@opengeni/api-router 2.5.0 → 2.6.4

package/src/routes/company-profile.ts

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import {
   ActivateCompanyProfileRevisionRequest,
+  CompanyProfileAgentPolicy,
   CompanyProfileConflictResponse,
   CompanyProfileDiffRequest,
   CompanyProfileDiffResponse,
@@ -11,6 +12,7 @@ import {
   CompanyProfileRevision,
   RollbackCompanyProfileRequest,
   UpdateCompanyProfileRequest,
+  UpdateCompanyProfileAgentPolicyRequest,
 } from "@opengeni/contracts";
 import {
   requireAccessGrant,
@@ -20,15 +22,18 @@ import {
 } from "@opengeni/core";
 import {
   activateCompanyProfileRevision,
+  CompanyProfileAgentPolicyError,
   CompanyProfileConflictError,
   CompanyProfileInvalidOperationError,
   CompanyProfileNotFoundError,
   CompanyProfileOperationReuseError,
   diffCompanyProfileRevisions,
   getCompanyProfileRevision,
+  getCompanyProfileAgentPolicy,
   listCompanyProfile,
   rollbackCompanyProfileRevision,
   updateCompanyProfile,
+  updateCompanyProfileAgentPolicy,
 } from "@opengeni/db";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
@@ -84,6 +89,15 @@ function profileError(context: Context, error: unknown): Response {
   if (error instanceof CompanyProfileInvalidOperationError) {
     return context.json({ code: "INVALID_COMPANY_PROFILE_OPERATION", message: error.message }, 422);
   }
+  if (error instanceof CompanyProfileAgentPolicyError) {
+    if (error.code === "authority_unavailable") {
+      throw new HTTPException(403, { message: error.message });
+    }
+    if (error.code === "policy_conflict" || error.code === "operation_reused") {
+      throw new HTTPException(409, { message: error.message });
+    }
+    throw new HTTPException(422, { message: error.message });
+  }
   throw error;
 }
 
@@ -97,6 +111,56 @@ function revisionId(context: Context): string {
 export function registerCompanyProfileRoutes(app: Hono, deps: ApiRouteDeps): void {
   const base = "/v1/workspaces/:workspaceId/company-profile";
 
+  app.get(`${base}/agent-policy`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "workspace:read",
+    );
+    requireDirectAccountAdmin(access);
+    try {
+      return context.json(
+        CompanyProfileAgentPolicy.parse(
+          await getCompanyProfileAgentPolicy(deps.db, {
+            accountId: access.grant.accountId,
+            workspaceId,
+            actorSubjectId: access.grant.subjectId,
+          }),
+        ),
+      );
+    } catch (error) {
+      return profileError(context, error);
+    }
+  });
+
+  app.patch(`${base}/agent-policy`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "workspace:read",
+    );
+    requireDirectAccountAdmin(access);
+    const request = await parseBody(context, UpdateCompanyProfileAgentPolicyRequest);
+    try {
+      return context.json(
+        CompanyProfileAgentPolicy.parse(
+          await updateCompanyProfileAgentPolicy(deps.db, {
+            accountId: access.grant.accountId,
+            workspaceId,
+            actorSubjectId: access.grant.subjectId,
+            ...request,
+          }),
+        ),
+      );
+    } catch (error) {
+      return profileError(context, error);
+    }
+  });
+
   app.get(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:read");

package/src/routes/computer-sessions.ts

@@ -68,6 +68,7 @@ import {
   BrowserControlServerUnsupportedError,
   BrowserControlTransportError,
   BrowserControlUnsupportedError,
+  ComputerFrameEvidenceMismatchError,
   buildSelfhostedBackendSession,
   buildStreamUrl,
   exposedPortEndpointFromUrl,
@@ -75,8 +76,11 @@ import {
   NatsControlRpc,
   NatsOpStreamTransport,
   provisionBrowserControlClient,
+  validateComputerControlFrameEvidence,
   renewSandboxProviderExpiration,
   type BrowserControlPlacementSession,
+  type ComputerControlFrame,
+  type ExpectedComputerFrameEvidence,
 } from "@opengeni/runtime/sandbox";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
@@ -101,7 +105,11 @@ import {
   createInteractionFrameProxyAttachment,
   placementUsesInteractionFrameProxy,
 } from "../interaction-frame-proxy";
-import { observeComputerActionResult, observeLifecycleResult } from "../interaction-metrics";
+import {
+  observeComputerActionResult,
+  observeComputerFrameEvidenceMismatch,
+  observeLifecycleResult,
+} from "../interaction-metrics";
 import { withChannelA, withChannelARead, type ChannelAOperation } from "../sandbox/channel-a";
 
 type ComputerPlacement = {
@@ -111,6 +119,59 @@ type ComputerPlacement = {
   lease: LeaseSnapshot | null;
 };
 
+const MODEL_COMPUTER_FRAME_MAX_BYTES = 256 * 1024;
+
+type ComputerFrameCaptureClient = {
+  capture(
+    targetId: string,
+    options: {
+      format?: "jpeg" | "png";
+      quality?: number;
+      maxWidth?: number;
+      maxHeight?: number;
+    },
+  ): Promise<ComputerControlFrame>;
+};
+
+export function validateComputerFrameForApi(
+  frame: Pick<ComputerControlFrame, "data" | "mediaType" | "metadataHeader">,
+  expected: ExpectedComputerFrameEvidence,
+): ComputerControlFrame {
+  return validateComputerControlFrameEvidence(frame, expected);
+}
+
+export async function captureModelComputerFrame(
+  sessionClient: ComputerFrameCaptureClient,
+  expected: ExpectedComputerFrameEvidence,
+): Promise<ComputerControlFrame> {
+  let captured = validateComputerFrameForApi(
+    await sessionClient.capture(expected.targetId, {
+      format: "jpeg",
+      quality: 55,
+      maxWidth: 1_024,
+      maxHeight: 768,
+    }),
+    expected,
+  );
+  if (captured.data.byteLength > MODEL_COMPUTER_FRAME_MAX_BYTES) {
+    captured = validateComputerFrameForApi(
+      await sessionClient.capture(expected.targetId, {
+        format: "jpeg",
+        quality: 30,
+        maxWidth: 640,
+        maxHeight: 480,
+      }),
+      expected,
+    );
+  }
+  if (captured.data.byteLength > MODEL_COMPUTER_FRAME_MAX_BYTES) {
+    throw new BrowserControlProtocolError(
+      "computer screenshot could not honor the model image byte bound",
+    );
+  }
+  return captured;
+}
+
 /** Public ComputerSession resource surface. Physical app/window authority stays
  * in the same placement controller used by BrowserSession; this route owns only
  * durable authorization, placement fencing, lifecycle receipts, and routing. */
@@ -389,6 +450,47 @@ export function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): vo
     },
   );
 
+  app.get(
+    "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/targets/:targetId/screenshot",
+    async (context) => {
+      const { workspaceId, grant, computerSessionId } = await routePreamble(
+        context,
+        "sessions:read",
+      );
+      const targetId = requireOpaqueParam(context, "targetId");
+      const frame = await withActiveComputerController(
+        context,
+        grant,
+        workspaceId,
+        computerSessionId,
+        "session.read",
+        "computer.read",
+        async ({ sessionClient, binding }) => {
+          try {
+            return await captureModelComputerFrame(sessionClient, {
+              computerSessionId,
+              controllerGeneration: binding.controllerGeneration,
+              targetId,
+            });
+          } catch (error) {
+            if (error instanceof ComputerFrameEvidenceMismatchError) {
+              observeComputerFrameEvidenceMismatch(deps.observability, error.reason);
+            }
+            throw error;
+          }
+        },
+      );
+      return new Response(frame.data.slice().buffer, {
+        status: 200,
+        headers: {
+          "cache-control": "no-store",
+          "content-type": frame.mediaType,
+          "x-opengeni-computer-frame": frame.metadataHeader,
+        },
+      });
+    },
+  );
+
   app.get(
     "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/clipboard",
     async (context) => {

package/src/routes/integration-facets.ts

@@ -66,7 +66,7 @@ export function registerIntegrationFacetRoutes(app: Hono, deps: ApiRouteDeps): v
         c,
         deps,
         workspaceId,
-        "workspace:admin",
+        "capabilities:manage",
       );
       const { grant } = authorization;
       try {
@@ -82,7 +82,10 @@ export function registerIntegrationFacetRoutes(app: Hono, deps: ApiRouteDeps): v
               payload: await c.req.json(),
               canManageOrganizationDestination:
                 authorization.accountGrant?.permissions.includes("account:admin") === true,
-              canManageWorkspaceDestination: hasPermission(grant.permissions, "workspace:admin"),
+              canManageWorkspaceDestination: hasPermission(
+                grant.permissions,
+                "capabilities:manage",
+              ),
               canManagePersonalDestination:
                 authorization.contextIntegrity &&
                 authorization.authenticatedSubjectId === grant.subjectId,
@@ -122,7 +125,7 @@ export function registerIntegrationFacetRoutes(app: Hono, deps: ApiRouteDeps): v
     "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
       const payload = UpsertIntegrationFacetRequest.parse(await c.req.json());
       const capabilityId = decoded(c.req.param("capabilityId"));
       const instanceKey = decoded(c.req.param("instanceKey"));
@@ -204,7 +207,7 @@ export function registerIntegrationFacetRoutes(app: Hono, deps: ApiRouteDeps): v
       `/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey/${action}`,
       async (c) => {
         const workspaceId = c.req.param("workspaceId");
-        const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+        const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
         const payload = MutateIntegrationFacetRequest.parse(await c.req.json());
         try {
           return c.json(
@@ -233,7 +236,7 @@ export function registerIntegrationFacetRoutes(app: Hono, deps: ApiRouteDeps): v
     "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
       const payload = MutateIntegrationFacetRequest.parse(await c.req.json());
       try {
         return c.json(

package/src/routes/interaction-resources.ts

@@ -58,7 +58,11 @@ import {
 import { publishDurableSessionEvents } from "@opengeni/events";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { sseWorkspaceInteractionRevisionStream, sseWorkspaceLiveStream } from "../http/sse";
+import {
+  browserSseDeliveryOptions,
+  sseWorkspaceInteractionRevisionStream,
+  sseWorkspaceLiveStream,
+} from "../http/sse";
 import { observeInterventionMutation } from "../interaction-metrics";
 
 export function registerInteractionResourceRoutes(app: Hono, deps: ApiRouteDeps): void {
@@ -74,6 +78,7 @@ export function registerInteractionResourceRoutes(app: Hono, deps: ApiRouteDeps)
       nonnegativeSafeIntegerQuery(context, "interactionAfter", 0),
       context.req.raw.signal,
       {
+        ...browserSseDeliveryOptions(context.req.query("transport")),
         observability: deps.observability,
         actorEpoch: getManagedAuthRequestActorEpoch(context.req.raw) ?? undefined,
         reauthorize: async () => {
@@ -99,6 +104,7 @@ export function registerInteractionResourceRoutes(app: Hono, deps: ApiRouteDeps)
       after,
       context.req.raw.signal,
       {
+        ...browserSseDeliveryOptions(context.req.query("transport")),
         observability: deps.observability,
         actorEpoch: getManagedAuthRequestActorEpoch(context.req.raw) ?? undefined,
         reauthorize: async () => {

package/src/routes/managed-auth-session-sets.ts

@@ -7,6 +7,7 @@ import {
   CompleteManagedAuthLoginTransactionResponse,
   LogoutManagedAuthLoginSlotRequest,
   LogoutManagedAuthSessionSetRequest,
+  MANAGED_AUTH_TRANSACTION_TTL_SECONDS,
   MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,
   MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,
   ManagedAuthDeepLinkResolution,
@@ -15,6 +16,8 @@ import {
   ManagedAuthSessionSetErrorCode,
   ResolveManagedAuthDeepLinkRequest,
   SelectManagedAuthLoginSlotRequest,
+  StartManagedAuthSocialTransactionRequest,
+  StartManagedAuthSocialTransactionResponse,
   type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType,
   type ManagedAuthSessionSetErrorCode as ManagedAuthSessionSetErrorCodeType,
 } from "@opengeni/contracts/managed-auth-session-sets";
@@ -57,11 +60,21 @@ import {
   mutateManagedAuthSessionSet,
 } from "@opengeni/db/managed-auth-session-sets";
 import { ensureManagedAccessForUser, getSession } from "@opengeni/db";
+import { sql } from "drizzle-orm";
 import type { Context, Hono } from "hono";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
 import { ApiHttpError } from "../http/api-error";
-import type { z } from "zod";
+import { z } from "zod";
+
+const ManagedAuthSocialStartReceipt = z
+  .object({
+    version: z.literal(1),
+    requestDigest: z.string().regex(/^[0-9a-f]{64}$/u),
+    url: z.string().url().max(4_096),
+    stateCookie: z.string().min(1).max(4_096),
+  })
+  .strict();
 
 export function registerManagedAuthSessionSetRoutes(app: Hono, deps: ApiRouteDeps): void {
   const noStore = async (context: Context, next: () => Promise<void>) => {
@@ -304,6 +317,129 @@ export function registerManagedAuthSessionSetRoutes(app: Hono, deps: ApiRouteDep
     }
   });
 
+  app.post("/v1/auth/session-set/transactions/social", async (context) => {
+    const body = await bodyAs(context, StartManagedAuthSocialTransactionRequest);
+    const { authority, actorEpoch } = await requireMutation(context, deps, body.expectedGeneration);
+    const available = requireAvailable(deps);
+    if (!managedAuthSocialProviderConfigured(deps, body.provider)) {
+      throw managedAuthApiError(404, "managed_authentication_unavailable");
+    }
+    const transactionSecret = requireTransactionSecret(context, body.transactionId);
+    const publicBaseUrl = deps.settings.publicBaseUrl;
+    if (!publicBaseUrl) {
+      throw managedAuthApiError(503, "managed_authentication_unavailable", {
+        retryable: true,
+      });
+    }
+    const callbackURL = new URL("/account-auth", publicBaseUrl);
+    callbackURL.searchParams.set("transaction", body.transactionId);
+    callbackURL.searchParams.set("social", "complete");
+    const errorCallbackURL = new URL(callbackURL);
+    errorCallbackURL.searchParams.set("social", "error");
+    try {
+      const authorityHash = managedAuthSha256(authority);
+      const transactionSecretHash = managedAuthSha256(transactionSecret);
+      const requestDigest = digest(deps, {
+        operation: "social_start",
+        authorityHash,
+        actorEpoch,
+        transactionSecretHash,
+        request: body,
+      });
+      const receiptIdentifier = `opengeni-managed-social-start:${authorityHash}:${body.operationId}`;
+      const receipt = await deps.db.transaction(async (transaction) => {
+        await transaction.execute(
+          sql`select pg_advisory_xact_lock(hashtextextended(${receiptIdentifier}, 0))`,
+        );
+        const authContext = await available.managedAuth.$context;
+        const stored = await authContext.internalAdapter.findVerificationValue(receiptIdentifier);
+        if (stored && new Date(stored.expiresAt).getTime() > Date.now()) {
+          let parsed: ReturnType<typeof ManagedAuthSocialStartReceipt.safeParse>;
+          try {
+            parsed = ManagedAuthSocialStartReceipt.safeParse(JSON.parse(stored.value));
+          } catch (error) {
+            throw new ManagedAuthCompletionOutcomeUnknownError({
+              cause: error,
+            });
+          }
+          if (!parsed.success) {
+            throw new ManagedAuthCompletionOutcomeUnknownError({
+              cause: parsed.error,
+            });
+          }
+          if (parsed.data.requestDigest !== requestDigest) {
+            throw new ManagedAuthSessionSetOperationReuseError();
+          }
+          return parsed.data;
+        }
+        if (stored) {
+          await authContext.internalAdapter.deleteVerificationByIdentifier(receiptIdentifier);
+        }
+        const result = await available.managedAuth.api.signInSocial({
+          body: {
+            provider: body.provider,
+            disableRedirect: true,
+            callbackURL: callbackURL.toString(),
+            errorCallbackURL: errorCallbackURL.toString(),
+            additionalData: {
+              opengeniManagedAuth: {
+                version: 1,
+                operationId: body.operationId,
+                provider: body.provider,
+                transactionId: body.transactionId,
+                authorityHash,
+                transactionSecretHash,
+                expectedGeneration: body.expectedGeneration,
+                expectedActorEpoch: actorEpoch,
+              },
+            },
+          },
+          headers: isolatedManagedAuthHeaders(context.req.raw),
+          returnHeaders: true,
+        });
+        const url = validatedManagedAuthSocialAuthorizationUrl({
+          provider: body.provider,
+          rawUrl: result.response?.url,
+          expectedClientId:
+            body.provider === "google"
+              ? deps.settings.managedAuthGoogleClientId!
+              : deps.settings.managedAuthGithubClientId!,
+          expectedCallbackUrl: new URL(
+            `/v1/auth/callback/${body.provider}`,
+            publicBaseUrl,
+          ).toString(),
+        });
+        const stateCookieName = authContext.createAuthCookie("state").name;
+        const stateCookie = setCookieHeaders(result.headers).find((cookie) =>
+          cookie.startsWith(`${stateCookieName}=`),
+        );
+        const parsed = ManagedAuthSocialStartReceipt.parse({
+          version: 1,
+          requestDigest,
+          url,
+          stateCookie,
+        });
+        const created = await authContext.internalAdapter.createVerificationValue({
+          identifier: receiptIdentifier,
+          value: JSON.stringify(parsed),
+          expiresAt: new Date(Date.now() + MANAGED_AUTH_TRANSACTION_TTL_SECONDS * 1_000),
+        });
+        if (!created) {
+          throw new ManagedAuthCompletionOutcomeUnknownError();
+        }
+        return parsed;
+      });
+      context.header("set-cookie", receipt.stateCookie, { append: true });
+      return jsonWithActorEpoch(
+        context,
+        actorEpoch,
+        StartManagedAuthSocialTransactionResponse.parse({ url: receipt.url }),
+      );
+    } catch (error) {
+      throwHttp(error);
+    }
+  });
+
   app.delete("/v1/auth/session-set/transactions/:transactionId", async (context) => {
     const body = await bodyAs(context, CancelManagedAuthLoginTransactionRequest);
     if (body.transactionId !== context.req.param("transactionId")) invalid();
@@ -449,6 +585,46 @@ export function registerManagedAuthSessionSetRoutes(app: Hono, deps: ApiRouteDep
   });
 }
 
+export function validatedManagedAuthSocialAuthorizationUrl(input: {
+  provider: "google" | "github";
+  rawUrl: unknown;
+  expectedClientId: string;
+  expectedCallbackUrl: string;
+}): string {
+  if (typeof input.rawUrl !== "string") {
+    throw new ManagedAuthCompletionOutcomeUnknownError();
+  }
+  let url: URL;
+  try {
+    url = new URL(input.rawUrl);
+  } catch (error) {
+    throw new ManagedAuthCompletionOutcomeUnknownError({ cause: error });
+  }
+  const expectedEndpoint =
+    input.provider === "google"
+      ? { origin: "https://accounts.google.com", pathname: "/o/oauth2/v2/auth" }
+      : { origin: "https://github.com", pathname: "/login/oauth/authorize" };
+  const exactlyOne = (name: string, expected?: string): boolean => {
+    const values = url.searchParams.getAll(name);
+    return (
+      values.length === 1 && values[0] !== "" && (expected === undefined || values[0] === expected)
+    );
+  };
+  if (
+    url.origin !== expectedEndpoint.origin ||
+    url.pathname !== expectedEndpoint.pathname ||
+    url.username ||
+    url.password ||
+    url.hash ||
+    !exactlyOne("client_id", input.expectedClientId) ||
+    !exactlyOne("redirect_uri", input.expectedCallbackUrl) ||
+    !exactlyOne("state")
+  ) {
+    throw new ManagedAuthCompletionOutcomeUnknownError();
+  }
+  return input.rawUrl;
+}
+
 /**
  * Better Auth 1.6.26 provider lifecycle routes retained while session-set mode
  * owns all selected-session reads, enumeration, revocation, and user mutation.
@@ -470,21 +646,42 @@ export function requireManagedAuthProviderRouteAllowed(method: string, pathname:
       (pathname === "/v1/auth/verify-email" ||
         pathname === "/v1/auth/error" ||
         pathname === "/v1/auth/ok" ||
+        /^\/v1\/auth\/callback\/(?:google|github)$/.test(pathname) ||
         /^\/v1\/auth\/reset-password\/[^/]+$/.test(pathname)));
   if (!allowed) throw managedAuthApiError(409, "provider_route_blocked");
 }
 
+function managedAuthSocialProviderConfigured(
+  deps: ApiRouteDeps,
+  provider: "google" | "github",
+): boolean {
+  return provider === "google"
+    ? Boolean(
+        deps.settings.managedAuthGoogleClientId && deps.settings.managedAuthGoogleClientSecret,
+      )
+    : Boolean(
+        deps.settings.managedAuthGithubClientId && deps.settings.managedAuthGithubClientSecret,
+      );
+}
+
 /** Remove provider bearer/session material and enforce browser-auth cache/cookie policy. */
 export async function scrubManagedAuthProviderResponse(
   response: Response,
-  options: { replacementCookies?: readonly string[] | undefined } = {},
+  options: {
+    replacementCookies?: readonly string[] | undefined;
+    preserveCookieNames?: readonly string[] | undefined;
+  } = {},
 ): Promise<Response> {
   const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
   const headers = new Headers(response.headers);
   headers.set("cache-control", "no-store");
   headers.set("pragma", "no-cache");
   if (options.replacementCookies !== undefined) {
+    const preserved = setCookieHeaders(response.headers).filter((cookie) =>
+      options.preserveCookieNames?.some((name) => cookie.startsWith(`${name}=`)),
+    );
     headers.delete("set-cookie");
+    for (const cookie of preserved) headers.append("set-cookie", cookie);
     for (const cookie of options.replacementCookies) headers.append("set-cookie", cookie);
   }
   let body: BodyInit | null = response.body;