@opengeni/api-router 2.5.0 → 2.6.4-canary.0

package/src/routes/interaction-resources.ts

@@ -58,7 +58,11 @@ import {
 import { publishDurableSessionEvents } from "@opengeni/events";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { sseWorkspaceInteractionRevisionStream, sseWorkspaceLiveStream } from "../http/sse";
+import {
+  browserSseDeliveryOptions,
+  sseWorkspaceInteractionRevisionStream,
+  sseWorkspaceLiveStream,
+} from "../http/sse";
 import { observeInterventionMutation } from "../interaction-metrics";
 
 export function registerInteractionResourceRoutes(app: Hono, deps: ApiRouteDeps): void {
@@ -74,6 +78,7 @@ export function registerInteractionResourceRoutes(app: Hono, deps: ApiRouteDeps)
       nonnegativeSafeIntegerQuery(context, "interactionAfter", 0),
       context.req.raw.signal,
       {
+        ...browserSseDeliveryOptions(context.req.query("transport")),
         observability: deps.observability,
         actorEpoch: getManagedAuthRequestActorEpoch(context.req.raw) ?? undefined,
         reauthorize: async () => {
@@ -99,6 +104,7 @@ export function registerInteractionResourceRoutes(app: Hono, deps: ApiRouteDeps)
       after,
       context.req.raw.signal,
       {
+        ...browserSseDeliveryOptions(context.req.query("transport")),
         observability: deps.observability,
         actorEpoch: getManagedAuthRequestActorEpoch(context.req.raw) ?? undefined,
         reauthorize: async () => {

package/src/routes/managed-auth-session-sets.ts

@@ -7,6 +7,7 @@ import {
   CompleteManagedAuthLoginTransactionResponse,
   LogoutManagedAuthLoginSlotRequest,
   LogoutManagedAuthSessionSetRequest,
+  MANAGED_AUTH_TRANSACTION_TTL_SECONDS,
   MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,
   MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,
   ManagedAuthDeepLinkResolution,
@@ -15,6 +16,8 @@ import {
   ManagedAuthSessionSetErrorCode,
   ResolveManagedAuthDeepLinkRequest,
   SelectManagedAuthLoginSlotRequest,
+  StartManagedAuthSocialTransactionRequest,
+  StartManagedAuthSocialTransactionResponse,
   type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType,
   type ManagedAuthSessionSetErrorCode as ManagedAuthSessionSetErrorCodeType,
 } from "@opengeni/contracts/managed-auth-session-sets";
@@ -57,11 +60,21 @@ import {
   mutateManagedAuthSessionSet,
 } from "@opengeni/db/managed-auth-session-sets";
 import { ensureManagedAccessForUser, getSession } from "@opengeni/db";
+import { sql } from "drizzle-orm";
 import type { Context, Hono } from "hono";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
 import { ApiHttpError } from "../http/api-error";
-import type { z } from "zod";
+import { z } from "zod";
+
+const ManagedAuthSocialStartReceipt = z
+  .object({
+    version: z.literal(1),
+    requestDigest: z.string().regex(/^[0-9a-f]{64}$/u),
+    url: z.string().url().max(4_096),
+    stateCookie: z.string().min(1).max(4_096),
+  })
+  .strict();
 
 export function registerManagedAuthSessionSetRoutes(app: Hono, deps: ApiRouteDeps): void {
   const noStore = async (context: Context, next: () => Promise<void>) => {
@@ -304,6 +317,129 @@ export function registerManagedAuthSessionSetRoutes(app: Hono, deps: ApiRouteDep
     }
   });
 
+  app.post("/v1/auth/session-set/transactions/social", async (context) => {
+    const body = await bodyAs(context, StartManagedAuthSocialTransactionRequest);
+    const { authority, actorEpoch } = await requireMutation(context, deps, body.expectedGeneration);
+    const available = requireAvailable(deps);
+    if (!managedAuthSocialProviderConfigured(deps, body.provider)) {
+      throw managedAuthApiError(404, "managed_authentication_unavailable");
+    }
+    const transactionSecret = requireTransactionSecret(context, body.transactionId);
+    const publicBaseUrl = deps.settings.publicBaseUrl;
+    if (!publicBaseUrl) {
+      throw managedAuthApiError(503, "managed_authentication_unavailable", {
+        retryable: true,
+      });
+    }
+    const callbackURL = new URL("/account-auth", publicBaseUrl);
+    callbackURL.searchParams.set("transaction", body.transactionId);
+    callbackURL.searchParams.set("social", "complete");
+    const errorCallbackURL = new URL(callbackURL);
+    errorCallbackURL.searchParams.set("social", "error");
+    try {
+      const authorityHash = managedAuthSha256(authority);
+      const transactionSecretHash = managedAuthSha256(transactionSecret);
+      const requestDigest = digest(deps, {
+        operation: "social_start",
+        authorityHash,
+        actorEpoch,
+        transactionSecretHash,
+        request: body,
+      });
+      const receiptIdentifier = `opengeni-managed-social-start:${authorityHash}:${body.operationId}`;
+      const receipt = await deps.db.transaction(async (transaction) => {
+        await transaction.execute(
+          sql`select pg_advisory_xact_lock(hashtextextended(${receiptIdentifier}, 0))`,
+        );
+        const authContext = await available.managedAuth.$context;
+        const stored = await authContext.internalAdapter.findVerificationValue(receiptIdentifier);
+        if (stored && new Date(stored.expiresAt).getTime() > Date.now()) {
+          let parsed: ReturnType<typeof ManagedAuthSocialStartReceipt.safeParse>;
+          try {
+            parsed = ManagedAuthSocialStartReceipt.safeParse(JSON.parse(stored.value));
+          } catch (error) {
+            throw new ManagedAuthCompletionOutcomeUnknownError({
+              cause: error,
+            });
+          }
+          if (!parsed.success) {
+            throw new ManagedAuthCompletionOutcomeUnknownError({
+              cause: parsed.error,
+            });
+          }
+          if (parsed.data.requestDigest !== requestDigest) {
+            throw new ManagedAuthSessionSetOperationReuseError();
+          }
+          return parsed.data;
+        }
+        if (stored) {
+          await authContext.internalAdapter.deleteVerificationByIdentifier(receiptIdentifier);
+        }
+        const result = await available.managedAuth.api.signInSocial({
+          body: {
+            provider: body.provider,
+            disableRedirect: true,
+            callbackURL: callbackURL.toString(),
+            errorCallbackURL: errorCallbackURL.toString(),
+            additionalData: {
+              opengeniManagedAuth: {
+                version: 1,
+                operationId: body.operationId,
+                provider: body.provider,
+                transactionId: body.transactionId,
+                authorityHash,
+                transactionSecretHash,
+                expectedGeneration: body.expectedGeneration,
+                expectedActorEpoch: actorEpoch,
+              },
+            },
+          },
+          headers: isolatedManagedAuthHeaders(context.req.raw),
+          returnHeaders: true,
+        });
+        const url = validatedManagedAuthSocialAuthorizationUrl({
+          provider: body.provider,
+          rawUrl: result.response?.url,
+          expectedClientId:
+            body.provider === "google"
+              ? deps.settings.managedAuthGoogleClientId!
+              : deps.settings.managedAuthGithubClientId!,
+          expectedCallbackUrl: new URL(
+            `/v1/auth/callback/${body.provider}`,
+            publicBaseUrl,
+          ).toString(),
+        });
+        const stateCookieName = authContext.createAuthCookie("state").name;
+        const stateCookie = setCookieHeaders(result.headers).find((cookie) =>
+          cookie.startsWith(`${stateCookieName}=`),
+        );
+        const parsed = ManagedAuthSocialStartReceipt.parse({
+          version: 1,
+          requestDigest,
+          url,
+          stateCookie,
+        });
+        const created = await authContext.internalAdapter.createVerificationValue({
+          identifier: receiptIdentifier,
+          value: JSON.stringify(parsed),
+          expiresAt: new Date(Date.now() + MANAGED_AUTH_TRANSACTION_TTL_SECONDS * 1_000),
+        });
+        if (!created) {
+          throw new ManagedAuthCompletionOutcomeUnknownError();
+        }
+        return parsed;
+      });
+      context.header("set-cookie", receipt.stateCookie, { append: true });
+      return jsonWithActorEpoch(
+        context,
+        actorEpoch,
+        StartManagedAuthSocialTransactionResponse.parse({ url: receipt.url }),
+      );
+    } catch (error) {
+      throwHttp(error);
+    }
+  });
+
   app.delete("/v1/auth/session-set/transactions/:transactionId", async (context) => {
     const body = await bodyAs(context, CancelManagedAuthLoginTransactionRequest);
     if (body.transactionId !== context.req.param("transactionId")) invalid();
@@ -449,6 +585,46 @@ export function registerManagedAuthSessionSetRoutes(app: Hono, deps: ApiRouteDep
   });
 }
 
+export function validatedManagedAuthSocialAuthorizationUrl(input: {
+  provider: "google" | "github";
+  rawUrl: unknown;
+  expectedClientId: string;
+  expectedCallbackUrl: string;
+}): string {
+  if (typeof input.rawUrl !== "string") {
+    throw new ManagedAuthCompletionOutcomeUnknownError();
+  }
+  let url: URL;
+  try {
+    url = new URL(input.rawUrl);
+  } catch (error) {
+    throw new ManagedAuthCompletionOutcomeUnknownError({ cause: error });
+  }
+  const expectedEndpoint =
+    input.provider === "google"
+      ? { origin: "https://accounts.google.com", pathname: "/o/oauth2/v2/auth" }
+      : { origin: "https://github.com", pathname: "/login/oauth/authorize" };
+  const exactlyOne = (name: string, expected?: string): boolean => {
+    const values = url.searchParams.getAll(name);
+    return (
+      values.length === 1 && values[0] !== "" && (expected === undefined || values[0] === expected)
+    );
+  };
+  if (
+    url.origin !== expectedEndpoint.origin ||
+    url.pathname !== expectedEndpoint.pathname ||
+    url.username ||
+    url.password ||
+    url.hash ||
+    !exactlyOne("client_id", input.expectedClientId) ||
+    !exactlyOne("redirect_uri", input.expectedCallbackUrl) ||
+    !exactlyOne("state")
+  ) {
+    throw new ManagedAuthCompletionOutcomeUnknownError();
+  }
+  return input.rawUrl;
+}
+
 /**
  * Better Auth 1.6.26 provider lifecycle routes retained while session-set mode
  * owns all selected-session reads, enumeration, revocation, and user mutation.
@@ -470,21 +646,42 @@ export function requireManagedAuthProviderRouteAllowed(method: string, pathname:
       (pathname === "/v1/auth/verify-email" ||
         pathname === "/v1/auth/error" ||
         pathname === "/v1/auth/ok" ||
+        /^\/v1\/auth\/callback\/(?:google|github)$/.test(pathname) ||
         /^\/v1\/auth\/reset-password\/[^/]+$/.test(pathname)));
   if (!allowed) throw managedAuthApiError(409, "provider_route_blocked");
 }
 
+function managedAuthSocialProviderConfigured(
+  deps: ApiRouteDeps,
+  provider: "google" | "github",
+): boolean {
+  return provider === "google"
+    ? Boolean(
+        deps.settings.managedAuthGoogleClientId && deps.settings.managedAuthGoogleClientSecret,
+      )
+    : Boolean(
+        deps.settings.managedAuthGithubClientId && deps.settings.managedAuthGithubClientSecret,
+      );
+}
+
 /** Remove provider bearer/session material and enforce browser-auth cache/cookie policy. */
 export async function scrubManagedAuthProviderResponse(
   response: Response,
-  options: { replacementCookies?: readonly string[] | undefined } = {},
+  options: {
+    replacementCookies?: readonly string[] | undefined;
+    preserveCookieNames?: readonly string[] | undefined;
+  } = {},
 ): Promise<Response> {
   const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
   const headers = new Headers(response.headers);
   headers.set("cache-control", "no-store");
   headers.set("pragma", "no-cache");
   if (options.replacementCookies !== undefined) {
+    const preserved = setCookieHeaders(response.headers).filter((cookie) =>
+      options.preserveCookieNames?.some((name) => cookie.startsWith(`${name}=`)),
+    );
     headers.delete("set-cookie");
+    for (const cookie of preserved) headers.append("set-cookie", cookie);
     for (const cookie of options.replacementCookies) headers.append("set-cookie", cookie);
   }
   let body: BodyInit | null = response.body;

package/src/routes/organization-memberships.ts

@@ -33,6 +33,7 @@ import {
 import {
   getManagedSession,
   organizationMembershipHttpStatus,
+  requireCanonicalLocalAccountAdministrator,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import {
@@ -100,6 +101,25 @@ async function requireManagedHuman(context: Context, deps: ApiRouteDeps) {
   return { session, subjectId: `user:${session.user.id}` };
 }
 
+async function requireOrganizationAdministrator(
+  context: Context,
+  deps: ApiRouteDeps,
+  organizationId: string,
+): Promise<{ subjectId: string }> {
+  if (deps.settings.productAccessMode === "managed") {
+    return await requireManagedHuman(context, deps);
+  }
+  if (deps.settings.productAccessMode === "local") {
+    const { subjectId } = await requireCanonicalLocalAccountAdministrator(
+      context,
+      deps,
+      organizationId,
+    );
+    return { subjectId };
+  }
+  throw new HTTPException(401, { message: "organization administrator session required" });
+}
+
 async function parseBody<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
   if (!parsed.success) {
@@ -213,12 +233,12 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   });
 
   app.get("/v1/organizations/:organizationId/overview", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id",
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId);
     try {
       return context.json(
         OrganizationAdministrationOverview.parse(
@@ -234,12 +254,12 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   });
 
   app.patch("/v1/organizations/:organizationId", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id",
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId);
     const payload = await parseBody(context, UpdateOrganizationNameRequest);
     try {
       return context.json(
@@ -257,12 +277,12 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   });
 
   app.patch("/v1/organizations/:organizationId/workspaces/:workspaceId", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id",
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId);
     const workspaceId = parseId(WorkspaceId, context.req.param("workspaceId"), "workspace id");
     const payload = await parseBody(context, UpdateOrganizationWorkspaceRequest);
     try {
@@ -284,12 +304,12 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   });
 
   app.post("/v1/organizations/:organizationId/workspaces", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id",
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId);
     const payload = await parseBody(context, CreateOrganizationWorkspaceRequest);
     try {
       return context.json(
@@ -311,12 +331,12 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   app.patch(
     "/v1/organizations/:organizationId/workspaces/:workspaceId/settings",
     async (context) => {
-      const { subjectId } = await requireManagedHuman(context, deps);
       const organizationId = parseId(
         OrganizationId,
         context.req.param("organizationId"),
         "organization id",
       );
+      const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId);
       const workspaceId = parseId(WorkspaceId, context.req.param("workspaceId"), "workspace id");
       const payload = await parseBody(context, UpdateWorkspaceSettingsRequest);
       try {
@@ -642,12 +662,12 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   );
 
   app.get("/v1/organizations/:organizationId/members", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id",
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId);
     try {
       return context.json(
         ListOrganizationAdministrationMembersResponse.parse({
@@ -689,12 +709,12 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   });
 
   app.get("/v1/organizations/:organizationId/retention-policy", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id",
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId);
     try {
       return context.json(
         OrganizationRetentionPolicy.parse(
@@ -710,12 +730,12 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   });
 
   app.patch("/v1/organizations/:organizationId/retention-policy", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id",
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId);
     const payload = await parseBody(context, UpdateOrganizationRetentionPolicyRequest);
     try {
       return context.json(

package/src/routes/packs.ts

@@ -83,7 +83,7 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
   // Built-in pack ids stay reserved so a registration can never shadow them.
   app.post("/v1/workspaces/:workspaceId/packs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const manifest = RegisterCapabilityPackRequest.parse(await c.req.json());
     if (isBuiltInCapabilityPack(manifest.id)) {
       throw new HTTPException(409, {
@@ -100,7 +100,7 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.delete("/v1/workspaces/:workspaceId/packs/:packId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const packId = c.req.param("packId");
     if (isBuiltInCapabilityPack(packId)) {
       throw new HTTPException(409, {
@@ -172,7 +172,7 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/packs/:packId/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const pack = await requirePack(db, workspaceId, c.req.param("packId"));
     const payload = InstallPackRequest.parse(await c.req.json());
     const preview = PackInstallationPreview.parse(
@@ -393,7 +393,7 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.delete("/v1/workspaces/:workspaceId/packs/:packId/installation", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const pack = await requirePack(db, workspaceId, c.req.param("packId"));
     const payload = UninstallPackRequest.parse(await c.req.json());
     const requestDigest = sha256(
@@ -483,7 +483,7 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/packs/:packId/enable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const pack = await requirePack(db, workspaceId, c.req.param("packId"));
     if (capabilityPackRequiresInstallationPlan(pack)) {
       throw new HTTPException(409, {

package/src/routes/plugins.ts

@@ -120,7 +120,7 @@ export function registerPluginRoutes(
 
   app.post("/v1/workspaces/:workspaceId/plugins/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const payload = InstallPluginRequest.parse(await c.req.json());
     const resolved = await resolvePluginPackage({
       deps,
@@ -253,7 +253,7 @@ export function registerPluginRoutes(
 
   app.delete("/v1/workspaces/:workspaceId/plugins/:pluginKey", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const pluginKey = decodeURIComponent(c.req.param("pluginKey"));
     const payload = UninstallPluginRequest.parse(await c.req.json());
     try {

package/src/routes/pr-review.ts

@@ -13,12 +13,14 @@ import {
   canonicalConfiguredModel,
   defaultPrReviewProviderBaseUrl,
   getCapabilityPack,
+  workspaceCustomModelReference,
   prReviewWebhookAuthKind,
   normalizePrReviewProviderBaseUrl,
   prReviewPackConnectorId,
   PR_REVIEW_AUTOMATION_TEMPLATE_ID,
   requireAccessGrant,
   requirePermission,
+  resolveWorkspaceCatalogSettings,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import {
@@ -32,6 +34,8 @@ import {
   getPackInstallation,
   listPrReviewAppRegistrations,
   listPrReviewRepositoryBindings,
+  lockActiveWorkspaceGatewayCustomModelForAdmission,
+  lockActiveWorkspaceOpenRouterCustomModelForAdmission,
   nestedPostgresSqlState,
   recordAuditEvent,
   updatePrReviewAppRegistration,
@@ -385,10 +389,24 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
         throw error;
       }
     }
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
     const model = payload.model
-      ? (canonicalConfiguredModel(settings, payload.model) ?? null)
+      ? (canonicalConfiguredModel(catalogSettings, payload.model) ?? null)
       : null;
-    if (model) await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
+    if (model) await assertWorkspaceModelPolicyAllows(db, catalogSettings, workspaceId, model);
+    const beforeCreateCommit = model
+      ? prReviewCustomModelCommitGuard({
+          settings: catalogSettings,
+          accountId: grant.accountId,
+          workspaceId,
+          modelId: model,
+        })
+      : undefined;
     const template = getCapabilityPack(OPENGENI_PR_REVIEW_PACK_ID)?.automationTemplates?.find(
       (candidate) => candidate.id === PR_REVIEW_AUTOMATION_TEMPLATE_ID,
     );
@@ -417,6 +435,7 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
         eventTypes: template.eventTypes,
         configuration: template.configuration,
         sessionTemplate: template.sessionTemplate,
+        ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
       }),
       "This repository is already bound to the selected PR Review registration",
     );
@@ -441,13 +460,40 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     await requirePrReviewPackActive(db, workspaceId);
     const payload = UpdatePrReviewRepositoryBindingRequest.parse(await c.req.json());
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
     const model =
       payload.model === undefined
         ? undefined
         : payload.model === null
           ? null
-          : (canonicalConfiguredModel(settings, payload.model) ?? null);
-    if (model) await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
+          : (canonicalConfiguredModel(catalogSettings, payload.model) ?? null);
+    if (model) await assertWorkspaceModelPolicyAllows(db, catalogSettings, workspaceId, model);
+    const beforeUpdateCommit = async (
+      tx: ApiRouteDeps["db"],
+      context: {
+        currentModel: string | null;
+        currentStatus: "active" | "disabled";
+        nextModel: string | null;
+        nextStatus: "active" | "disabled";
+      },
+    ): Promise<void> => {
+      const materialExecutionChange =
+        payload.model !== undefined ||
+        payload.additionalInstructions !== undefined ||
+        (context.currentStatus === "disabled" && context.nextStatus === "active");
+      if (!materialExecutionChange || !context.nextModel) return;
+      await prReviewCustomModelCommitGuard({
+        settings: catalogSettings,
+        accountId: grant.accountId,
+        workspaceId,
+        modelId: context.nextModel,
+      })?.(tx);
+    };
     const binding = await updatePrReviewRepositoryBinding(db, {
       accountId: grant.accountId,
       workspaceId,
@@ -458,6 +504,7 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
         ? { additionalInstructions: payload.additionalInstructions }
         : {}),
       ...(payload.status !== undefined ? { status: payload.status } : {}),
+      beforeUpdateCommit,
     });
     if (!binding)
       throw new HTTPException(404, {
@@ -501,6 +548,35 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 }
 
+function prReviewCustomModelCommitGuard(input: {
+  settings: ApiRouteDeps["settings"];
+  accountId: string;
+  workspaceId: string;
+  modelId: string;
+}): ((tx: ApiRouteDeps["db"]) => Promise<void>) | undefined {
+  const reference = workspaceCustomModelReference(input.settings, input.modelId);
+  if (!reference) return undefined;
+  return async (tx): Promise<void> => {
+    const active =
+      reference.providerKind === "openrouter"
+        ? await lockActiveWorkspaceOpenRouterCustomModelForAdmission(tx, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            upstreamModelId: reference.upstreamModelId,
+          })
+        : await lockActiveWorkspaceGatewayCustomModelForAdmission(tx, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            upstreamModelId: reference.upstreamModelId,
+          });
+    if (!active) {
+      throw new HTTPException(422, {
+        message: `model is not available: ${input.modelId}`,
+      });
+    }
+  };
+}
+
 function assertPrReviewSandboxBackend(deps: ApiRouteDeps): void {
   if (deps.settings.sandboxBackend === "selfhosted") {
     throw new HTTPException(409, {