@opengeni/api-router 2.5.0 → 2.6.4

package/src/routes/codex.ts

@@ -39,8 +39,10 @@ import {
   designateCodexAppsCredential,
   disconnectAllCodexAccounts,
   disconnectCodexAccount,
+  disconnectOrganizationCodexAccount,
   encryptEnvironmentValue,
   ensureCodexRotationSettings,
+  ensureOrganizationCodexRotationSettings,
   fetchCodexUsageForAccount,
   fetchCodexRateLimitResetCreditsForAccount,
   fenceCodexResetRedemptionSend,
@@ -48,18 +50,29 @@ import {
   getCodexCredentialStatus,
   getCodexAppsSettings,
   getCodexRotationSettings,
+  getOrganizationCodexRotationSettings,
+  getWorkspaceCodexSubscriptionSource,
   listPendingCodexCapacityWakeTargets,
   listCodexAccountStatuses,
+  listOrganizationCodexAccountStatuses,
   listCodexResetRedemptionRecoveries,
+  nestedPostgresSqlState,
   releaseCodexResetRedemptionClaim,
   updateCodexAllocatorEligibility,
   loadCodexCredentialForRun,
   renameCodexAccount,
+  renameOrganizationCodexAccount,
   setActiveCodexCredential,
+  setActiveOrganizationCodexCredential,
   setInitialActiveCodexCredential,
+  setWorkspaceCodexSubscriptionMode,
+  setWorkspaceCodexSubscriptionModeInTransaction,
+  updateOrganizationCodexRotationSettings,
   updateCodexRotationSettings,
+  upsertOrganizationCodexSubscriptionCredential,
   upsertCodexSubscriptionCredential,
   withCodexCapacityMutation,
+  withSessionCodexCapacityMutation,
   type CodexAccountStatus,
   type CodexCapacityWakeTarget,
 } from "@opengeni/db";
@@ -81,6 +94,7 @@ function codexAccountJson(
 ) {
   return {
     id: row.id,
+    source: row.source,
     chatgptAccountId: row.chatgptAccountId,
     label: row.label,
     email: row.accountEmail,
@@ -110,6 +124,7 @@ function codexAccountJson(
     exhaustedUntil: row.exhaustedUntil,
     appsDesignated: options.appsCredentialId === row.id,
     canEnableApps:
+      row.source === "workspace" &&
       options.appsCredentialId === null &&
       options.canManageApps === true &&
       options.humanSubjectId !== null &&
@@ -154,6 +169,7 @@ import {
   getManagedSession,
   hasPermission,
   requireAccessGrant,
+  requireCanonicalLocalAccountAdministrator,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import type { Context, Hono } from "hono";
@@ -207,6 +223,57 @@ async function managedCookieHuman(
   };
 }
 
+async function requireOrganizationCodexHuman(
+  c: Context,
+  deps: ApiRouteDeps,
+  organizationId: string,
+): Promise<ManagedCookieHuman> {
+  const parsed = z.string().uuid().safeParse(organizationId);
+  if (!parsed.success) throw new HTTPException(422, { message: "invalid organization id" });
+  let human = await managedCookieHuman(c, deps);
+  if (!human && deps.settings.productAccessMode === "local") {
+    const local = await requireCanonicalLocalAccountAdministrator(c, deps, organizationId);
+    human = {
+      subjectId: local.subjectId,
+      browserSessionHash: await hashCodexBrowserSession(`local:${local.subjectId}`),
+    };
+  }
+  if (!human) {
+    throw new HTTPException(401, { message: "organization administrator session required" });
+  }
+  try {
+    await getOrganizationCodexRotationSettings(deps.db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+    });
+  } catch (error) {
+    const state = nestedPostgresSqlState(error);
+    if (state === "42501") {
+      throw new HTTPException(403, { message: "organization administration is not authorized" });
+    }
+    if (state === "P0002") {
+      throw new HTTPException(404, { message: "organization not found" });
+    }
+    throw error;
+  }
+  return human;
+}
+
+async function requireWorkspaceCodexManagementSource(
+  deps: ApiRouteDeps,
+  workspaceId: string,
+): Promise<void> {
+  const source = await getWorkspaceCodexSubscriptionSource(deps.db, workspaceId);
+  if (source.effectiveSource === "organization") {
+    throw new HTTPException(409, {
+      message: "this Codex subscription is managed in Organization settings",
+    });
+  }
+  if (source.effectiveSource === "disabled") {
+    throw new HTTPException(409, { message: "Codex is disabled for this workspace" });
+  }
+}
+
 function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void {
   const contentType = c.req.header("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
   if (contentType !== "application/json") {
@@ -214,13 +281,17 @@ function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void
       message: "JSON browser request required",
     });
   }
-  if (!deps.settings.publicBaseUrl) {
+  if (deps.settings.productAccessMode !== "local" && !deps.settings.publicBaseUrl) {
     throw new HTTPException(503, {
       message: "managed browser origin is not configured",
     });
   }
-  const expectedOrigin = new URL(deps.settings.publicBaseUrl).origin;
-  if (c.req.header("origin") !== expectedOrigin) {
+  const origin = c.req.header("origin");
+  if (
+    deps.settings.productAccessMode === "local"
+      ? !localBrowserOriginMatchesRequest(c, origin)
+      : origin !== new URL(deps.settings.publicBaseUrl!).origin
+  ) {
     throw new HTTPException(403, {
       message: "same-origin browser request required",
     });
@@ -232,6 +303,41 @@ function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void
   }
 }
 
+function localBrowserOriginMatchesRequest(c: Context, value: string | undefined): boolean {
+  if (!value) return false;
+  let origin: URL;
+  try {
+    origin = new URL(value);
+  } catch {
+    return false;
+  }
+  if (
+    origin.origin !== value ||
+    origin.origin === "null" ||
+    (origin.protocol !== "http:" && origin.protocol !== "https:")
+  ) {
+    return false;
+  }
+
+  const forwardedProtocol = c.req.header("x-forwarded-proto")?.trim().toLowerCase();
+  const protocol = forwardedProtocol ? `${forwardedProtocol}:` : new URL(c.req.url).protocol;
+  if (protocol !== "http:" && protocol !== "https:") return false;
+  const forwardedHost = c.req.header("x-forwarded-host") ?? c.req.header("host");
+  if (!forwardedHost || /[\s,/?#@\\]/u.test(forwardedHost)) return false;
+
+  let request: URL;
+  try {
+    request = new URL(`${protocol}//${forwardedHost}`);
+  } catch {
+    return false;
+  }
+  return (
+    origin.protocol === request.protocol &&
+    origin.hostname === request.hostname &&
+    (request.port === "" || origin.port === request.port)
+  );
+}
+
 async function requireRedemptionHuman(
   c: Context,
   deps: ApiRouteDeps,
@@ -258,7 +364,7 @@ async function requireRedemptionHuman(
       message: "managed browser session required",
     });
   }
-  const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+  const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
   if (grant.subjectId !== human.subjectId) {
     throw new HTTPException(403, {
       message: "managed browser identity mismatch",
@@ -553,6 +659,8 @@ async function fetchCodexAccountOverview(
 
 type CodexConnectState = {
   workspaceId?: string;
+  organizationId?: string;
+  actorSubjectId?: string;
   deviceAuthId?: string;
   userCode?: string;
   iat?: number;
@@ -597,11 +705,276 @@ const CODEX_DEVICE_EXPIRY_SECONDS = 15 * 60; // the device code expires 15 min a
 export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, settings, githubStateSecret } = deps;
 
+  app.get("/v1/workspaces/:workspaceId/codex/source", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    return c.json(await getWorkspaceCodexSubscriptionSource(db, workspaceId));
+  });
+
+  app.patch("/v1/workspaces/:workspaceId/codex/source", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    const parsed = z
+      .object({ mode: z.enum(["automatic", "workspace", "organization", "disabled"]) })
+      .safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: "a valid Codex source mode is required" });
+    }
+    try {
+      return c.json(
+        await setWorkspaceCodexSubscriptionMode(db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          mode: parsed.data.mode,
+        }),
+      );
+    } catch (error) {
+      if (
+        error instanceof Error &&
+        (error.message.includes("personal workspaces") ||
+          error.message.includes("active turns are using it"))
+      ) {
+        throw new HTTPException(409, { message: error.message });
+      }
+      throw error;
+    }
+  });
+
+  app.get("/v1/organizations/:organizationId/codex/accounts", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const [accounts, rotation] = await Promise.all([
+      listOrganizationCodexAccountStatuses(db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+      }),
+      getOrganizationCodexRotationSettings(db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+      }),
+    ]);
+    return c.json({
+      accounts: accounts.map((account) => codexAccountJson(account)),
+      activeAccountId: rotation?.activeCredentialId ?? null,
+      settings: {
+        rotationEnabled: rotation?.rotationEnabled ?? false,
+        rotationStrategy: "sharded",
+        activeCredentialId: rotation?.activeCredentialId ?? null,
+      },
+    });
+  });
+
+  app.post("/v1/organizations/:organizationId/codex/connect/start", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    let start: Awaited<ReturnType<typeof startDeviceCode>>;
+    try {
+      start = await startDeviceCode();
+    } catch (error) {
+      throw new HTTPException(502, {
+        message:
+          error instanceof CodexDeviceError ? error.message : "failed to start Codex device login",
+      });
+    }
+    return c.json({
+      userCode: start.userCode,
+      verificationUri: start.verificationUri,
+      intervalSeconds: start.intervalSeconds,
+      state: createSignedState(githubStateSecret, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        deviceAuthId: start.deviceAuthId,
+        userCode: start.userCode,
+      }),
+    });
+  });
+
+  app.post("/v1/organizations/:organizationId/codex/connect/poll", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const { state } = (await c.req.json().catch(() => null)) as { state?: string };
+    const payload = (state
+      ? readSignedState(state, githubStateSecret)
+      : null) as unknown as CodexConnectState | null;
+    if (
+      !payload ||
+      payload.organizationId !== organizationId ||
+      payload.actorSubjectId !== human.subjectId ||
+      !payload.deviceAuthId ||
+      !payload.userCode
+    ) {
+      throw new HTTPException(400, { message: "codex connect state is invalid or expired" });
+    }
+    if (
+      typeof payload.iat === "number" &&
+      Date.now() / 1000 - payload.iat > CODEX_DEVICE_EXPIRY_SECONDS
+    ) {
+      return c.json({ status: "expired" });
+    }
+    let poll: Awaited<ReturnType<typeof pollDeviceCode>>;
+    try {
+      poll = await pollDeviceCode({
+        deviceAuthId: payload.deviceAuthId,
+        userCode: payload.userCode,
+      });
+    } catch (error) {
+      throw new HTTPException(502, {
+        message: error instanceof CodexDeviceError ? error.message : "codex device poll failed",
+      });
+    }
+    if (poll.status === "pending") return c.json({ status: "pending" });
+    if (poll.status === "expired") return c.json({ status: "expired" });
+    let tokens: Awaited<ReturnType<typeof exchangeDeviceCode>>;
+    try {
+      tokens = await exchangeDeviceCode({
+        authorizationCode: poll.authorizationCode,
+        codeVerifier: poll.codeVerifier,
+      });
+    } catch (error) {
+      throw new HTTPException(502, {
+        message: error instanceof CodexDeviceError ? error.message : "codex token exchange failed",
+      });
+    }
+    const key = environmentsEncryptionKeyBytes(settings);
+    if (!key) {
+      throw new HTTPException(500, {
+        message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured",
+      });
+    }
+    const id = parseIdToken(tokens.idToken);
+    await ensureOrganizationCodexRotationSettings(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+    });
+    const upserted = await upsertOrganizationCodexSubscriptionCredential(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+      credentialEncrypted: encryptEnvironmentValue(
+        key,
+        JSON.stringify({
+          access_token: tokens.accessToken,
+          refresh_token: tokens.refreshToken,
+          id_token: tokens.idToken,
+        }),
+      ),
+      chatgptAccountId: id.chatgptAccountId,
+      scopes: null,
+      planType: id.planType,
+      isFedramp: id.isFedramp,
+      expiresAt: accessTokenExpiry(tokens.accessToken),
+      lastRefreshAt: new Date(),
+      accountEmail: id.email ?? null,
+      label: id.email ?? id.chatgptAccountId ?? null,
+    });
+    await signalCodexCapacityTargets(deps, upserted.wakeTargets);
+    const rotation = await getOrganizationCodexRotationSettings(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+    });
+    return c.json({
+      status: "connected",
+      plan: id.planType,
+      accountId: upserted.id,
+      isActive: rotation?.activeCredentialId === upserted.id,
+    });
+  });
+
+  app.post("/v1/organizations/:organizationId/codex/accounts/:accountId/activate", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const credentialId = c.req.param("accountId");
+    const activation = await setActiveOrganizationCodexCredential(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+      credentialId,
+    });
+    if (!activation.activated) {
+      throw new HTTPException(404, { message: "codex account not found" });
+    }
+    await signalCodexCapacityTargets(deps, activation.wakeTargets);
+    return c.json({ activated: true, accountId: credentialId });
+  });
+
+  app.patch("/v1/organizations/:organizationId/codex/settings", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const parsed = z
+      .object({ rotationEnabled: z.boolean() })
+      .safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: "rotationEnabled is required" });
+    }
+    const updated = await updateOrganizationCodexRotationSettings(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+      rotationEnabled: parsed.data.rotationEnabled,
+    });
+    if (!updated) throw new HTTPException(404, { message: "Codex settings not found" });
+    await signalCodexCapacityTargets(deps, updated.wakeTargets);
+    return c.json({
+      rotationEnabled: updated.rotationEnabled,
+      rotationStrategy: "sharded",
+      activeCredentialId: updated.activeCredentialId,
+    });
+  });
+
+  app.patch("/v1/organizations/:organizationId/codex/accounts/:accountId", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const body = (await c.req.json().catch(() => null)) as { label?: unknown } | null;
+    const renamed = await renameOrganizationCodexAccount(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+      credentialId: c.req.param("accountId"),
+      label: typeof body?.label === "string" ? body.label : null,
+    });
+    if (!renamed) throw new HTTPException(404, { message: "codex account not found" });
+    const accounts = await listOrganizationCodexAccountStatuses(db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+    });
+    const row = accounts.find((account) => account.id === c.req.param("accountId"));
+    if (!row) throw new HTTPException(404, { message: "codex account not found" });
+    return c.json(codexAccountJson(row));
+  });
+
+  app.delete("/v1/organizations/:organizationId/codex/accounts/:accountId", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    let result: Awaited<ReturnType<typeof disconnectOrganizationCodexAccount>>;
+    try {
+      result = await disconnectOrganizationCodexAccount(db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        credentialId: c.req.param("accountId"),
+      });
+    } catch (error) {
+      const cause = (error as { cause?: unknown } | null)?.cause;
+      const message =
+        cause instanceof Error ? cause.message : error instanceof Error ? error.message : "";
+      if (message.includes("active turns are using it")) {
+        throw new HTTPException(409, {
+          message: "Codex subscription cannot disconnect while active turns are using it",
+        });
+      }
+      throw error;
+    }
+    await signalCodexCapacityTargets(deps, result.wakeTargets);
+    return c.json({ disconnected: result.removed, newActiveId: result.newActiveCredentialId });
+  });
+
   // Begin device-code login: returns the user code + verification URL and a
   // signed state that carries the device_auth_id back to `poll`.
   app.post("/v1/workspaces/:workspaceId/codex/connect/start", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant(c, deps, workspaceId, "connections:write");
     let start: Awaited<ReturnType<typeof startDeviceCode>>;
     try {
       start = await startDeviceCode();
@@ -627,7 +1000,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   // Poll for authorization: pending | expired | connected (persists on success).
   app.post("/v1/workspaces/:workspaceId/codex/connect/poll", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
     const { state } = (await c.req.json()) as { state?: string };
     const payload = (state
       ? readSignedState(state, githubStateSecret)
@@ -688,56 +1061,60 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured",
       });
     }
-    await ensureCodexRotationSettings(db, grant.accountId, workspaceId);
-    const mutation = await withCodexCapacityMutation(
-      db,
-      { workspaceId, reason: "codex_credential_connected" },
-      async (tx) => {
-        const upserted = await upsertCodexSubscriptionCredential(tx, {
-          accountId: grant.accountId,
-          workspaceId,
-          credentialEncrypted: encryptEnvironmentValue(
-            key,
-            JSON.stringify({
-              access_token: tokens.accessToken,
-              refresh_token: tokens.refreshToken,
-              id_token: tokens.idToken,
-            }),
-          ),
-          chatgptAccountId: id.chatgptAccountId,
-          scopes: null, // device grant scopes are discovered at runtime, not asserted here
-          planType: id.planType,
-          isFedramp: id.isFedramp,
-          expiresAt: accessTokenExpiry(tokens.accessToken),
-          lastRefreshAt: new Date(),
-          accountEmail: id.email ?? null,
-          label: id.email ?? id.chatgptAccountId ?? null,
-          connectedBySubjectId:
-            connectingHuman?.subjectId === grant.subjectId ? connectingHuman.subjectId : null,
-        });
-        return { result: upserted, changed: upserted.kind === "upserted" };
-      },
-    );
-    const upserted = mutation.result;
+    const mutation = await withSessionCodexCapacityMutation<{
+      upserted: Awaited<ReturnType<typeof upsertCodexSubscriptionCredential>>;
+      isActive: boolean;
+    }>(db, { workspaceId, reason: "codex_credential_connected" }, async (tx) => {
+      const upserted = await upsertCodexSubscriptionCredential(tx, {
+        accountId: grant.accountId,
+        workspaceId,
+        credentialEncrypted: encryptEnvironmentValue(
+          key,
+          JSON.stringify({
+            access_token: tokens.accessToken,
+            refresh_token: tokens.refreshToken,
+            id_token: tokens.idToken,
+          }),
+        ),
+        chatgptAccountId: id.chatgptAccountId,
+        scopes: null, // device grant scopes are discovered at runtime, not asserted here
+        planType: id.planType,
+        isFedramp: id.isFedramp,
+        expiresAt: accessTokenExpiry(tokens.accessToken),
+        lastRefreshAt: new Date(),
+        accountEmail: id.email ?? null,
+        label: id.email ?? id.chatgptAccountId ?? null,
+        connectedBySubjectId:
+          connectingHuman?.subjectId === grant.subjectId ? connectingHuman.subjectId : null,
+      });
+      if (upserted.kind === "unresolved_redemption") {
+        return { result: { upserted, isActive: false }, changed: false };
+      }
+      await ensureCodexRotationSettings(tx, grant.accountId, workspaceId);
+      await setInitialActiveCodexCredential(tx, workspaceId, upserted.id);
+      const source = await getWorkspaceCodexSubscriptionSource(tx, workspaceId);
+      await setWorkspaceCodexSubscriptionModeInTransaction(tx, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        mode: source.workspaceKind === "personal" ? "automatic" : "workspace",
+      });
+      const rotation = await getCodexRotationSettings(tx, workspaceId);
+      return {
+        result: {
+          upserted,
+          isActive: rotation?.activeCredentialId === upserted.id,
+        },
+        changed: true,
+      };
+    });
+    const { upserted, isActive } = mutation.result;
     if (upserted.kind === "unresolved_redemption") {
       throw new HTTPException(409, {
         message:
           "this subscription has an unresolved reset redemption; recover it before changing ownership",
       });
     }
-    // Ensure the per-workspace rotation-settings row exists, then auto-activate
-    // the FIRST account only. Additional new accounts do NOT auto-activate — a
-    // manual switch is required (no auto-rotation in P1). A re-connect of the
-    // already-active account is a no-op for the pointer.
-    // Keep both rotation bits false on first connect. The deployment flag makes
-    // the compatible allocator available, but the workspace-local cutover bit
-    // is enabled only by an explicit settings write after every worker replica
-    // understands leasing.
-    const rotation = await getCodexRotationSettings(db, workspaceId);
-    let isActive = rotation?.activeCredentialId === upserted.id;
-    if (!isActive && rotation?.activeCredentialId == null) {
-      isActive = await setInitialActiveCodexCredential(db, workspaceId, upserted.id);
-    }
     await signalCodexCapacityTargets(deps, mutation.wakeTargets);
     return c.json({ status: "connected", plan: id.planType, accountId: upserted.id, isActive });
   });
@@ -751,7 +1128,10 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!status) {
       return c.json({ connected: false });
     }
-    const accounts = await listCodexAccountStatuses(db, workspaceId);
+    const [accounts, source] = await Promise.all([
+      listCodexAccountStatuses(db, workspaceId),
+      getWorkspaceCodexSubscriptionSource(db, workspaceId),
+    ]);
     const activeRow = accounts.find((account) => account.id === status.credentialId) ?? null;
     const activeAccount = activeRow
       ? {
@@ -798,6 +1178,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       models, // ClientModel[] the picker surfaces under the "no credits" group
       activeAccount, // the account a session runs on when unpinned (label for the indicator)
       accountCount: accounts.length,
+      source,
     });
   });
 
@@ -806,11 +1187,12 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/codex/accounts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const [accounts, rotation, apps, human] = await Promise.all([
+    const [accounts, rotation, apps, human, source] = await Promise.all([
       listCodexAccountStatuses(db, workspaceId),
       getCodexRotationSettings(db, workspaceId),
       getCodexAppsSettings(db, workspaceId),
       managedCookieHuman(c, deps),
+      getWorkspaceCodexSubscriptionSource(db, workspaceId),
     ]);
     const activeAccountId = rotation?.activeCredentialId ?? null;
     const humanSubjectId = human?.subjectId === grant.subjectId ? human.subjectId : null;
@@ -825,6 +1207,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
         }),
       ),
       activeAccountId,
+      source,
       apps: {
         available: settings.codexConnectedAppsEnabled,
         credentialId: apps.credentialId,
@@ -844,6 +1227,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/codex/apps", async (c) => {
     const workspaceId = c.req.param("workspaceId");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     if (!settings.codexConnectedAppsEnabled) {
       throw new HTTPException(409, { message: "Codex Apps is disabled for this deployment" });
     }
@@ -889,6 +1273,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.delete("/v1/workspaces/:workspaceId/codex/apps", async (c) => {
     const workspaceId = c.req.param("workspaceId");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const { human, accountId } = await requireCodexAppsHuman(c, deps, workspaceId);
     const parsed = z
       .object({ expectedVersion: z.number().int().nonnegative() })
@@ -918,7 +1303,8 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   // Pure pointer flip; in-flight turns pick it up on their next token fetch.
   app.post("/v1/workspaces/:workspaceId/codex/accounts/:accountId/activate", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const accountId = c.req.param("accountId");
     const mutation = await withCodexCapacityMutation(
       db,
@@ -936,14 +1322,15 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.json({ activated: true, accountId });
   });
 
-  // Update rotation settings. admin access. sharded-rotation policy: the strategy picker is GONE —
+  // Update rotation settings. Connection-management access. Sharded-rotation policy: the strategy picker is GONE —
   // rotation-enabled always behaves as sticky-sharded (worker-side
   // effectiveRotationStrategy normalization). `rotationStrategy` in the body is
   // ACCEPTED-BUT-IGNORED so no existing SDK/UI caller breaks (deprecation), and
   // the stored column is only legacy residue kept for old-binary rollback.
   app.patch("/v1/workspaces/:workspaceId/codex/settings", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const body = (await c.req.json().catch(() => ({}))) as {
       rotationEnabled?: unknown;
       rotationStrategy?: unknown;
@@ -987,7 +1374,8 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   // Rename an account (label only in P1).
   app.patch("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const accountId = c.req.param("accountId");
     const body = (await c.req.json()) as { label?: string | null };
     const label = typeof body.label === "string" ? body.label : null;
@@ -1008,7 +1396,8 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   // an explicit 409 carrying the current version.
   app.patch("/v1/workspaces/:workspaceId/codex/accounts/:accountId/allocator", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const parsed = z
       .object({
         enabled: z.boolean(),
@@ -1046,7 +1435,8 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   // row was active (FK ON DELETE SET NULL + re-pick in the same RLS txn).
   app.delete("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const accountId = c.req.param("accountId");
     const mutation = await withCodexCapacityMutation(
       db,
@@ -1071,7 +1461,8 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   // the by-id route above.
   app.delete("/v1/workspaces/:workspaceId/codex", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const mutation = await withCodexCapacityMutation(
       db,
       { workspaceId, reason: "codex_credentials_disconnected" },
@@ -1181,7 +1572,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     const ownerRecoveries =
       human &&
       human.subjectId === grant.subjectId &&
-      hasPermission(grant.permissions, "workspace:admin")
+      hasPermission(grant.permissions, "connections:write")
         ? await listCodexResetRedemptionRecoveries(db, {
             accountId: grant.accountId,
             workspaceId,
@@ -1201,18 +1592,25 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
         const account = queue.shift();
         if (!account) return;
         const canResumeRedemption = Boolean(
+          account.source === "workspace" &&
           human &&
           human.subjectId === grant.subjectId &&
           human.subjectId === account.connectedBySubjectId &&
-          hasPermission(grant.permissions, "workspace:admin"),
+          hasPermission(grant.permissions, "connections:write"),
         );
         const canRedeem = canResumeRedemption && account.status === "active";
-        const redemptionAccess = codexRedemptionAccess({
-          connectedBySubjectId: account.connectedBySubjectId,
-          grantSubjectId: grant.subjectId,
-          managedHumanSubjectId: human?.subjectId ?? null,
-          canManage: hasPermission(grant.permissions, "workspace:admin"),
-        });
+        const redemptionAccess: CodexRedemptionAccess =
+          account.source === "organization"
+            ? {
+                ownership: "managed_human_unavailable",
+                canClaimUnownedViaReconnect: false,
+              }
+            : codexRedemptionAccess({
+                connectedBySubjectId: account.connectedBySubjectId,
+                grantSubjectId: grant.subjectId,
+                managedHumanSubjectId: human?.subjectId ?? null,
+                canManage: hasPermission(grant.permissions, "connections:write"),
+              });
         overview[account.id] = await fetchCodexAccountOverview(
           deps,
           workspaceId,
@@ -1255,21 +1653,27 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
           .filter((account) => overview[account.id] == null)
           .map(async (account) => {
             const canResumeRedemption = Boolean(
+              account.source === "workspace" &&
               human &&
               human.subjectId === grant.subjectId &&
               human.subjectId === account.connectedBySubjectId &&
-              hasPermission(grant.permissions, "workspace:admin"),
+              hasPermission(grant.permissions, "connections:write"),
             );
             const fallback = await fetchCodexAccountOverview(
               deps,
               workspaceId,
               account,
-              codexRedemptionAccess({
-                connectedBySubjectId: account.connectedBySubjectId,
-                grantSubjectId: grant.subjectId,
-                managedHumanSubjectId: human?.subjectId ?? null,
-                canManage: hasPermission(grant.permissions, "workspace:admin"),
-              }),
+              account.source === "organization"
+                ? {
+                    ownership: "managed_human_unavailable",
+                    canClaimUnownedViaReconnect: false,
+                  }
+                : codexRedemptionAccess({
+                    connectedBySubjectId: account.connectedBySubjectId,
+                    grantSubjectId: grant.subjectId,
+                    managedHumanSubjectId: human?.subjectId ?? null,
+                    canManage: hasPermission(grant.permissions, "connections:write"),
+                  }),
               false,
               canResumeRedemption,
               canResumeRedemption
@@ -1311,6 +1715,11 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       const accounts = await listCodexAccountStatuses(db, workspaceId);
       const account = accounts.find((candidate) => candidate.id === credentialId);
       if (!account) throw new HTTPException(404, { message: "codex account not found" });
+      if (account.source === "organization") {
+        throw new HTTPException(409, {
+          message: "organization Codex subscriptions are managed in Organization settings",
+        });
+      }
       let existing = await getCodexResetRedemptionAttempt(db, workspaceId, parsed.data.attemptId);
       if (account.connectedBySubjectId !== human.subjectId) {
         throw new HTTPException(403, {