@opengeni/api-router 2.2.0-canary.0 → 2.3.2-canary.0

package/src/mcp/session-view.ts

@@ -534,6 +534,11 @@ export function boundSessionDetailMcp(
   effectiveControl: unknown = session.effectiveControl,
   maxBytes = SESSION_DETAIL_MCP_MAX_BYTES,
 ) {
+  const variableSetIds = session.variableSetIds;
+  // The plural selection is authoritative. Keep the singular/environment
+  // fields only as final-entry compatibility aliases so they cannot be read as
+  // complete attachment membership by newer consumers.
+  const variableSetId = variableSetIds.at(-1) ?? null;
   const title = session.title === null ? null : modelStringProjection(session.title, 512);
   const initialMessage = modelStringProjection(session.initialMessage, 4_000);
   const instructions =
@@ -592,8 +597,9 @@ export function boundSessionDetailMcp(
     sandboxGroupId: session.sandboxGroupId,
     activeSandboxId: session.activeSandboxId,
     activeEpoch: session.activeEpoch,
-    variableSetId: session.variableSetId,
-    environmentId: session.environmentId,
+    variableSetIds,
+    variableSetId,
+    environmentId: variableSetId,
     rigId: session.rigId,
     rigVersionId: session.rigVersionId,
     firstPartyMcpPermissions: permissions.value,

package/src/routes/automations.ts

@@ -278,7 +278,7 @@ export function registerAutomationRoutes(app: Hono, deps: ApiRouteDeps): void {
     });
     const bytes = new TextEncoder().encode(stableJson(request));
     return c.json(
-      await acceptEvent(deps, source, {
+      await acceptAutomationEvent(deps, source, {
         deliveryKey:
           request.deliveryId ?? `manual:${automationRequestDigest(source.adapterId, bytes)}`,
         requestDigest: automationRequestDigest(source.adapterId, bytes),
@@ -335,7 +335,7 @@ export function registerAutomationRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
     const requestDigest = automationRequestDigest(source.adapterId, rawBody);
     try {
-      const result = await acceptEvent(deps, source, {
+      const result = await acceptAutomationEvent(deps, source, {
         deliveryKey: adapter.deliveryKey({
           headers: c.req.raw.headers,
           requestDigest,
@@ -357,7 +357,7 @@ export function registerAutomationRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 }
 
-async function acceptEvent(
+export async function acceptAutomationEvent(
   deps: ApiRouteDeps,
   source: AutomationSourceSecret,
   input: {

package/src/routes/documents.ts

@@ -594,6 +594,7 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
             limit: payload.limit,
             mode: payload.mode,
             sourceKinds: payload.sourceKinds,
+            authorityKinds: payload.authorityKinds,
             aclTags: payload.aclTags,
             initiatingSubjectId: grant.subjectId,
             surface: "human",
@@ -620,6 +621,7 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
             limit: payload.limit,
             mode: payload.mode,
             sourceKinds: payload.sourceKinds,
+            authorityKinds: payload.authorityKinds,
             aclTags: payload.aclTags,
             initiatingSubjectId: grant.subjectId,
             surface: "human",

package/src/routes/insights.ts

@@ -1,30 +1,72 @@
 import { InsightsRange, WorkspaceInsightsResponse } from "@opengeni/contracts";
-import { getWorkspaceInsights, requireAccessGrant, type ApiRouteDeps } from "@opengeni/core";
+import {
+  getWorkspaceInsights,
+  normalizeWorkspaceInsightsFilter,
+  requireAccessGrant,
+  WorkspaceInsightsFilterValidationError,
+  type ApiRouteDeps,
+  type WorkspaceInsightsFilterField,
+} from "@opengeni/core";
+import { workspaceInsightsMetricObserver } from "@opengeni/observability";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 
+export function normalizeWorkspaceInsightsQueryFilter(
+  value: string | null | undefined,
+  field: WorkspaceInsightsFilterField,
+): string | null {
+  try {
+    return normalizeWorkspaceInsightsFilter(value, field);
+  } catch (error) {
+    if (error instanceof WorkspaceInsightsFilterValidationError) {
+      throw new HTTPException(400, { message: error.message });
+    }
+    throw error;
+  }
+}
+
 export function registerInsightsRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const observeRequest = workspaceInsightsMetricObserver(deps.observability);
   app.get("/v1/workspaces/:workspaceId/insights", async (c) => {
-    const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-
+    const startedAtMs = performance.now();
     const rangeRaw = c.req.query("range") ?? "week";
-    const rangeParsed = InsightsRange.safeParse(rangeRaw);
-    if (!rangeParsed.success) {
-      throw new HTTPException(400, {
-        message: "range must be one of today|week|month|ytd",
+    const providerRaw = c.req.query("provider");
+    const modelRaw = c.req.query("model");
+    let provider: string | null = null;
+    let model: string | null = null;
+    let outcome = "failed";
+
+    try {
+      const workspaceId = c.req.param("workspaceId");
+      await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+
+      const rangeParsed = InsightsRange.safeParse(rangeRaw);
+      if (!rangeParsed.success) {
+        throw new HTTPException(400, {
+          message: "range must be one of today|week|month|ytd",
+        });
+      }
+      provider = normalizeWorkspaceInsightsQueryFilter(providerRaw, "provider");
+      model = normalizeWorkspaceInsightsQueryFilter(modelRaw, "model");
+
+      const response = await getWorkspaceInsights(deps.db, deps.settings, {
+        workspaceId,
+        range: rangeParsed.data,
+        provider,
+        model,
+      });
+      c.header("cache-control", "private, no-store");
+      const result = c.json(WorkspaceInsightsResponse.parse(response));
+      outcome = "completed";
+      return result;
+    } finally {
+      observeRequest({
+        range: rangeRaw,
+        providerFiltered: provider !== null,
+        modelFiltered: model !== null,
+        outcome,
+        durationMs: performance.now() - startedAtMs,
       });
     }
-    const provider = c.req.query("provider");
-    const model = c.req.query("model");
-
-    const response = await getWorkspaceInsights(deps.db, deps.settings, {
-      workspaceId,
-      range: rangeParsed.data,
-      provider: provider && provider !== "all" ? provider : null,
-      model: model && model !== "all" ? model : null,
-    });
-    c.header("cache-control", "private, no-store");
-    return c.json(WorkspaceInsightsResponse.parse(response));
   });
 }

package/src/routes/managed-onboarding.ts

@@ -0,0 +1,317 @@
+import {
+  CompleteSelfServiceOrganizationSetupRequest,
+  CompleteSelfServiceOrganizationSetupResponse,
+  CompleteOrganizationUserSetupRequest,
+  CompleteOrganizationUserSetupResponse,
+  OrganizationUserSetupPreview,
+  PreviewOrganizationUserSetupRequest,
+  SelfServiceOrganizationOnboardingStatus,
+} from "@opengeni/contracts";
+import { getManagedSession, type ApiRouteDeps } from "@opengeni/core";
+import {
+  completeSelfServiceOrganizationSetup,
+  completeOrganizationUserSetup,
+  getSelfServiceOrganizationOnboardingState,
+  nestedPostgresSqlState,
+  preflightOrganizationUserSetup,
+  previewOrganizationUserSetup,
+} from "@opengeni/db";
+import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+
+import {
+  organizationUserSetupRequestFingerprint,
+  organizationUserSetupTokenDigest,
+  selfServiceOrganizationSetupRequestFingerprint,
+} from "../auth/organization-user-setup";
+import { hashManagedAuthPassword } from "../auth/managed-auth";
+
+export type ManagedOnboardingRouteOptions = {
+  accountSetupLimiter?: { take(key: string): boolean };
+  hashPassword?: (password: string) => Promise<string>;
+};
+
+const completedSetupReplayPasswordHash = `completed-replay:${"0".repeat(64)}`;
+
+export function registerManagedOnboardingRoutes(
+  app: Hono,
+  deps: ApiRouteDeps,
+  options: ManagedOnboardingRouteOptions = {},
+): void {
+  const accountSetupLimiter = options.accountSetupLimiter ?? new PublicSetupRateLimiter();
+  const hashPassword = options.hashPassword ?? hashManagedAuthPassword;
+  app.get("/v1/auth/organization-onboarding", async (context) => {
+    const session = await requireManagedHuman(context, deps);
+    return context.json(
+      SelfServiceOrganizationOnboardingStatus.parse({
+        state: await getSelfServiceOrganizationOnboardingState(deps.db, {
+          authUserId: session.user.id,
+          email: session.user.email,
+          emailVerified: session.user.emailVerified,
+        }),
+      }),
+    );
+  });
+
+  app.post("/v1/auth/organization-onboarding", async (context) => {
+    const session = await requireManagedHuman(context, deps);
+    const parsed = CompleteSelfServiceOrganizationSetupRequest.safeParse(
+      await context.req.json().catch(() => null),
+    );
+    if (!parsed.success) {
+      throw new HTTPException(422, {
+        message: "invalid organization setup request",
+      });
+    }
+    const organizationName = parsed.data.organizationName.trim();
+    try {
+      const requestFingerprint = await selfServiceOrganizationSetupRequestFingerprint({
+        authUserId: session.user.id,
+        organizationName,
+      });
+      return context.json(
+        CompleteSelfServiceOrganizationSetupResponse.parse(
+          await completeSelfServiceOrganizationSetup(deps.db, {
+            authUserId: session.user.id,
+            actorSubjectId: `user:${session.user.id}`,
+            organizationName,
+            operationId: parsed.data.operationId,
+            requestFingerprint,
+          }),
+        ),
+      );
+    } catch (error) {
+      const sqlState = nestedPostgresSqlState(error);
+      if (sqlState === "22023") {
+        throw new HTTPException(422, {
+          message: "invalid organization setup request",
+        });
+      }
+      if (sqlState === "42501") {
+        throw new HTTPException(403, {
+          message: "verified managed user required",
+        });
+      }
+      if (sqlState === "23505" || sqlState === "55000") {
+        throw new HTTPException(409, {
+          message: "organization setup is no longer available; refresh to continue",
+        });
+      }
+      throw error;
+    }
+  });
+
+  app.post("/v1/auth/organization-setup/preview", async (context) => {
+    if (deps.settings.productAccessMode !== "managed" || !deps.managedAuth) {
+      throw new HTTPException(404, { message: "account setup is unavailable" });
+    }
+    enforceAccountSetupRateLimit(context, accountSetupLimiter);
+    const parsed = PreviewOrganizationUserSetupRequest.safeParse(
+      await context.req.json().catch(() => null),
+    );
+    if (!parsed.success) {
+      throw new HTTPException(422, { message: "invalid account setup preview request" });
+    }
+    return context.json(
+      OrganizationUserSetupPreview.parse(
+        await previewOrganizationUserSetup(
+          deps.db,
+          await organizationUserSetupTokenDigest(parsed.data.token),
+        ),
+      ),
+    );
+  });
+
+  app.post("/v1/auth/organization-setup", async (context) => {
+    if (deps.settings.productAccessMode !== "managed" || !deps.managedAuth) {
+      throw new HTTPException(404, { message: "account setup is unavailable" });
+    }
+    enforceAccountSetupRateLimit(context, accountSetupLimiter);
+    const parsed = CompleteOrganizationUserSetupRequest.safeParse(
+      await context.req.json().catch(() => null),
+    );
+    if (!parsed.success) {
+      throw new HTTPException(422, {
+        message: "invalid account setup request",
+      });
+    }
+    const name = parsed.data.name.trim();
+    const tokenDigest = await organizationUserSetupTokenDigest(parsed.data.token);
+    const preflight = await preflightOrganizationUserSetup(deps.db, tokenDigest);
+    if (preflight === "unavailable") {
+      throw new HTTPException(404, {
+        message: "account setup link is invalid, expired, or already belongs to an account",
+      });
+    }
+    const requestFingerprint = await organizationUserSetupRequestFingerprint(deps.settings, {
+      tokenDigest,
+      name,
+      password: parsed.data.password,
+    });
+    const passwordHash =
+      preflight === "completed"
+        ? completedSetupReplayPasswordHash
+        : await hashPassword(parsed.data.password);
+    try {
+      return context.json(
+        CompleteOrganizationUserSetupResponse.parse(
+          await completeOrganizationUserSetup(deps.db, {
+            tokenDigest,
+            operationId: parsed.data.operationId,
+            requestFingerprint,
+            authUserId: crypto.randomUUID(),
+            name,
+            passwordHash,
+          }),
+        ),
+      );
+    } catch (error) {
+      const sqlState = nestedPostgresSqlState(error);
+      if (sqlState === "22023") {
+        throw new HTTPException(422, {
+          message: "invalid account setup request",
+        });
+      }
+      if (sqlState === "23505") {
+        throw new HTTPException(409, {
+          message: "account setup request changed; reopen the original link and try again",
+        });
+      }
+      if (sqlState === "P0002" || sqlState === "42501" || sqlState === "55000") {
+        throw new HTTPException(404, {
+          message: "account setup link is invalid, expired, or already belongs to an account",
+        });
+      }
+      throw error;
+    }
+  });
+}
+
+function enforceAccountSetupRateLimit(
+  context: Context,
+  limiter: { take(key: string): boolean },
+): void {
+  let allowed = false;
+  try {
+    allowed = limiter.take(accountSetupClientKey(context));
+  } catch {
+    // A public credential-setting endpoint must fail closed if its abuse gate
+    // cannot make a decision.
+  }
+  if (!allowed) {
+    throw new HTTPException(429, { message: "too many account setup requests; slow down" });
+  }
+}
+
+function accountSetupClientKey(context: Context): string {
+  const forwarded = context.req.header("x-forwarded-for")?.split(",")[0]?.trim();
+  const address = forwarded || context.req.header("x-real-ip")?.trim() || "unknown";
+  return address.slice(0, 128);
+}
+
+/**
+ * Bounded application-tier protection for the public setup bearer endpoint.
+ * The global bucket prevents spoofed/high-cardinality client keys from
+ * multiplying password-hash work, while the per-client bucket limits bursts.
+ * A full key map rejects new clients until an idle bucket can be pruned.
+ */
+export class PublicSetupRateLimiter {
+  private readonly buckets = new Map<string, { tokens: number; updatedAt: number }>();
+  private global: { tokens: number; updatedAt: number };
+
+  constructor(
+    private readonly options: {
+      globalCapacity?: number;
+      globalRefillPerSecond?: number;
+      clientCapacity?: number;
+      clientRefillPerSecond?: number;
+      maxClientKeys?: number;
+      now?: () => number;
+    } = {},
+  ) {
+    this.global = {
+      tokens: options.globalCapacity ?? 50,
+      updatedAt: options.now?.() ?? Date.now(),
+    };
+  }
+
+  take(key: string): boolean {
+    const now = this.options.now?.() ?? Date.now();
+    const globalCapacity = this.options.globalCapacity ?? 50;
+    if (
+      !takeSetupRateLimitToken(
+        this.global,
+        globalCapacity,
+        this.options.globalRefillPerSecond ?? 5,
+        now,
+      )
+    ) {
+      return false;
+    }
+    const clientCapacity = this.options.clientCapacity ?? 5;
+    const maxClientKeys = this.options.maxClientKeys ?? 2_048;
+    let bucket = this.buckets.get(key);
+    if (!bucket && this.buckets.size >= maxClientKeys) {
+      for (const [candidateKey, candidate] of this.buckets) {
+        refillSetupRateLimitBucket(
+          candidate,
+          clientCapacity,
+          this.options.clientRefillPerSecond ?? 0.1,
+          now,
+        );
+        if (candidate.tokens >= clientCapacity) this.buckets.delete(candidateKey);
+      }
+      if (this.buckets.size >= maxClientKeys) return false;
+    }
+    bucket ??= { tokens: clientCapacity, updatedAt: now };
+    const allowed = takeSetupRateLimitToken(
+      bucket,
+      clientCapacity,
+      this.options.clientRefillPerSecond ?? 0.1,
+      now,
+    );
+    this.buckets.set(key, bucket);
+    return allowed;
+  }
+}
+
+function takeSetupRateLimitToken(
+  bucket: { tokens: number; updatedAt: number },
+  capacity: number,
+  refillPerSecond: number,
+  now: number,
+): boolean {
+  refillSetupRateLimitBucket(bucket, capacity, refillPerSecond, now);
+  if (bucket.tokens < 1) return false;
+  bucket.tokens -= 1;
+  return true;
+}
+
+function refillSetupRateLimitBucket(
+  bucket: { tokens: number; updatedAt: number },
+  capacity: number,
+  refillPerSecond: number,
+  now: number,
+): void {
+  const elapsedSeconds = Math.max(0, (now - bucket.updatedAt) / 1_000);
+  bucket.tokens = Math.min(capacity, bucket.tokens + elapsedSeconds * refillPerSecond);
+  bucket.updatedAt = now;
+}
+
+async function requireManagedHuman(context: Context, deps: ApiRouteDeps) {
+  if (
+    deps.settings.productAccessMode !== "managed" ||
+    !deps.managedAuth ||
+    !context.req.header("cookie") ||
+    context.req.header("authorization")
+  ) {
+    throw new HTTPException(401, { message: "managed human session required" });
+  }
+  const session = await getManagedSession(context, deps.managedAuth, {
+    db: deps.db,
+  });
+  if (!session?.user) {
+    throw new HTTPException(401, { message: "managed human session required" });
+  }
+  return session;
+}