@opengeni/api-router 2.3.2-canary.2 → 2.4.2-canary.0

package/src/auth/managed-auth.ts

@@ -9,14 +9,20 @@ import { ensureManagedAccessForUser } from "@opengeni/db";
 import {
   ensureCanonicalHumanIdentityForAuthUser,
   getCanonicalHumanIdentityProjection,
+  getCanonicalHumanExactLoginBindingForAuthUser,
   synchronizeCanonicalHumanLoginBindings,
 } from "@opengeni/db/canonical-human-identities";
 import { betterAuth } from "better-auth";
 import { createEmailVerificationToken } from "better-auth/api";
 import { hashPassword } from "better-auth/crypto";
+import { sql } from "drizzle-orm";
 import { Pool } from "pg";
 
 import { decideCanonicalHumanSessionAdmission } from "./canonical-human-session-admission";
+import {
+  currentManagedAuthAttemptId,
+  shouldDiscardCurrentManagedAuthProviderSession,
+} from "./managed-auth-attempt-context";
 
 // `ManagedAuth` (the Better Auth `Auth<any>` alias) is owned by @opengeni/core
 // (`managed-auth-type.ts`) — `dependencies.ts`/`access` reference it as a
@@ -121,6 +127,25 @@ export function createManagedAuth(
           returned: false,
           bigint: true,
         },
+        loginBindingId: {
+          type: "string",
+          fieldName: "login_binding_id",
+          input: false,
+          returned: false,
+        },
+        loginBindingRevision: {
+          type: "number",
+          fieldName: "login_binding_revision",
+          input: false,
+          returned: false,
+          bigint: true,
+        },
+        managedAuthLoginTransactionId: {
+          type: "string",
+          fieldName: "managed_auth_login_transaction_id",
+          input: false,
+          returned: false,
+        },
       },
     },
     account: {
@@ -215,8 +240,13 @@ export function createManagedAuth(
               binding: null,
             });
             if (!preflight.allowed) {
+              const exactRecoveryBinding = await getCanonicalHumanExactLoginBindingForAuthUser(db, {
+                authUserId: session.userId,
+                providerId: "credential",
+              });
               const recoveryBinding = preflightProjection.loginBindings.find(
-                (binding) => binding.status === "recovery_pending",
+                (binding) =>
+                  binding.id === exactRecoveryBinding.id && binding.status === "recovery_pending",
               );
               const recoveryAdmission = decideCanonicalHumanSessionAdmission({
                 intent: "recovery_completion",
@@ -235,17 +265,27 @@ export function createManagedAuth(
               return {
                 data: {
                   ...session,
+                  ...(shouldDiscardCurrentManagedAuthProviderSession()
+                    ? { expiresAt: new Date(0) }
+                    : {}),
                   identityId: preflightProjection.activeIdentity.id,
                   identityRevision: preflightProjection.activeIdentity.identityRevision,
                   authRevision: preflightProjection.activeIdentity.authRevision,
+                  loginBindingId: recoveryBinding!.id,
+                  loginBindingRevision: recoveryBinding!.revision,
+                  managedAuthLoginTransactionId: currentManagedAuthAttemptId(),
                 },
               };
             }
 
             await synchronizeCanonicalHumanLoginBindings(db, session.userId);
             const projection = await getCanonicalHumanIdentityProjection(db, session.userId);
+            const exactBinding = await getCanonicalHumanExactLoginBindingForAuthUser(db, {
+              authUserId: session.userId,
+              providerId: "credential",
+            });
             const activeBinding = projection.loginBindings.find(
-              (binding) => binding.id === projection.activeIdentity.activeLoginBindingId,
+              (binding) => binding.id === exactBinding.id,
             );
             const admission = decideCanonicalHumanSessionAdmission({
               intent: "ordinary_session",
@@ -265,12 +305,22 @@ export function createManagedAuth(
             return {
               data: {
                 ...session,
+                ...(shouldDiscardCurrentManagedAuthProviderSession()
+                  ? { expiresAt: new Date(0) }
+                  : {}),
                 identityId: projection.activeIdentity.id,
                 identityRevision: projection.activeIdentity.identityRevision,
                 authRevision: projection.activeIdentity.authRevision,
+                loginBindingId: exactBinding.id,
+                loginBindingRevision: exactBinding.revision,
+                managedAuthLoginTransactionId: currentManagedAuthAttemptId(),
               },
             };
           },
+          after: async (session) => {
+            if (!shouldDiscardCurrentManagedAuthProviderSession()) return;
+            await db.execute(sql`delete from auth_sessions where id = ${session.id}`);
+          },
         },
       },
       user: {

package/src/fatal-process-boundary.ts

@@ -0,0 +1,231 @@
+import { randomUUID } from "node:crypto";
+import type { Attributes, Observability, Span } from "@opengeni/observability";
+
+export type ApiFatalEvent = "startup_failure" | "unhandled_rejection" | "uncaught_exception";
+export type ApiFatalPhase = "startup" | "running";
+export type ApiFatalReasonKind =
+  | "bigint"
+  | "boolean"
+  | "error"
+  | "function"
+  | "null"
+  | "number"
+  | "object"
+  | "string"
+  | "symbol"
+  | "undefined";
+
+type ApiFatalObservability = Pick<Observability, "error" | "flush" | "startSpan">;
+
+type ApiFatalProcess = {
+  on: (
+    event: "unhandledRejection" | "uncaughtException",
+    listener: (reason: unknown) => void,
+  ) => void;
+  off: (
+    event: "unhandledRejection" | "uncaughtException",
+    listener: (reason: unknown) => void,
+  ) => void;
+  exit: (code: number) => void;
+};
+
+export type ApiFatalProcessBoundaryOptions = {
+  process?: ApiFatalProcess;
+  observability?: ApiFatalObservability;
+  flushTimeoutMs?: number;
+  correlationId?: () => string;
+  fallbackLog?: (message: string) => void;
+};
+
+export type ApiFatalProcessBoundary = {
+  attachObservability: (observability: ApiFatalObservability) => void;
+  markRunning: () => void;
+  reportStartupFailure: (reason: unknown) => Promise<void>;
+  dispose: () => void;
+};
+
+const API_FATAL_FLUSH_TIMEOUT_MS = 1_000;
+const API_FATAL_CORRELATION_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+
+const FATAL_ERROR_CODES = {
+  startup_failure: "api_startup_failed",
+  unhandled_rejection: "api_unhandled_rejection",
+  uncaught_exception: "api_uncaught_exception",
+} as const;
+
+export function installApiFatalProcessBoundary(
+  options: ApiFatalProcessBoundaryOptions = {},
+): ApiFatalProcessBoundary {
+  const runtimeProcess = options.process ?? defaultProcessBoundary();
+  const flushTimeoutMs = options.flushTimeoutMs ?? API_FATAL_FLUSH_TIMEOUT_MS;
+  const correlationId = options.correlationId ?? (() => `api-fatal.${randomUUID()}`);
+  const fallbackLog = options.fallbackLog ?? ((message: string) => console.error(message));
+  let observability = options.observability;
+  let phase: ApiFatalPhase = "startup";
+  let reporting = false;
+
+  const report = async (event: ApiFatalEvent, reason: unknown): Promise<void> => {
+    if (reporting) return;
+    reporting = true;
+
+    const diagnostic = apiFatalDiagnostic(event, phase, reason, correlationId);
+    const message = apiFatalMessage(diagnostic);
+    const activeObservability = observability;
+    try {
+      if (activeObservability) {
+        let logged = false;
+        try {
+          activeObservability.error(message, diagnostic);
+          logged = true;
+        } catch {
+          // The fatal boundary must still report and terminate if logging is unhealthy.
+        }
+        if (!logged) {
+          safeFallbackLog(fallbackLog, message);
+        }
+        try {
+          const span: Span = activeObservability.startSpan("api.process.fatal", diagnostic);
+          span.end({ error: true });
+        } catch {
+          // The synchronous log remains authoritative when span creation fails.
+        }
+        await flushWithin(activeObservability, flushTimeoutMs);
+      } else {
+        safeFallbackLog(fallbackLog, message);
+      }
+    } finally {
+      runtimeProcess.exit(1);
+    }
+  };
+
+  const onUnhandledRejection = (reason: unknown): void => {
+    void report("unhandled_rejection", reason);
+  };
+  const onUncaughtException = (reason: unknown): void => {
+    void report("uncaught_exception", reason);
+  };
+  runtimeProcess.on("unhandledRejection", onUnhandledRejection);
+  runtimeProcess.on("uncaughtException", onUncaughtException);
+
+  return {
+    attachObservability: (value) => {
+      observability = value;
+    },
+    markRunning: () => {
+      phase = "running";
+    },
+    reportStartupFailure: async (reason) => {
+      await report("startup_failure", reason);
+    },
+    dispose: () => {
+      runtimeProcess.off("unhandledRejection", onUnhandledRejection);
+      runtimeProcess.off("uncaughtException", onUncaughtException);
+    },
+  };
+}
+
+function apiFatalDiagnostic(
+  event: ApiFatalEvent,
+  phase: ApiFatalPhase,
+  reason: unknown,
+  correlationId: () => string,
+): Attributes & {
+  errorClass: "ApiFatalOperationError";
+  errorCode: (typeof FATAL_ERROR_CODES)[ApiFatalEvent];
+  origin: "api";
+  phase: ApiFatalPhase;
+  reasonKind: ApiFatalReasonKind;
+  correlationId: string;
+} {
+  let safeCorrelationId = "api-fatal.fallback";
+  try {
+    const candidate = correlationId();
+    if (API_FATAL_CORRELATION_ID_PATTERN.test(candidate)) {
+      safeCorrelationId = candidate;
+    }
+  } catch {
+    // A fixed valid fallback preserves the fatal report and nonzero exit.
+  }
+  return {
+    errorClass: "ApiFatalOperationError",
+    errorCode: FATAL_ERROR_CODES[event],
+    origin: "api",
+    phase,
+    reasonKind: apiFatalReasonKind(reason),
+    correlationId: safeCorrelationId,
+  };
+}
+
+function apiFatalReasonKind(reason: unknown): ApiFatalReasonKind {
+  if (reason === null) return "null";
+  const kind = typeof reason;
+  if (kind !== "object") return kind;
+  try {
+    return reason instanceof Error ? "error" : "object";
+  } catch {
+    return "object";
+  }
+}
+
+function apiFatalMessage(diagnostic: ReturnType<typeof apiFatalDiagnostic>): string {
+  return (
+    `OpenGeni API fatal process failure (${diagnostic.errorCode}; ` +
+    `phase=${diagnostic.phase}; reason_kind=${diagnostic.reasonKind}; ` +
+    `correlation_id=${diagnostic.correlationId})`
+  );
+}
+
+async function flushWithin(
+  observability: Pick<Observability, "flush">,
+  timeoutMs: number,
+): Promise<void> {
+  let flush: Promise<void>;
+  try {
+    flush = Promise.resolve(observability.flush()).catch(() => undefined);
+  } catch {
+    return;
+  }
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return;
+
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  try {
+    await Promise.race([
+      flush,
+      new Promise<void>((resolve) => {
+        timeout = setTimeout(resolve, timeoutMs);
+      }),
+    ]);
+  } finally {
+    if (timeout !== undefined) clearTimeout(timeout);
+  }
+}
+
+function safeFallbackLog(fallbackLog: (message: string) => void, message: string): void {
+  try {
+    fallbackLog(message);
+  } catch {
+    // Process termination remains mandatory even when every diagnostic sink fails.
+  }
+}
+
+function defaultProcessBoundary(): ApiFatalProcess {
+  return {
+    on: (event, listener) => {
+      if (event === "unhandledRejection") {
+        process.on("unhandledRejection", listener);
+      } else {
+        process.on("uncaughtException", listener);
+      }
+    },
+    off: (event, listener) => {
+      if (event === "unhandledRejection") {
+        process.off("unhandledRejection", listener);
+      } else {
+        process.off("uncaughtException", listener);
+      }
+    },
+    exit: (code) => {
+      process.exit(code);
+    },
+  };
+}

package/src/http/sse.ts

@@ -19,6 +19,7 @@ import {
   type EventBus,
 } from "@opengeni/events";
 import type { Observability } from "@opengeni/observability";
+import { MANAGED_AUTH_ACTOR_EPOCH_HEADER } from "@opengeni/core/managed-auth-session-sets";
 
 const SESSION_REPLAY_PAGE_SIZE = 100;
 const WORKSPACE_CONTROL_REPLAY_PAGE_SIZE = 100;
@@ -463,6 +464,7 @@ export async function sseSessionStream(
       "Content-Type": "text/event-stream; charset=utf-8",
       "Cache-Control": "no-cache, no-transform",
       Connection: "keep-alive",
+      ...(options.actorEpoch ? { [MANAGED_AUTH_ACTOR_EPOCH_HEADER]: options.actorEpoch } : {}),
     },
   });
 }
@@ -636,6 +638,7 @@ export async function sseWorkspaceControlStream(
       "Content-Type": "text/event-stream; charset=utf-8",
       "Cache-Control": "no-cache, no-transform",
       Connection: "keep-alive",
+      ...(options.actorEpoch ? { [MANAGED_AUTH_ACTOR_EPOCH_HEADER]: options.actorEpoch } : {}),
     },
   });
 }
@@ -763,6 +766,7 @@ export async function sseWorkspaceLiveStream(
       "Content-Type": "text/event-stream; charset=utf-8",
       "Cache-Control": "no-cache, no-transform",
       Connection: "keep-alive",
+      ...(options.actorEpoch ? { [MANAGED_AUTH_ACTOR_EPOCH_HEADER]: options.actorEpoch } : {}),
     },
   });
 }
@@ -851,6 +855,7 @@ export async function sseWorkspaceInteractionRevisionStream(
       "Content-Type": "text/event-stream; charset=utf-8",
       "Cache-Control": "no-cache, no-transform",
       Connection: "keep-alive",
+      ...(options.actorEpoch ? { [MANAGED_AUTH_ACTOR_EPOCH_HEADER]: options.actorEpoch } : {}),
     },
   });
 }
@@ -922,6 +927,8 @@ export type SseDeliveryOptions = {
   /** Current ACL re-check, run even while the event stream is idle. */
   reauthorize?: (() => Promise<void>) | undefined;
   reauthorizeAfterMs?: number | undefined;
+  /** Exact selected actor emitted on the stream response for cross-tab fencing. */
+  actorEpoch?: string | undefined;
 };
 
 export type SessionSseDeliveryOptions = SseDeliveryOptions;

package/src/index.ts

@@ -21,7 +21,11 @@ import {
   type Database,
 } from "@opengeni/db";
 import { createNatsEventBus, type ResponderConnection } from "@opengeni/events";
-import { createObservability, logStartupDependencyRetry } from "@opengeni/observability";
+import {
+  createObservability,
+  logStartupDependencyRetry,
+  type Observability,
+} from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { isArtifactRuntimeConfigured } from "@opengeni/artifact-tool/runtime/development";
 import { SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID } from "@opengeni/core";
@@ -51,6 +55,7 @@ import {
   createStandaloneEditableArtifactApplication,
   type StandaloneEditableArtifactApplication,
 } from "./editable-artifact-production";
+import { installApiFatalProcessBoundary } from "./fatal-process-boundary";
 
 /**
  * A REJECT_DUPLICATE start collides on the deterministic workflowId when the
@@ -299,9 +304,15 @@ export async function createTemporalWorkflowClient(
   };
 }
 
-export async function startApi() {
-  const settings = getSettings();
-  const observability = createObservability(settings, { component: "api" });
+export async function startApi(
+  options: {
+    settings?: ReturnType<typeof getSettings>;
+    observability?: Observability;
+  } = {},
+) {
+  const settings = options.settings ?? getSettings();
+  const observability =
+    options.observability ?? createObservability(settings, { component: "api" });
   // Step I: standalone → dbSchema unset → searchPath undefined → today's plain
   // handle (public). Embedded → scoped to the dedicated schema + the host's RLS
   // strategy.
@@ -531,7 +542,16 @@ export async function startApi() {
 }
 
 if (import.meta.main) {
-  await startApi();
+  const fatalBoundary = installApiFatalProcessBoundary();
+  try {
+    const settings = getSettings();
+    const observability = createObservability(settings, { component: "api" });
+    fatalBoundary.attachObservability(observability);
+    await startApi({ settings, observability });
+    fatalBoundary.markRunning();
+  } catch (error) {
+    await fatalBoundary.reportStartupFailure(error);
+  }
 }
 
 export function temporalOverlapPolicy(policy: ScheduledTaskOverlapPolicy): ScheduleOverlapPolicy {

package/src/integrations/slack-interactions.ts

@@ -3203,13 +3203,15 @@ async function continueSlackSession(
         respondedBy: grant.subjectId,
         clientEventId: `slack:${entry.providerEventId}`,
       });
-      if (accepted.action === "accepted") {
-        await publishDurableSessionEvents(
-          deps.bus,
-          grant.workspaceId,
-          interaction.sessionId,
-          accepted.events,
-        );
+      if (accepted.action === "accepted" || accepted.action === "completed") {
+        if (accepted.events.length > 0) {
+          await publishDurableSessionEvents(
+            deps.bus,
+            grant.workspaceId,
+            interaction.sessionId,
+            accepted.events,
+          );
+        }
         if (accepted.workflowWakeRevision !== null) {
           await deps.workflowClient.signalApprovalDecision({
             accountId: grant.accountId,
@@ -3220,7 +3222,8 @@ async function continueSlackSession(
             workflowWakeRevision: accepted.workflowWakeRevision,
           });
         }
-        return;
+        const committedOutcome = accepted.request.response?.outcome;
+        if (committedOutcome === "answered" || committedOutcome === "skipped") return;
       }
     }
   }
@@ -3502,19 +3505,21 @@ async function executeSlackAction(
       respondedBy: grant.subjectId,
       clientEventId: `slack-action:${handle.id}`,
     });
-    if (accepted.action !== "accepted") {
+    if (accepted.action === "not_found" || accepted.action === "conflict") {
       return {
         result: "stale",
         stale: true,
         text: `${mention}This question is no longer pending.`,
       };
     }
-    await publishDurableSessionEvents(
-      deps.bus,
-      grant.workspaceId,
-      handle.sessionId,
-      accepted.events,
-    );
+    if (accepted.events.length > 0) {
+      await publishDurableSessionEvents(
+        deps.bus,
+        grant.workspaceId,
+        handle.sessionId,
+        accepted.events,
+      );
+    }
     if (accepted.workflowWakeRevision !== null) {
       await deps.workflowClient.signalApprovalDecision({
         accountId: grant.accountId,
@@ -3525,9 +3530,17 @@ async function executeSlackAction(
         workflowWakeRevision: accepted.workflowWakeRevision,
       });
     }
+    const committedOutcome = accepted.request.response?.outcome ?? response.outcome;
+    if (committedOutcome !== "answered" && committedOutcome !== "skipped") {
+      return {
+        result: "stale",
+        stale: true,
+        text: `${mention}This question is already ${committedOutcome}.`,
+      };
+    }
     return {
-      result: response.outcome === "skipped" ? "skipped" : "answered",
-      text: `${mention}${response.outcome === "skipped" ? "Skipped the question" : "Answer submitted"}. OpenGeni will continue.`,
+      result: committedOutcome === "skipped" ? "skipped" : "answered",
+      text: `${mention}${committedOutcome === "skipped" ? "Skipped the question" : "Answer submitted"}. OpenGeni will continue.`,
     };
   }
   if (handle.actionKind === "session_pause" || handle.actionKind === "session_resume") {

package/src/mcp/receipts.ts

@@ -26,6 +26,40 @@ export function mcpMutationReceipt(input: McpMutationReceiptInput): McpMutationR
   });
 }
 
+export function sessionControlMutationReceipt(input: {
+  operation: "session_pause" | "session_resume";
+  sessionId: string;
+  state: string;
+  receiptId: string;
+  timestamp: string;
+  outcome: "changed" | "unchanged" | "replayed";
+  interruptionCount: number;
+}): McpMutationReceiptType {
+  return mcpMutationReceipt({
+    operation: input.operation,
+    committed: true,
+    outcome:
+      input.outcome === "changed"
+        ? "updated"
+        : input.outcome === "unchanged"
+          ? "unchanged"
+          : "replayed",
+    changed: input.outcome === "changed",
+    resource: {
+      type: "session",
+      id: input.sessionId,
+      state: input.state,
+    },
+    relatedResources: [{ type: "session_command_receipt", id: input.receiptId }],
+    timestamp: input.timestamp,
+    idempotency: {
+      status: input.outcome === "replayed" ? "replayed" : "applied",
+    },
+    facts: { interruptionCount: input.interruptionCount },
+    nextAction: { tool: "session_get", arguments: { sessionId: input.sessionId } },
+  });
+}
+
 export type SessionCreateReceiptResult = {
   session: {
     id: string;