@opengeni/api-router 2.3.2-canary.2 → 2.4.2-canary.0

package/src/routes/managed-onboarding.ts

@@ -309,6 +309,8 @@ async function requireManagedHuman(context: Context, deps: ApiRouteDeps) {
   }
   const session = await getManagedSession(context, deps.managedAuth, {
     db: deps.db,
+    sessionAdapter: deps.managedAuthSessionAdapter,
+    sessionSetMode: deps.settings.managedAuthSessionSetMode,
   });
   if (!session?.user) {
     throw new HTTPException(401, { message: "managed human session required" });

package/src/routes/organization-memberships.ts

@@ -91,6 +91,8 @@ async function requireManagedHuman(context: Context, deps: ApiRouteDeps) {
   }
   const session = await getManagedSession(context, deps.managedAuth, {
     db: deps.db,
+    sessionAdapter: deps.managedAuthSessionAdapter,
+    sessionSetMode: deps.settings.managedAuthSessionSetMode,
   });
   if (!session?.user) {
     throw new HTTPException(401, { message: "managed human session required" });

package/src/routes/organization-recovery.ts

@@ -0,0 +1,325 @@
+import {
+  AcceptOrganizationRecoveryCustodyRequest,
+  ConfigureOrganizationRecoveryPolicyRequest,
+  DisableOrganizationRecoveryPolicyRequest,
+  OrganizationRecoveryMutationResponse,
+  OrganizationRecoveryOperationCommandRequest,
+  OrganizationRecoveryOverview,
+  StartOrganizationRecoveryOperationRequest,
+} from "@opengeni/contracts/organization-recovery";
+import {
+  getManagedAuthRequestActorAdmissionStamp,
+  getManagedAuthRequestActorLeaseStamp,
+  requireCanonicalHumanRequestIdentity,
+} from "@opengeni/core/canonical-human-identities";
+import type { ApiRouteDeps } from "@opengeni/core";
+import {
+  acceptOrganizationRecoveryCustody,
+  approveOrganizationRecoveryOperation,
+  cancelOrganizationRecoveryOperation,
+  configureOrganizationRecoveryPolicy,
+  disableOrganizationRecoveryPolicy,
+  executeOrganizationRecoveryOperation,
+  getOrganizationRecoveryOverview,
+  OrganizationRecoveryDeniedError,
+  OrganizationRecoveryOperationReuseError,
+  OrganizationRecoveryRevisionConflictError,
+  OrganizationRecoveryUnavailableError,
+  startOrganizationRecoveryOperation,
+} from "@opengeni/db";
+import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+import { ApiHttpError } from "../http/api-error";
+
+const OrganizationId = z.string().uuid();
+const RecoveryOperationId = z.string().uuid();
+
+export type OrganizationRecoveryRouteServices = {
+  requireCanonicalHumanRequestIdentity: typeof requireCanonicalHumanRequestIdentity;
+  getManagedAuthRequestActorAdmissionStamp: typeof getManagedAuthRequestActorAdmissionStamp;
+  getManagedAuthRequestActorLeaseStamp: typeof getManagedAuthRequestActorLeaseStamp;
+  getOrganizationRecoveryOverview: typeof getOrganizationRecoveryOverview;
+  configureOrganizationRecoveryPolicy: typeof configureOrganizationRecoveryPolicy;
+  acceptOrganizationRecoveryCustody: typeof acceptOrganizationRecoveryCustody;
+  disableOrganizationRecoveryPolicy: typeof disableOrganizationRecoveryPolicy;
+  startOrganizationRecoveryOperation: typeof startOrganizationRecoveryOperation;
+  approveOrganizationRecoveryOperation: typeof approveOrganizationRecoveryOperation;
+  cancelOrganizationRecoveryOperation: typeof cancelOrganizationRecoveryOperation;
+  executeOrganizationRecoveryOperation: typeof executeOrganizationRecoveryOperation;
+};
+
+const productionServices: OrganizationRecoveryRouteServices = {
+  requireCanonicalHumanRequestIdentity,
+  getManagedAuthRequestActorAdmissionStamp,
+  getManagedAuthRequestActorLeaseStamp,
+  getOrganizationRecoveryOverview,
+  configureOrganizationRecoveryPolicy,
+  acceptOrganizationRecoveryCustody,
+  disableOrganizationRecoveryPolicy,
+  startOrganizationRecoveryOperation,
+  approveOrganizationRecoveryOperation,
+  cancelOrganizationRecoveryOperation,
+  executeOrganizationRecoveryOperation,
+};
+
+async function requireRecoveryIdentity(
+  context: Context,
+  deps: ApiRouteDeps,
+  services: OrganizationRecoveryRouteServices,
+) {
+  // Recovery is a browser-session ceremony. Never let ambient API, bearer,
+  // service, or machine authority become a competing recovery identity.
+  if (
+    deps.settings.productAccessMode !== "managed" ||
+    !deps.managedAuth ||
+    !context.req.header("cookie") ||
+    context.req.header("authorization")
+  ) {
+    throw new HTTPException(401, {
+      message: "Managed human authentication required",
+    });
+  }
+  const identity = await services.requireCanonicalHumanRequestIdentity(context, {
+    db: deps.db,
+    managedAuth: deps.managedAuth,
+    managedAuthSessionAdapter: deps.managedAuthSessionAdapter,
+    managedAuthSessionSetMode: deps.settings.managedAuthSessionSetMode,
+    allowRecovery: false,
+  });
+  return { ...identity, actorSubjectId: `user:${identity.authUserId}` };
+}
+
+async function parseBody<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
+  const parsed = schema.safeParse(await context.req.json().catch(() => null));
+  if (!parsed.success) {
+    throw new HTTPException(422, {
+      message: "Invalid organization recovery request",
+    });
+  }
+  return parsed.data;
+}
+
+function parseId(schema: z.ZodString, value: string, label: string): string {
+  const parsed = schema.safeParse(value);
+  if (!parsed.success) throw new HTTPException(422, { message: `Invalid ${label}` });
+  return parsed.data;
+}
+
+function organizationId(context: Context): string {
+  return parseId(OrganizationId, context.req.param("organizationId") ?? "", "organization id");
+}
+
+function recoveryOperationId(context: Context): string {
+  return parseId(
+    RecoveryOperationId,
+    context.req.param("recoveryOperationId") ?? "",
+    "recovery operation id",
+  );
+}
+
+export function organizationRecoveryHttpError(error: unknown): Error {
+  if (error instanceof OrganizationRecoveryRevisionConflictError) {
+    return new ApiHttpError(409, {
+      code: "conflict",
+      message: "Recovery state changed; refresh before submitting a new action.",
+      retryable: false,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof OrganizationRecoveryOperationReuseError) {
+    return new ApiHttpError(409, {
+      code: "idempotency_conflict",
+      message: "Operation id was reused with different input.",
+      retryable: false,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof OrganizationRecoveryUnavailableError) {
+    return new ApiHttpError(409, {
+      code: "conflict",
+      message: "Organization recovery is unavailable.",
+      retryable: false,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof OrganizationRecoveryDeniedError) {
+    return new ApiHttpError(404, {
+      code: "not_found",
+      message: "Organization recovery not found.",
+      retryable: false,
+      outcomeUnknown: false,
+    });
+  }
+  if (error instanceof Error) return error;
+  return new Error("Organization recovery failed");
+}
+
+function requireActorFence(
+  context: Context,
+  deps: ApiRouteDeps,
+  services: OrganizationRecoveryRouteServices,
+) {
+  const actorFence = services.getManagedAuthRequestActorLeaseStamp(context.req.raw);
+  if (deps.settings.managedAuthSessionSetMode !== "legacy" && !actorFence) {
+    throw new HTTPException(409, {
+      message: "Managed actor mutation fence is unavailable",
+    });
+  }
+  if (!actorFence) {
+    throw new HTTPException(409, {
+      message: "Organization recovery requires provider-neutral browser login slots",
+    });
+  }
+  return actorFence;
+}
+
+async function mutationContext(
+  context: Context,
+  deps: ApiRouteDeps,
+  services: OrganizationRecoveryRouteServices,
+) {
+  const identity = await requireRecoveryIdentity(context, deps, services);
+  return {
+    organizationId: organizationId(context),
+    actorSubjectId: identity.actorSubjectId,
+    actorAuthUserId: identity.authUserId,
+    actorAuthSessionId: identity.authSessionId,
+    actorFence: requireActorFence(context, deps, services),
+  };
+}
+
+function mutationResponse(context: Context, value: unknown): Response {
+  return context.json(OrganizationRecoveryMutationResponse.parse(value));
+}
+
+export function registerOrganizationRecoveryRoutes(
+  app: Hono,
+  deps: ApiRouteDeps,
+  services: OrganizationRecoveryRouteServices = productionServices,
+): void {
+  const base = "/v1/organizations/:organizationId/recovery";
+
+  app.get(base, async (context) => {
+    const identity = await requireRecoveryIdentity(context, deps, services);
+    try {
+      return context.json(
+        OrganizationRecoveryOverview.parse(
+          await services.getOrganizationRecoveryOverview(deps.db, {
+            organizationId: organizationId(context),
+            actorSubjectId: identity.actorSubjectId,
+            actorAuthUserId: identity.authUserId,
+            actorAuthSessionId: identity.authSessionId,
+            actorFence: services.getManagedAuthRequestActorAdmissionStamp(context.req.raw) ?? null,
+          }),
+        ),
+      );
+    } catch (error) {
+      throw organizationRecoveryHttpError(error);
+    }
+  });
+
+  app.put(`${base}/policy`, async (context) => {
+    const authority = await mutationContext(context, deps, services);
+    const payload = await parseBody(context, ConfigureOrganizationRecoveryPolicyRequest);
+    try {
+      return mutationResponse(
+        context,
+        await services.configureOrganizationRecoveryPolicy(deps.db, {
+          ...authority,
+          operationId: payload.operationId,
+          expectedPolicyRevision: payload.expectedPolicyRevision,
+          custodianMembershipIds: payload.custodianMembershipIds,
+        }),
+      );
+    } catch (error) {
+      throw organizationRecoveryHttpError(error);
+    }
+  });
+
+  app.post(`${base}/policy/accept`, async (context) => {
+    const authority = await mutationContext(context, deps, services);
+    const payload = await parseBody(context, AcceptOrganizationRecoveryCustodyRequest);
+    try {
+      return mutationResponse(
+        context,
+        await services.acceptOrganizationRecoveryCustody(deps.db, {
+          ...authority,
+          operationId: payload.operationId,
+          expectedPolicyRevision: payload.expectedPolicyRevision,
+        }),
+      );
+    } catch (error) {
+      throw organizationRecoveryHttpError(error);
+    }
+  });
+
+  app.post(`${base}/policy/disable`, async (context) => {
+    const authority = await mutationContext(context, deps, services);
+    const payload = await parseBody(context, DisableOrganizationRecoveryPolicyRequest);
+    try {
+      return mutationResponse(
+        context,
+        await services.disableOrganizationRecoveryPolicy(deps.db, {
+          ...authority,
+          operationId: payload.operationId,
+          expectedPolicyRevision: payload.expectedPolicyRevision,
+        }),
+      );
+    } catch (error) {
+      throw organizationRecoveryHttpError(error);
+    }
+  });
+
+  app.post(`${base}/operations`, async (context) => {
+    const authority = await mutationContext(context, deps, services);
+    const payload = await parseBody(context, StartOrganizationRecoveryOperationRequest);
+    try {
+      return mutationResponse(
+        context,
+        await services.startOrganizationRecoveryOperation(deps.db, {
+          ...authority,
+          operationId: payload.operationId,
+          expectedPolicyRevision: payload.expectedPolicyRevision,
+          targetMembershipId: payload.targetMembershipId,
+        }),
+      );
+    } catch (error) {
+      throw organizationRecoveryHttpError(error);
+    }
+  });
+
+  async function mutateOperation(
+    context: Context,
+    command: typeof approveOrganizationRecoveryOperation,
+  ): Promise<Response> {
+    const authority = await mutationContext(context, deps, services);
+    const payload = await parseBody(context, OrganizationRecoveryOperationCommandRequest);
+    try {
+      return mutationResponse(
+        context,
+        await command(deps.db, {
+          ...authority,
+          recoveryOperationId: recoveryOperationId(context),
+          operationId: payload.operationId,
+          expectedOperationRevision: payload.expectedOperationRevision,
+        }),
+      );
+    } catch (error) {
+      throw organizationRecoveryHttpError(error);
+    }
+  }
+
+  app.post(`${base}/operations/:recoveryOperationId/approve`, async (context) =>
+    mutateOperation(context, services.approveOrganizationRecoveryOperation),
+  );
+  app.post(`${base}/operations/:recoveryOperationId/cancel`, async (context) =>
+    mutateOperation(context, services.cancelOrganizationRecoveryOperation),
+  );
+  app.post(`${base}/operations/:recoveryOperationId/execute`, async (context) =>
+    mutateOperation(context, services.executeOrganizationRecoveryOperation),
+  );
+}

package/src/routes/sessions.ts

@@ -211,6 +211,7 @@ import type { Context, Hono, MiddlewareHandler } from "hono";
 import { HTTPException } from "hono/http-exception";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
 import {
+  getManagedAuthRequestActorEpoch,
   hasPermission,
   requireAccessGrant,
   requireAccessGrantAuthorization,
@@ -243,7 +244,6 @@ import {
 import { buildSessionCodexRealtimeBroker, CodexRealtimeBrokerError } from "../codex-realtime";
 import {
   acceptSessionUserMessage,
-  acceptSessionUserMessageWithOutcome,
   controlHumanSessionWorkstream,
   createSessionForRequest,
   deleteHumanQueuePrompt,
@@ -259,6 +259,7 @@ import {
   SessionSpawnDeniedError,
   sessionSpawnDenialEnvelope,
   steerHumanQueuePrompt,
+  submitComposerDraftForRequest,
   updateSessionMcpApprovalPolicy,
   updateManagedHumanSessionVisibility,
   updateSessionToolPolicy,
@@ -1572,7 +1573,13 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
   // while the actively-working label remains independent of acknowledgment.
   app.put("/v1/workspaces/:workspaceId/sessions/:sessionId/attention", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:read");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "sessions:read",
+    );
+    const grant = authorization.grant;
     const sessionId = c.req.param("sessionId");
     if (!z.string().uuid().safeParse(sessionId).success) {
       throw new HTTPException(404, { message: "session not found" });
@@ -1586,6 +1593,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
         workspaceId,
         subjectId: grant.subjectId,
         sessionId,
+        personalWorkspaceOwnerException: authorization.canonicalManagedHumanSession,
         ...parsed.data,
       });
       if (!session) throw new HTTPException(404, { message: "session not found" });
@@ -1618,7 +1626,13 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
   // for this member and remain recoverable through the archived list view.
   app.put("/v1/workspaces/:workspaceId/sessions/:sessionId/archive", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:read");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "sessions:read",
+    );
+    const grant = authorization.grant;
     const sessionId = c.req.param("sessionId");
     const parsed = UpdateSessionArchiveRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
@@ -1629,6 +1643,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
         workspaceId,
         subjectId: grant.subjectId,
         sessionId,
+        personalWorkspaceOwnerException: authorization.canonicalManagedHumanSession,
         ...parsed.data,
       });
       if (!session) throw new HTTPException(404, { message: "session not found" });
@@ -2559,6 +2574,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       c.req.raw.signal,
       {
         observability: deps.observability,
+        actorEpoch: getManagedAuthRequestActorEpoch(c.req.raw) ?? undefined,
         reauthorizeAfterMs:
           authorization?.reauthorizeAfterMs ?? SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS,
         reauthorize: async () => {
@@ -2832,46 +2848,15 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
     const payload = SubmitComposerDraftRequest.parse(await c.req.json().catch(() => null));
-    let result: Awaited<ReturnType<typeof acceptSessionUserMessageWithOutcome>>;
+    let result: Awaited<ReturnType<typeof submitComposerDraftForRequest>>;
     try {
-      result = await acceptSessionUserMessageWithOutcome(deps, grant, workspaceId, sessionId, {
-        text: payload.text,
-        annotations: payload.annotations,
-        modelContext: payload.modelContext ?? null,
-        resources: payload.resources,
-        model: payload.model,
-        reasoningEffort: payload.reasoningEffort,
-        latencyMode: payload.latencyMode,
-        mcpCredentialUpdates: payload.mcpCredentialUpdates ?? [],
-        connectionAuthorities: payload.connectionAuthorities,
-        ...(payload.personalResourceAttachment
-          ? { personalResourceAttachment: payload.personalResourceAttachment }
-          : {}),
+      result = await submitComposerDraftForRequest(deps, grant, workspaceId, sessionId, payload, {
         authorization,
-        delivery: payload.delivery,
-        origin: "human",
-        expectedDraftRevision: payload.expectedDraftRevision,
-        clientEventId: payload.clientEventId,
-        ...(payload.controlEtag ? { controlEtag: payload.controlEtag } : {}),
       });
     } catch (error) {
       return commandConflictResponse(c, error);
     }
-    if (!result.draft) {
-      throw new Error("Accepted composer draft submission did not return its next draft");
-    }
-    return c.json(
-      {
-        accepted: result.accepted,
-        turn: result.turn,
-        draft: result.draft,
-        receipt: result.receipt,
-        routing: result.routing,
-        interruptionCount: result.interruptionCount,
-        replay: result.replay,
-      },
-      202,
-    );
+    return c.json(result, 202);
   });
 
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/events", async (c) => {
@@ -2995,10 +2980,10 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       }
       if (accepted.action === "conflict") {
         throw new HTTPException(409, {
-          message: `human-input request is ${accepted.request.status}`,
+          message: "human-input request is not currently actionable",
         });
       }
-      return c.json(accepted.event, 202);
+      return c.json(accepted.event, accepted.action === "completed" ? 200 : 202);
     }
   });
 

package/src/routes/supergrok.ts

@@ -80,7 +80,11 @@ async function managedCookieHuman(
   ) {
     return null;
   }
-  const session = await getManagedSession(c, deps.managedAuth);
+  const session = await getManagedSession(c, deps.managedAuth, {
+    db: deps.db,
+    sessionAdapter: deps.managedAuthSessionAdapter,
+    sessionSetMode: deps.settings.managedAuthSessionSetMode,
+  });
   return session?.user?.id ? { subjectId: `user:${session.user.id}` } : null;
 }
 

package/src/routes/workspaces.ts

@@ -45,6 +45,7 @@ import { boundWorkspaceControlHttpPage } from "@opengeni/events";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import {
+  getManagedAuthRequestActorEpoch,
   hasPermission,
   requireAccessContext,
   requireAccessGrant,
@@ -58,6 +59,7 @@ import {
   resolveMemberSubjectId,
 } from "@opengeni/core";
 import { boundedLimit } from "../http/common";
+import { ApiHttpError } from "../http/api-error";
 import { sseWorkspaceControlStream } from "../http/sse";
 import { buildWorkspaceModelCatalog } from "../model-catalog";
 import { processTemporalScheduleCleanupClaims } from "../temporal-schedule-cleanup";
@@ -97,6 +99,14 @@ export function workspaceMembersResponse(members: readonly WorkspaceMemberProjec
   });
 }
 
+export function workspaceUpdateRequestsAccountTransfer(value: unknown): boolean {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    Object.prototype.hasOwnProperty.call(value, "accountId")
+  );
+}
+
 export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/access/me", async (c) => {
     return c.json(await requireAccessContext(c, deps));
@@ -163,7 +173,18 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.patch("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const payload = UpdateWorkspaceRequest.parse(await c.req.json());
+    const body = await c.req.json();
+    if (workspaceUpdateRequestsAccountTransfer(body)) {
+      throw new ApiHttpError(409, {
+        code: "conflict",
+        message:
+          "A workspace is permanently owned by one organization; use workspace grants for same-organization access handoff.",
+        retryable: false,
+        outcomeUnknown: false,
+        details: { code: "workspace_transfer_unsupported" },
+      });
+    }
+    const payload = UpdateWorkspaceRequest.parse(body);
     const workspace = await updateWorkspace(deps.db, workspaceId, {
       ...(payload.name !== undefined ? { name: payload.name.trim() } : {}),
       ...(payload.slug !== undefined ? { slug: payload.slug?.trim() || null } : {}),
@@ -363,6 +384,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
       c.req.raw.signal,
       {
         observability: deps.observability,
+        actorEpoch: getManagedAuthRequestActorEpoch(c.req.raw) ?? undefined,
         reauthorize: async () => {
           await requireFreshAccessGrant(c, deps, workspaceId, "workspace:read");
         },