@opengeni/api-router 2.5.0 → 2.6.4-canary.0

package/src/routes/automations.ts

@@ -25,18 +25,26 @@ import {
   listAutomationRuns,
   listAutomationSources,
   listAutomationTriggers,
+  lockActiveWorkspaceGatewayCustomModelForAdmission,
+  lockActiveWorkspaceOpenRouterCustomModelForAdmission,
   recordAutomationEvent,
   resolveAutomationWebhookEndpoint,
   updateAutomationSource,
   updateAutomationTrigger,
+  withWorkspaceGatewayCustomModelReadLock,
+  withWorkspaceOpenRouterCustomModelReadLock,
   type AutomationSourceSecret,
 } from "@opengeni/db";
 import {
   automationRequestDigest,
+  assertWorkspaceModelPolicyAllows,
   buildAutomationAcceptedExecution,
+  canonicalConfiguredModel,
+  workspaceCustomModelReference,
   requireAccessGrant,
   requireAutomationAdapter,
   requirePermission,
+  resolveWorkspaceCatalogSettings,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import type { Hono } from "hono";
@@ -157,13 +165,36 @@ export function registerAutomationRoutes(app: Hono, deps: ApiRouteDeps): void {
     for (const permission of request.sessionTemplate.firstPartyMcpPermissions) {
       requirePermission(grant, permission);
     }
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(deps.db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
+    const model = canonicalConfiguredModel(catalogSettings, request.sessionTemplate.model) ?? null;
+    if (model) {
+      await assertWorkspaceModelPolicyAllows(deps.db, catalogSettings, workspaceId, model);
+    }
+    const normalizedRequest = {
+      ...request,
+      sessionTemplate: { ...request.sessionTemplate, model },
+    };
+    const beforeCreateCommit = model
+      ? workspaceCustomModelCommitGuard({
+          settings: catalogSettings,
+          accountId: grant.accountId,
+          workspaceId,
+          modelId: model,
+        })
+      : undefined;
     return c.json(
       await createAutomationTrigger(deps.db, {
         accountId: grant.accountId,
         workspaceId,
         createdBySubjectId: grant.subjectId,
-        request,
+        request: normalizedRequest,
         adapterId: adapter.id,
+        ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
       }),
       201,
     );
@@ -194,12 +225,54 @@ export function registerAutomationRoutes(app: Hono, deps: ApiRouteDeps): void {
         requirePermission(grant, permission);
       }
     }
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(deps.db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
+    const normalizedRequest = request.sessionTemplate
+      ? {
+          ...request,
+          sessionTemplate: {
+            ...request.sessionTemplate,
+            model: canonicalConfiguredModel(catalogSettings, request.sessionTemplate.model) ?? null,
+          },
+        }
+      : request;
+    if (normalizedRequest.sessionTemplate?.model) {
+      await assertWorkspaceModelPolicyAllows(
+        deps.db,
+        catalogSettings,
+        workspaceId,
+        normalizedRequest.sessionTemplate.model,
+      );
+    }
+    const effectiveModel = normalizedRequest.sessionTemplate
+      ? normalizedRequest.sessionTemplate.model
+      : existing.sessionTemplate.model;
+    const materialExecutionChange =
+      request.eventTypes !== undefined ||
+      request.configuration !== undefined ||
+      request.parameters !== undefined ||
+      request.sessionTemplate !== undefined ||
+      (request.status === "active" && existing.status !== "active");
+    const beforeUpdateCommit =
+      materialExecutionChange && effectiveModel
+        ? workspaceCustomModelCommitGuard({
+            settings: catalogSettings,
+            accountId: grant.accountId,
+            workspaceId,
+            modelId: effectiveModel,
+          })
+        : undefined;
     try {
       const trigger = await updateAutomationTrigger(deps.db, {
         workspaceId,
         triggerId: c.req.param("triggerId"),
         subjectId: grant.subjectId,
-        request,
+        request: normalizedRequest,
+        ...(beforeUpdateCommit ? { beforeUpdateCommit } : {}),
       });
       if (!trigger)
         throw new HTTPException(404, {
@@ -377,29 +450,86 @@ export async function acceptAutomationEvent(
     workspaceId: source.workspaceId,
     sourceId: source.id,
   });
-  const matchingAtAcceptance = triggers.filter((trigger) =>
+  const matchingByEvent = triggers.filter((trigger) =>
     adapter.matches({ event: input.normalizedEvent, trigger }),
   );
-  if (matchingAtAcceptance.length > AUTOMATION_MAX_MATCHED_TRIGGERS) {
+  if (matchingByEvent.length > AUTOMATION_MAX_MATCHED_TRIGGERS) {
     throw new HTTPException(422, {
       message: `automation event matches more than ${AUTOMATION_MAX_MATCHED_TRIGGERS} triggers`,
     });
   }
-  const stored = await recordAutomationEvent(deps.db, {
-    accountId: source.accountId,
-    workspaceId: source.workspaceId,
-    sourceId: source.id,
-    sourceVersion: source.version,
-    sourceConfiguration: source.configuration,
-    matchedTriggerRevisions: matchingAtAcceptance.map((trigger) => ({
-      triggerId: trigger.id,
-      revision: trigger.revision,
-    })),
-    deliveryKey: input.deliveryKey,
-    requestDigest: input.requestDigest,
-    normalizedEvent: input.normalizedEvent,
-    ignoredReason: matchingAtAcceptance.length === 0 ? "no_matching_triggers" : null,
-  });
+  const stored =
+    matchingByEvent.length === 0
+      ? await recordAutomationEvent(deps.db, {
+          accountId: source.accountId,
+          workspaceId: source.workspaceId,
+          sourceId: source.id,
+          sourceVersion: source.version,
+          sourceConfiguration: source.configuration,
+          matchedTriggerRevisions: [],
+          deliveryKey: input.deliveryKey,
+          requestDigest: input.requestDigest,
+          normalizedEvent: input.normalizedEvent,
+          ignoredReason: "no_matching_triggers",
+        })
+      : await withWorkspaceGatewayCustomModelReadLock(
+          deps.db,
+          { accountId: source.accountId, workspaceId: source.workspaceId },
+          async (gatewayLockedDb) =>
+            await withWorkspaceOpenRouterCustomModelReadLock(
+              gatewayLockedDb,
+              { accountId: source.accountId, workspaceId: source.workspaceId },
+              async (lockedDb) => {
+                const catalogSourceSettings = deps.catalogSourceSettings ?? deps.settings;
+                const catalogSettings = (
+                  await resolveWorkspaceCatalogSettings(lockedDb, catalogSourceSettings, {
+                    accountId: source.accountId,
+                    workspaceId: source.workspaceId,
+                  })
+                ).settings;
+                const matchingAtAcceptance = [];
+                for (const trigger of matchingByEvent) {
+                  try {
+                    const render = adapter.render({
+                      event: input.normalizedEvent,
+                      trigger,
+                      source,
+                    });
+                    const requestedModel =
+                      render.sessionTemplate.model ?? catalogSettings.openaiModel;
+                    const model = canonicalConfiguredModel(catalogSettings, requestedModel);
+                    if (!model) continue;
+                    await assertWorkspaceModelPolicyAllows(
+                      lockedDb,
+                      catalogSettings,
+                      source.workspaceId,
+                      model,
+                    );
+                    matchingAtAcceptance.push(trigger);
+                  } catch (error) {
+                    if (isUnprocessableEntity(error)) continue;
+                    throw error;
+                  }
+                }
+                return await recordAutomationEvent(lockedDb, {
+                  accountId: source.accountId,
+                  workspaceId: source.workspaceId,
+                  sourceId: source.id,
+                  sourceVersion: source.version,
+                  sourceConfiguration: source.configuration,
+                  matchedTriggerRevisions: matchingAtAcceptance.map((trigger) => ({
+                    triggerId: trigger.id,
+                    revision: trigger.revision,
+                  })),
+                  deliveryKey: input.deliveryKey,
+                  requestDigest: input.requestDigest,
+                  normalizedEvent: input.normalizedEvent,
+                  ignoredReason:
+                    matchingAtAcceptance.length === 0 ? "no_executable_triggers" : null,
+                });
+              },
+            ),
+        );
   const matching = await getAutomationTriggerRevisions(deps.db, {
     workspaceId: source.workspaceId,
     refs: stored.event.matchedTriggerRevisions,
@@ -457,6 +587,43 @@ export async function acceptAutomationEvent(
   });
 }
 
+function isUnprocessableEntity(error: unknown): boolean {
+  return (
+    error instanceof Error &&
+    "status" in error &&
+    (error as Error & { status?: unknown }).status === 422
+  );
+}
+
+function workspaceCustomModelCommitGuard(input: {
+  settings: ApiRouteDeps["settings"];
+  accountId: string;
+  workspaceId: string;
+  modelId: string;
+}): ((tx: ApiRouteDeps["db"]) => Promise<void>) | undefined {
+  const reference = workspaceCustomModelReference(input.settings, input.modelId);
+  if (!reference) return undefined;
+  return async (tx): Promise<void> => {
+    const active =
+      reference.providerKind === "openrouter"
+        ? await lockActiveWorkspaceOpenRouterCustomModelForAdmission(tx, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            upstreamModelId: reference.upstreamModelId,
+          })
+        : await lockActiveWorkspaceGatewayCustomModelForAdmission(tx, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            upstreamModelId: reference.upstreamModelId,
+          });
+    if (!active) {
+      throw new HTTPException(422, {
+        message: `model is not available: ${input.modelId}`,
+      });
+    }
+  };
+}
+
 async function requireSource(
   deps: ApiRouteDeps,
   accountId: string,

package/src/routes/browser-sessions.ts

@@ -3435,7 +3435,14 @@ async function ensureHeadedBrowserDisplayStack(
   headless: boolean,
   linkedComputer: boolean,
 ): Promise<void> {
-  if (!browserNeedsStandaloneDisplayStack({ headless, linkedComputer })) return;
+  if (
+    !browserNeedsStandaloneDisplayStack({
+      headless,
+      linkedComputer,
+      nativeBrowserControl: typeof session.ensureBrowserControl === "function",
+    })
+  )
+    return;
   if (typeof session.exec !== "function" && typeof session.execCommand !== "function") return;
   await ensureDisplayStack(session, {
     telemetryContext: { callerKind: "viewer" },
@@ -3445,8 +3452,9 @@ async function ensureHeadedBrowserDisplayStack(
 export function browserNeedsStandaloneDisplayStack(input: {
   headless: boolean;
   linkedComputer: boolean;
+  nativeBrowserControl: boolean;
 }): boolean {
-  return !input.headless && !input.linkedComputer;
+  return !input.headless && !input.linkedComputer && !input.nativeBrowserControl;
 }
 
 async function ensureLinkedComputerController(

package/src/routes/capabilities.ts

@@ -32,7 +32,7 @@ export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/capabilities", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const payload = CreateCapabilityCatalogItemRequest.parse(await c.req.json());
     return c.json(
       await createCatalogItem({ db, accountId: grant.accountId, workspaceId, payload }),
@@ -62,7 +62,7 @@ export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/capabilities/:capabilityId/enable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const payload = EnableCapabilityRequest.parse(await c.req.json());
     const installation = await enableCapability({
       db,
@@ -78,7 +78,7 @@ export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/capabilities/:capabilityId/disable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const installation = await disableCapability({
       db,
       accountId: grant.accountId,