-        getWorkspaceArtifact3(deps.db, grant.workspaceId, artifactId2),
-        getWorkspaceArtifactContentRef(deps.db, grant.workspaceId, artifactId2, versionId)
+        getWorkspaceArtifact2(deps.db, grant.workspaceId, artifactId2),
+        getWorkspaceArtifactContentRef2(deps.db, grant.workspaceId, artifactId2, versionId)
       ]);
       const sourceAuthorizations = /* @__PURE__ */ new Map();
       const canReadSourceSession = (sourceSessionId) => {
@@ -94108,8 +94108,8 @@ import {
 } from "@opengeni/core";
 import {
   createWorkspaceArtifact as createWorkspaceArtifact2,
-  getWorkspaceArtifact as getWorkspaceArtifact4,
-  getWorkspaceArtifactContentRef as getWorkspaceArtifactContentRef2,
+  getWorkspaceArtifact as getWorkspaceArtifact3,
+  getWorkspaceArtifactContentRef as getWorkspaceArtifactContentRef3,
   listWorkspaceArtifacts as listWorkspaceArtifacts2,
   nestedPostgresSqlState as nestedPostgresSqlState6,
   publishWorkspaceArtifactVersion as publishWorkspaceArtifactVersion2,
@@ -94231,7 +94231,7 @@ function registerWorkspaceArtifactRoutes(app, deps) {
       throw new HTTPException81(503, {
         message: "Object storage is not configured"
       });
-    const ref = await getWorkspaceArtifactContentRef2(
+    const ref = await getWorkspaceArtifactContentRef3(
       deps.db,
       workspaceId,
       artifactId(context),
@@ -94315,7 +94315,7 @@ function registerWorkspaceArtifactRoutes(app, deps) {
     const workspaceId = context.req.param("workspaceId");
     const grant = await requireAccessGrant42(context, deps, workspaceId, "artifacts:read");
     try {
-      const detail = await getWorkspaceArtifact4(deps.db, workspaceId, artifactId(context));
+      const detail = await getWorkspaceArtifact3(deps.db, workspaceId, artifactId(context));
       return context.json(
         WorkspaceArtifactDetailResponse.parse(
           await projectWorkspaceArtifactDetailProvenance(
@@ -94335,7 +94335,7 @@ function registerWorkspaceArtifactRoutes(app, deps) {
       throw new HTTPException81(503, {
         message: "Object storage is not configured"
       });
-    const ref = await getWorkspaceArtifactContentRef2(
+    const ref = await getWorkspaceArtifactContentRef3(
       deps.db,
       workspaceId,
       artifactId(context),
@@ -94375,7 +94375,7 @@ function registerWorkspaceArtifactRoutes(app, deps) {
       });
     const parsedVersion = parseVersionId(context.req.query("versionId"));
     try {
-      const ref = await getWorkspaceArtifactContentRef2(
+      const ref = await getWorkspaceArtifactContentRef3(
         deps.db,
         workspaceId,
         artifactId(context),
@@ -105876,4 +105876,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-BJWHVMOL.js.map
+//# sourceMappingURL=chunk-V4IDX7VJ.js.map