@opengeni/api-router 2.13.0-canary.0 → 2.13.0-canary.2

package/src/integrations/atlassian.ts

@@ -1,3 +1,8 @@
+import {
+  scheduledTaskKnowledgeSource,
+  requireScheduledTaskKnowledgeSource,
+  knowledgeSourceAgentConfig,
+} from "@opengeni/contracts";
 import type { Settings } from "@opengeni/config";
 import { createHash } from "node:crypto";
 import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
@@ -840,10 +845,10 @@ export async function preflightAtlassianScheduleAuthorization(
   input: { task: ScheduledTask; subjectId: string },
 ): Promise<void> {
   const { task } = input;
-  if (task.action.kind !== "knowledge_source_sync") return;
+  if (!scheduledTaskKnowledgeSource(task)) return;
   if (
-    task.action.initiatingSubjectId !== input.subjectId ||
-    task.action.connection.ownerSubjectId !== input.subjectId
+    requireScheduledTaskKnowledgeSource(task).initiatingSubjectId !== input.subjectId ||
+    requireScheduledTaskKnowledgeSource(task).connection.ownerSubjectId !== input.subjectId
   ) {
     throw new HTTPException(403, {
       message: "knowledge source schedule requires the exact initiating subject",
@@ -862,10 +867,10 @@ export async function revokeAtlassianScheduleAuthorization(
   input: { task: ScheduledTask; subjectId: string },
 ): Promise<void> {
   const { task } = input;
-  if (task.action.kind !== "knowledge_source_sync") return;
+  if (!scheduledTaskKnowledgeSource(task)) return;
   if (
-    task.action.initiatingSubjectId !== input.subjectId ||
-    task.action.connection.ownerSubjectId !== input.subjectId
+    requireScheduledTaskKnowledgeSource(task).initiatingSubjectId !== input.subjectId ||
+    requireScheduledTaskKnowledgeSource(task).connection.ownerSubjectId !== input.subjectId
   ) {
     throw new HTTPException(403, {
       message: "knowledge source schedule requires the exact initiating subject",
@@ -879,11 +884,11 @@ export async function revokeAtlassianScheduleAuthorization(
     taskId: task.id,
     accountId: task.accountId,
     workspaceId: task.workspaceId,
-    connectionId: task.action.connection.connectionId,
-    connectionVersion: task.action.connection.connectionVersion,
-    sourceId: task.action.sourceId,
-    sourceLifecycleGeneration: task.action.sourceLifecycleGeneration,
-    sourceConfigGeneration: task.action.sourceConfigGeneration,
+    connectionId: requireScheduledTaskKnowledgeSource(task).connection.connectionId,
+    connectionVersion: requireScheduledTaskKnowledgeSource(task).connection.connectionVersion,
+    sourceId: requireScheduledTaskKnowledgeSource(task).sourceId,
+    sourceLifecycleGeneration: requireScheduledTaskKnowledgeSource(task).sourceLifecycleGeneration,
+    sourceConfigGeneration: requireScheduledTaskKnowledgeSource(task).sourceConfigGeneration,
     externalSourceId,
     subjectId: input.subjectId,
   });
@@ -1014,11 +1019,11 @@ async function materializeSchedules(
     let source = null as Awaited<ReturnType<typeof upsertKnowledgeSource>> | null;
     let existingTask: (typeof tasks)[number] | null = null;
     for (const task of tasks) {
-      if (task.action.kind !== "knowledge_source_sync") continue;
+      if (!scheduledTaskKnowledgeSource(task)) continue;
       const resolved = await getKnowledgeSourceForSyncAuthority(deps.db, {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
-        sourceId: task.action.sourceId,
+        sourceId: requireScheduledTaskKnowledgeSource(task).sourceId,
         initiatingSubjectId: input.subjectId,
       });
       if (resolved?.source.externalSourceId !== identity.externalSourceId) continue;
@@ -1125,7 +1130,10 @@ async function materializeSchedules(
         name: `Sync ${selectedSource.kind === "jira_project" ? "Jira" : "Confluence"}: ${selectedSource.name}`,
         schedule: atlassianSchedule(selectedSource.syncCadence),
         overlapPolicy: "buffer_one",
-        action,
+        action: { kind: "agent_turn" },
+        agentConfig: knowledgeSourceAgentConfig(action, existingTask.agentConfig),
+        refreshPersonalResourceAuthority: true,
+        authorityUpdatedBy: { kind: "subject", subjectId: input.subjectId },
         metadata: {
           ...existingTask.metadata,
           connectorKind: "atlassian",
@@ -1153,16 +1161,11 @@ async function materializeSchedules(
           status: "active",
           schedule: atlassianSchedule(selectedSource.syncCadence),
           overlapPolicy: "buffer_one",
-          action,
+          action: { kind: "agent_turn" },
           runMode: "new_session_per_run",
           targetSessionId: null,
           connectionAuthorities: [],
-          agentConfig: {
-            prompt: "Knowledge source synchronization",
-            resources: [],
-            tools: [],
-            metadata: {},
-          },
+          agentConfig: knowledgeSourceAgentConfig(action),
           variableSetId: null,
           environmentId: null,
           rigId: null,
@@ -1187,11 +1190,11 @@ async function materializeSchedules(
   }
 
   for (const task of tasks) {
-    if (task.action.kind !== "knowledge_source_sync") continue;
+    if (!scheduledTaskKnowledgeSource(task)) continue;
     const resolved = await getKnowledgeSourceForSyncAuthority(deps.db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
-      sourceId: task.action.sourceId,
+      sourceId: requireScheduledTaskKnowledgeSource(task).sourceId,
       initiatingSubjectId: input.subjectId,
     });
     if (!resolved || enabledIds.has(resolved.source.externalSourceId)) continue;
@@ -1510,20 +1513,20 @@ async function deauthorizeConnectionSources(
     connection.id,
   );
   for (const task of tasks) {
-    if (task.action.kind !== "knowledge_source_sync") continue;
+    if (!scheduledTaskKnowledgeSource(task)) continue;
     const resolved = await getKnowledgeSourceForSyncAuthority(deps.db, {
       accountId: task.accountId,
       workspaceId: task.workspaceId,
-      sourceId: task.action.sourceId,
+      sourceId: requireScheduledTaskKnowledgeSource(task).sourceId,
       initiatingSubjectId: subjectId,
     });
     if (!resolved || resolved.source.lifecycleState !== "active") continue;
     await deauthorizeKnowledgeSourceRetrieval(deps.db, {
       accountId: task.accountId,
       workspaceId: task.workspaceId,
-      sourceId: task.action.sourceId,
-      audience: task.action.destination,
-      operationId: `atlassian-deauthorize:${connection.id}:${connection.version + 1}:${task.action.sourceId}:${reasonCode}`,
+      sourceId: requireScheduledTaskKnowledgeSource(task).sourceId,
+      audience: requireScheduledTaskKnowledgeSource(task).destination,
+      operationId: `atlassian-deauthorize:${connection.id}:${connection.version + 1}:${requireScheduledTaskKnowledgeSource(task).sourceId}:${reasonCode}`,
       reasonCode,
       actor: { kind: "human", subjectId, initiatingHumanSubjectId: subjectId },
     });

package/src/integrations/google-drive.ts

@@ -1,3 +1,8 @@
+import {
+  scheduledTaskKnowledgeSource,
+  requireScheduledTaskKnowledgeSource,
+  knowledgeSourceAgentConfig,
+} from "@opengeni/contracts";
 import { createHash, randomBytes } from "node:crypto";
 import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
 import { requireConnectOwnerAuthority } from "./connect-authority";
@@ -188,7 +193,7 @@ export async function wakeGoogleDriveSourcesFromWorkspaceEvent(
   );
   let triggered = 0;
   for (const task of tasks) {
-    if (task.action.kind !== "knowledge_source_sync" || task.status !== "active") continue;
+    if (!scheduledTaskKnowledgeSource(task) || task.status !== "active") continue;
     const externalSourceId =
       typeof task.metadata.externalSourceId === "string" ? task.metadata.externalSourceId : null;
     const selectedSource = externalSourceId ? selectedById.get(externalSourceId) : null;
@@ -808,20 +813,20 @@ async function deauthorizeGoogleDriveConnectionSources(
     connection.workspaceId,
     connection.id,
     async (task) => {
-      if (task.action.initiatingSubjectId !== subjectId) return;
+      if (requireScheduledTaskKnowledgeSource(task).initiatingSubjectId !== subjectId) return;
       const resolved = await getKnowledgeSourceForSyncAuthority(deps.db, {
         accountId: task.accountId,
         workspaceId: task.workspaceId,
-        sourceId: task.action.sourceId,
+        sourceId: requireScheduledTaskKnowledgeSource(task).sourceId,
         initiatingSubjectId: subjectId,
       });
       if (!resolved || resolved.source.lifecycleState !== "active") return;
       await deauthorizeKnowledgeSourceRetrieval(deps.db, {
         accountId: task.accountId,
         workspaceId: task.workspaceId,
-        sourceId: task.action.sourceId,
-        audience: task.action.destination,
-        operationId: `google-drive-deauthorize:${connection.id}:${authorityVersion}:${task.action.sourceId}:${reasonCode}`,
+        sourceId: requireScheduledTaskKnowledgeSource(task).sourceId,
+        audience: requireScheduledTaskKnowledgeSource(task).destination,
+        operationId: `google-drive-deauthorize:${connection.id}:${authorityVersion}:${requireScheduledTaskKnowledgeSource(task).sourceId}:${reasonCode}`,
         reasonCode,
         actor: {
           kind: "human",
@@ -837,7 +842,7 @@ async function forEachGoogleDriveConnectionTask(
   deps: ApiRouteDeps,
   workspaceId: string,
   connectionId: string,
-  fn: (task: ScheduledTask & { action: { kind: "knowledge_source_sync" } }) => Promise<void>,
+  fn: (task: ScheduledTask) => Promise<void>,
 ): Promise<void> {
   const tasks = await listKnowledgeSourceSyncTasksForConnection(deps.db, workspaceId, connectionId);
   for (const task of tasks) {
@@ -1393,11 +1398,11 @@ async function materializeGoogleDriveKnowledgeSchedules(
     let source = null as Awaited<ReturnType<typeof upsertKnowledgeSource>> | null;
     let existingTask = null as (typeof connectionTasks)[number] | null;
     for (const task of connectionTasks) {
-      if (task.action.kind !== "knowledge_source_sync") continue;
+      if (!scheduledTaskKnowledgeSource(task)) continue;
       const resolved = await getKnowledgeSourceForSyncAuthority(deps.db, {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
-        sourceId: task.action.sourceId,
+        sourceId: requireScheduledTaskKnowledgeSource(task).sourceId,
         initiatingSubjectId: input.subjectId,
       });
       if (resolved?.source.externalSourceId !== identity.externalSourceId) continue;
@@ -1499,7 +1504,10 @@ async function materializeGoogleDriveKnowledgeSchedules(
       task = await updateScheduledTask(deps.db, input.workspaceId, existingTask.id, {
         name: `Sync Google Drive: ${selectedSource.name}`,
         overlapPolicy: "buffer_one",
-        action,
+        action: { kind: "agent_turn" },
+        agentConfig: knowledgeSourceAgentConfig(action, existingTask.agentConfig),
+        refreshPersonalResourceAuthority: true,
+        authorityUpdatedBy: { kind: "subject", subjectId: input.subjectId },
         metadata: {
           ...existingTask.metadata,
           connectorKind: "google_drive",
@@ -1531,16 +1539,11 @@ async function materializeGoogleDriveKnowledgeSchedules(
           status: "active",
           schedule,
           overlapPolicy: "buffer_one",
-          action,
+          action: { kind: "agent_turn" },
           runMode: "new_session_per_run",
           targetSessionId: null,
           connectionAuthorities: [],
-          agentConfig: {
-            prompt: "Knowledge source synchronization",
-            resources: [],
-            tools: [],
-            metadata: {},
-          },
+          agentConfig: knowledgeSourceAgentConfig(action),
           variableSetId: null,
           environmentId: null,
           rigId: null,
@@ -1565,11 +1568,11 @@ async function materializeGoogleDriveKnowledgeSchedules(
   }
 
   for (const task of connectionTasks) {
-    if (task.action.kind !== "knowledge_source_sync") continue;
+    if (!scheduledTaskKnowledgeSource(task)) continue;
     const resolved = await getKnowledgeSourceForSyncAuthority(deps.db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
-      sourceId: task.action.sourceId,
+      sourceId: requireScheduledTaskKnowledgeSource(task).sourceId,
       initiatingSubjectId: input.subjectId,
     });
     if (!resolved || enabledIds.has(resolved.source.externalSourceId)) continue;
@@ -1613,10 +1616,10 @@ export async function preflightKnowledgeSourceScheduleAuthorization(
   input: { task: ScheduledTask; subjectId: string },
 ): Promise<void> {
   const { task } = input;
-  if (task.action.kind !== "knowledge_source_sync") return;
+  if (!scheduledTaskKnowledgeSource(task)) return;
   if (
-    task.action.initiatingSubjectId !== input.subjectId ||
-    task.action.connection.ownerSubjectId !== input.subjectId
+    requireScheduledTaskKnowledgeSource(task).initiatingSubjectId !== input.subjectId ||
+    requireScheduledTaskKnowledgeSource(task).connection.ownerSubjectId !== input.subjectId
   ) {
     throw new HTTPException(403, {
       message: "knowledge source schedule requires the exact initiating subject",
@@ -1642,10 +1645,10 @@ export async function revokeKnowledgeSourceScheduleAuthorization(
   input: { task: ScheduledTask; subjectId: string },
 ): Promise<void> {
   const { task } = input;
-  if (task.action.kind !== "knowledge_source_sync") return;
+  if (!scheduledTaskKnowledgeSource(task)) return;
   if (
-    task.action.initiatingSubjectId !== input.subjectId ||
-    task.action.connection.ownerSubjectId !== input.subjectId
+    requireScheduledTaskKnowledgeSource(task).initiatingSubjectId !== input.subjectId ||
+    requireScheduledTaskKnowledgeSource(task).connection.ownerSubjectId !== input.subjectId
   ) {
     throw new HTTPException(403, {
       message: "knowledge source schedule requires the exact initiating subject",
@@ -1665,11 +1668,11 @@ export async function revokeKnowledgeSourceScheduleAuthorization(
     taskId: task.id,
     accountId: task.accountId,
     workspaceId: task.workspaceId,
-    connectionId: task.action.connection.connectionId,
-    connectionVersion: task.action.connection.connectionVersion,
-    sourceId: task.action.sourceId,
-    sourceLifecycleGeneration: task.action.sourceLifecycleGeneration,
-    sourceConfigGeneration: task.action.sourceConfigGeneration,
+    connectionId: requireScheduledTaskKnowledgeSource(task).connection.connectionId,
+    connectionVersion: requireScheduledTaskKnowledgeSource(task).connection.connectionVersion,
+    sourceId: requireScheduledTaskKnowledgeSource(task).sourceId,
+    sourceLifecycleGeneration: requireScheduledTaskKnowledgeSource(task).sourceLifecycleGeneration,
+    sourceConfigGeneration: requireScheduledTaskKnowledgeSource(task).sourceConfigGeneration,
     externalSourceId,
     subjectId: input.subjectId,
   });

package/src/integrations/marketplace-plugin.ts

@@ -5,7 +5,7 @@ import { HTTPException } from "hono/http-exception";
 /** Adapt only indexed portable components. Never silently drop required components. */
 export function marketplacePlugin(url: string) {
   const source = snapshot.sources.find((candidate) =>
-    candidate.entries.some((item) => item.sourceUrl === url),
+    candidate.entries.some((entry) => entry.sourceUrl === url),
   );
   const item = source?.entries.find((candidate) => candidate.sourceUrl === url);
   if (!item || !source) return null;

package/src/integrations/provider-oauth.ts

@@ -375,7 +375,7 @@ export async function completeApiIntegrationProviderOAuth(
     if (!providerScopesInclude(definition, token.scopes, state.authorizeScopes)) {
       throw new ProviderOAuthCallbackError("scope_not_granted");
     }
-    const grantedScopes = token.scopes.length > 0 ? token.scopes : state.authorizeScopes;
+    let grantedScopes = token.scopes.length > 0 ? token.scopes : state.authorizeScopes;
     const identity = await verifyProviderIdentity(deps, definition, token);
     if (
       state.expectedProviderPrincipalId &&
@@ -415,6 +415,11 @@ export async function completeApiIntegrationProviderOAuth(
     if (!refreshToken) {
       throw new ProviderOAuthCallbackError("refresh_token_missing");
     }
+    // Microsoft omits offline_access from access-token scopes. The new or
+    // previously verified refresh token proves this capability instead.
+    if (definition.provider.id === "microsoft") {
+      grantedScopes = uniqueStrings([...grantedScopes, "offline_access"]);
+    }
     const credentialEncrypted = encryptEnvironmentValue(
       key,
       JSON.stringify({
@@ -926,7 +931,11 @@ function providerScopesInclude(
     return value;
   };
   const granted = new Set(effective.map(normalize));
-  return definition.authentication.scopes.every((scope) => granted.has(normalize(scope)));
+  return definition.authentication.scopes.every(
+    (scope) =>
+      (definition.provider.id === "microsoft" && normalize(scope) === "offline_access") ||
+      granted.has(normalize(scope)),
+  );
 }
 
 function providerOAuthReturnUrl(