@opengeni/api-router 2.6.4-canary.0 → 2.8.1-canary.0

package/src/routes/codex.ts

@@ -223,7 +223,7 @@ async function managedCookieHuman(
   };
 }
 
-async function requireOrganizationCodexHuman(
+export async function requireOrganizationCodexHuman(
   c: Context,
   deps: ApiRouteDeps,
   organizationId: string,
@@ -239,7 +239,9 @@ async function requireOrganizationCodexHuman(
     };
   }
   if (!human) {
-    throw new HTTPException(401, { message: "organization administrator session required" });
+    throw new HTTPException(401, {
+      message: "organization administrator session required",
+    });
   }
   try {
     await getOrganizationCodexRotationSettings(deps.db, {
@@ -249,7 +251,9 @@ async function requireOrganizationCodexHuman(
   } catch (error) {
     const state = nestedPostgresSqlState(error);
     if (state === "42501") {
-      throw new HTTPException(403, { message: "organization administration is not authorized" });
+      throw new HTTPException(403, {
+        message: "organization administration is not authorized",
+      });
     }
     if (state === "P0002") {
       throw new HTTPException(404, { message: "organization not found" });
@@ -270,11 +274,13 @@ async function requireWorkspaceCodexManagementSource(
     });
   }
   if (source.effectiveSource === "disabled") {
-    throw new HTTPException(409, { message: "Codex is disabled for this workspace" });
+    throw new HTTPException(409, {
+      message: "Codex is disabled for this workspace",
+    });
   }
 }
 
-function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void {
+export function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void {
   const contentType = c.req.header("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
   if (contentType !== "application/json") {
     throw new HTTPException(403, {
@@ -287,16 +293,28 @@ function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void
     });
   }
   const origin = c.req.header("origin");
+  const localOriginMatches =
+    deps.settings.productAccessMode === "local" && localBrowserOriginMatchesRequest(c, origin);
   if (
     deps.settings.productAccessMode === "local"
-      ? !localBrowserOriginMatchesRequest(c, origin)
+      ? !localOriginMatches
       : origin !== new URL(deps.settings.publicBaseUrl!).origin
   ) {
     throw new HTTPException(403, {
       message: "same-origin browser request required",
     });
   }
-  if (c.req.header("sec-fetch-site")?.toLowerCase() !== "same-origin") {
+  const fetchSite = c.req.header("sec-fetch-site")?.toLowerCase();
+  const localFetchSiteMatches =
+    localOriginMatches &&
+    (fetchSite === "same-origin" ||
+      fetchSite === "same-site" ||
+      (fetchSite === "cross-site" && localLoopbackOriginMatchesRequest(c, origin)));
+  if (
+    deps.settings.productAccessMode === "local"
+      ? !localFetchSiteMatches
+      : fetchSite !== "same-origin"
+  ) {
     throw new HTTPException(403, {
       message: "same-origin fetch metadata required",
     });
@@ -333,11 +351,35 @@ function localBrowserOriginMatchesRequest(c: Context, value: string | undefined)
   }
   return (
     origin.protocol === request.protocol &&
-    origin.hostname === request.hostname &&
-    (request.port === "" || origin.port === request.port)
+    (origin.hostname === request.hostname ||
+      (isLoopbackHostname(origin.hostname) && isLoopbackHostname(request.hostname)))
   );
 }
 
+function localLoopbackOriginMatchesRequest(c: Context, value: string | undefined): boolean {
+  if (!value) return false;
+  try {
+    const origin = new URL(value);
+    const forwardedProtocol = c.req.header("x-forwarded-proto")?.trim().toLowerCase();
+    const protocol = forwardedProtocol ? `${forwardedProtocol}:` : new URL(c.req.url).protocol;
+    const forwardedHost = c.req.header("x-forwarded-host") ?? c.req.header("host");
+    if (!forwardedHost || /[\s,/?#@\\]/u.test(forwardedHost)) return false;
+    const request = new URL(`${protocol}//${forwardedHost}`);
+    return (
+      origin.origin === value &&
+      origin.protocol === request.protocol &&
+      isLoopbackHostname(origin.hostname) &&
+      isLoopbackHostname(request.hostname)
+    );
+  } catch {
+    return false;
+  }
+}
+
+function isLoopbackHostname(value: string): boolean {
+  return value === "localhost" || value === "[::1]" || /^127(?:\.[0-9]{1,3}){3}$/u.test(value);
+}
+
 async function requireRedemptionHuman(
   c: Context,
   deps: ApiRouteDeps,
@@ -386,11 +428,15 @@ async function requireCodexAppsHuman(
   requireSameOriginBrowserMutation(c, deps);
   const human = await managedCookieHuman(c, deps);
   if (!human) {
-    throw new HTTPException(401, { message: "managed browser session required" });
+    throw new HTTPException(401, {
+      message: "managed browser session required",
+    });
   }
   const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
   if (grant.subjectId !== human.subjectId) {
-    throw new HTTPException(403, { message: "managed browser identity mismatch" });
+    throw new HTTPException(403, {
+      message: "managed browser identity mismatch",
+    });
   }
   return { human, accountId: grant.accountId };
 }
@@ -715,10 +761,14 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
     const parsed = z
-      .object({ mode: z.enum(["automatic", "workspace", "organization", "disabled"]) })
+      .object({
+        mode: z.enum(["automatic", "workspace", "organization", "disabled"]),
+      })
       .safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException(400, { message: "a valid Codex source mode is required" });
+      throw new HTTPException(400, {
+        message: "a valid Codex source mode is required",
+      });
     }
     try {
       return c.json(
@@ -795,7 +845,9 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     const organizationId = c.req.param("organizationId");
     requireSameOriginBrowserMutation(c, deps);
     const human = await requireOrganizationCodexHuman(c, deps, organizationId);
-    const { state } = (await c.req.json().catch(() => null)) as { state?: string };
+    const { state } = (await c.req.json().catch(() => null)) as {
+      state?: string;
+    };
     const payload = (state
       ? readSignedState(state, githubStateSecret)
       : null) as unknown as CodexConnectState | null;
@@ -806,7 +858,9 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       !payload.deviceAuthId ||
       !payload.userCode
     ) {
-      throw new HTTPException(400, { message: "codex connect state is invalid or expired" });
+      throw new HTTPException(400, {
+        message: "codex connect state is invalid or expired",
+      });
     }
     if (
       typeof payload.iat === "number" &&
@@ -927,7 +981,9 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     const organizationId = c.req.param("organizationId");
     requireSameOriginBrowserMutation(c, deps);
     const human = await requireOrganizationCodexHuman(c, deps, organizationId);
-    const body = (await c.req.json().catch(() => null)) as { label?: unknown } | null;
+    const body = (await c.req.json().catch(() => null)) as {
+      label?: unknown;
+    } | null;
     const renamed = await renameOrganizationCodexAccount(db, {
       organizationId,
       actorSubjectId: human.subjectId,
@@ -967,7 +1023,10 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw error;
     }
     await signalCodexCapacityTargets(deps, result.wakeTargets);
-    return c.json({ disconnected: result.removed, newActiveId: result.newActiveCredentialId });
+    return c.json({
+      disconnected: result.removed,
+      newActiveId: result.newActiveCredentialId,
+    });
   });
 
   // Begin device-code login: returns the user code + verification URL and a
@@ -1065,6 +1124,8 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       upserted: Awaited<ReturnType<typeof upsertCodexSubscriptionCredential>>;
       isActive: boolean;
     }>(db, { workspaceId, reason: "codex_credential_connected" }, async (tx) => {
+      // The capacity mutation holds the source lock before entering this callback.
+      const sourceBeforeConnect = await getWorkspaceCodexSubscriptionSource(tx, workspaceId);
       const upserted = await upsertCodexSubscriptionCredential(tx, {
         accountId: grant.accountId,
         workspaceId,
@@ -1092,12 +1153,12 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       }
       await ensureCodexRotationSettings(tx, grant.accountId, workspaceId);
       await setInitialActiveCodexCredential(tx, workspaceId, upserted.id);
-      const source = await getWorkspaceCodexSubscriptionSource(tx, workspaceId);
       await setWorkspaceCodexSubscriptionModeInTransaction(tx, {
         accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
-        mode: source.workspaceKind === "personal" ? "automatic" : "workspace",
+        mode: sourceBeforeConnect.workspaceKind === "personal" ? "automatic" : "workspace",
+        effectiveSourceBeforeMutation: sourceBeforeConnect.effectiveSource,
       });
       const rotation = await getCodexRotationSettings(tx, workspaceId);
       return {
@@ -1107,6 +1168,14 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
         },
         changed: true,
       };
+    }).catch((error: unknown) => {
+      const cause = (error as { cause?: unknown } | null)?.cause;
+      const message =
+        cause instanceof Error ? cause.message : error instanceof Error ? error.message : "";
+      if (message.includes("active turns are using it")) {
+        throw new HTTPException(409, { message });
+      }
+      throw error;
     });
     const { upserted, isActive } = mutation.result;
     if (upserted.kind === "unresolved_redemption") {
@@ -1116,7 +1185,12 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       });
     }
     await signalCodexCapacityTargets(deps, mutation.wakeTargets);
-    return c.json({ status: "connected", plan: id.planType, accountId: upserted.id, isActive });
+    return c.json({
+      status: "connected",
+      plan: id.planType,
+      accountId: upserted.id,
+      isActive,
+    });
   });
 
   // Connection health: the cheapest real call is GET /codex/models (a 200 proves
@@ -1229,7 +1303,9 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     await requireWorkspaceCodexManagementSource(deps, workspaceId);
     if (!settings.codexConnectedAppsEnabled) {
-      throw new HTTPException(409, { message: "Codex Apps is disabled for this deployment" });
+      throw new HTTPException(409, {
+        message: "Codex Apps is disabled for this deployment",
+      });
     }
     const { human, accountId } = await requireCodexAppsHuman(c, deps, workspaceId);
     const parsed = z
@@ -1239,7 +1315,9 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       })
       .safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException(400, { message: "accountId and expectedVersion are required" });
+      throw new HTTPException(400, {
+        message: "accountId and expectedVersion are required",
+      });
     }
     const result = await designateCodexAppsCredential(db, {
       accountId,
@@ -1257,10 +1335,14 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       });
     }
     if (result.kind === "forbidden") {
-      throw new HTTPException(403, { message: "missing permission: connections:write" });
+      throw new HTTPException(403, {
+        message: "missing permission: connections:write",
+      });
     }
     if (result.kind === "unavailable") {
-      throw new HTTPException(409, { message: "codex account requires relogin" });
+      throw new HTTPException(409, {
+        message: "codex account requires relogin",
+      });
     }
     const response = {
       credentialId: result.credentialId,
@@ -1288,7 +1370,9 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       expectedVersion: parsed.data.expectedVersion,
     });
     if (result.kind === "forbidden") {
-      throw new HTTPException(403, { message: "missing permission: connections:write" });
+      throw new HTTPException(403, {
+        message: "missing permission: connections:write",
+      });
     }
     const response = {
       credentialId: result.credentialId,
@@ -1345,7 +1429,10 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (patch.rotationEnabled === undefined) {
       // Strategy-only writes are a deprecated no-op (no db touch): report the
       // (only) truth. Callers that also flip rotationEnabled fall through.
-      return c.json({ rotationStrategy: "sharded", rotationStrategyDeprecated: true });
+      return c.json({
+        rotationStrategy: "sharded",
+        rotationStrategyDeprecated: true,
+      });
     }
     await ensureCodexRotationSettings(db, grant.accountId, workspaceId);
     const mutation = await withCodexCapacityMutation(
@@ -1454,7 +1541,10 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       });
     }
     await signalCodexCapacityTargets(deps, mutation.wakeTargets);
-    return c.json({ disconnected: result.removed, newActiveId: result.newActiveCredentialId });
+    return c.json({
+      disconnected: result.removed,
+      newActiveId: result.newActiveCredentialId,
+    });
   });
 
   // Legacy "disconnect all" (old workspace-wide behavior), deprecated in favor of
@@ -1752,10 +1842,14 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
           });
         }
         if (adoption.kind === "not_found") {
-          throw new HTTPException(409, { message: "redemption recovery state changed" });
+          throw new HTTPException(409, {
+            message: "redemption recovery state changed",
+          });
         }
         if (adoption.kind === "forbidden") {
-          throw new HTTPException(403, { message: "redemption owner is unavailable" });
+          throw new HTTPException(403, {
+            message: "redemption owner is unavailable",
+          });
         }
         if (adoption.kind === "conflict") {
           throw new HTTPException(409, {
@@ -1769,7 +1863,9 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       // and a lost HTTP response must remain replayable after a later health
       // transition without another consume call.
       if (account.status !== "active" && existing?.status !== "completed") {
-        throw new HTTPException(403, { message: "redemption credential is unavailable" });
+        throw new HTTPException(403, {
+          message: "redemption credential is unavailable",
+        });
       }
       const secret = settings.betterAuthSecret;
       if (!secret) {
@@ -1968,13 +2064,21 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       if (fenced.kind !== "ready") {
         if (fenced.reason === "confirmation_expired") {
           return c.json(
-            { status: "confirmation_expired", attemptId: attempt.id, retryable: true },
+            {
+              status: "confirmation_expired",
+              attemptId: attempt.id,
+              retryable: true,
+            },
             403,
           );
         }
         if (fenced.reason === "credential_unavailable") {
           return c.json(
-            { status: "provider_unavailable", attemptId: attempt.id, retryable: true },
+            {
+              status: "provider_unavailable",
+              attemptId: attempt.id,
+              retryable: true,
+            },
             503,
           );
         }

package/src/routes/github.ts

@@ -4,6 +4,11 @@ import {
   type GitHubInstallationBindingCandidate,
   type GitHubInstallationBindingProof,
 } from "@opengeni/contracts";
+import {
+  ListGitHubRepositoryBranchesQuery,
+  VerifyPublicGitHubRepositoryRefRequest,
+} from "@opengeni/contracts/github-repository-contracts";
+import { parseCanonicalGitHubRepositoryUrl } from "@opengeni/contracts/github-repository";
 import {
   bindAuthorizedGitHubInstallationRepositories,
   deleteGitHubInstallationBinding,
@@ -19,12 +24,14 @@ import {
   GitHubAppApiError,
   GitHubAppConfigurationError,
   GitHubInstallationAuthorityError,
+  GitHubPublicRepositoryVerificationError,
   githubAppMissingSettings,
   githubOAuthAuthorizeUrl,
   organizationAppManifestUrl,
   personalAppManifestUrl,
   readSignedState,
   stateMaxAgeSeconds,
+  verifyPublicGitHubRepositoryRef,
   type GitHubSignedStatePayload,
   verifySignedState,
 } from "@opengeni/github";
@@ -42,7 +49,9 @@ import {
 } from "../github-browser-flow";
 import {
   githubBindingStatus,
+  GitHubRepositoryBranchAuthorityError,
   listWorkspaceGitHubInstallationBindings,
+  listWorkspaceGitHubRepositoryBranches,
   listWorkspaceGitHubRepositories,
 } from "../github-access";
 
@@ -177,6 +186,65 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
   });
 
+  app.post("/v1/workspaces/:workspaceId/github/public-repositories/verify", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId);
+    requirePublicGitHubRepositoryVerificationPermission(grant);
+    const request = VerifyPublicGitHubRepositoryRefRequest.parse(await c.req.json());
+    let repository: ReturnType<typeof parseCanonicalGitHubRepositoryUrl>;
+    try {
+      repository = parseCanonicalGitHubRepositoryUrl(request.url);
+    } catch (error) {
+      throw new HTTPException(422, {
+        message: error instanceof Error ? error.message : "GitHub repository URL is invalid.",
+      });
+    }
+    try {
+      return c.json(
+        await verifyPublicGitHubRepositoryRef(
+          { repository, ref: request.ref },
+          deps.githubAnonymousFetch ?? fetch,
+        ),
+      );
+    } catch (error) {
+      if (error instanceof GitHubPublicRepositoryVerificationError) {
+        throw new HTTPException(error.code === "provider_unavailable" ? 503 : 422, {
+          message: error.message,
+        });
+      }
+      throw new HTTPException(503, {
+        message: "GitHub public repository verification is temporarily unavailable.",
+      });
+    }
+  });
+
+  app.get(
+    "/v1/workspaces/:workspaceId/github/installations/:installationId/repositories/:repositoryId/branches",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "github:use");
+      const installationId = parsePositiveInteger(c.req.param("installationId"));
+      const repositoryId = parsePositiveInteger(c.req.param("repositoryId"));
+      if (installationId === null || repositoryId === null) {
+        throw new HTTPException(400, { message: "invalid GitHub repository identity" });
+      }
+      const query = ListGitHubRepositoryBranchesQuery.parse(c.req.query());
+      try {
+        return c.json(
+          await listWorkspaceGitHubRepositoryBranches(deps, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            installationId,
+            repositoryId,
+            query,
+          }),
+        );
+      } catch (error) {
+        throw githubRepositoryBranchesRouteError(error);
+      }
+    },
+  );
+
   app.delete("/v1/workspaces/:workspaceId/github/installations/:installationId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "github:manage");
@@ -184,14 +252,11 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (installationId === null) {
       throw new HTTPException(400, { message: "invalid GitHub installation id" });
     }
-    const deleted = await deleteGitHubInstallationBinding(db, {
+    await deleteGitHubInstallationBinding(db, {
       accountId: grant.accountId,
       workspaceId: grant.workspaceId,
       installationId,
     });
-    if (!deleted) {
-      throw new HTTPException(404, { message: "GitHub installation binding not found" });
-    }
     return c.body(null, 204);
   });
 
@@ -749,6 +814,50 @@ function githubAuthorityHttpError(error: unknown): HTTPException {
   return new HTTPException(502, { message: "GitHub authority verification failed" });
 }
 
+function githubRepositoryBranchesRouteError(error: unknown): Error {
+  if (error instanceof HTTPException) {
+    return error;
+  }
+  if (error instanceof GitHubRepositoryBranchAuthorityError) {
+    return error.code === "not_authorized"
+      ? new HTTPException(404, {
+          message: "GitHub repository is not authorized for this workspace",
+        })
+      : new HTTPException(409, {
+          message: "GitHub repository authorization changed; refresh and try again",
+        });
+  }
+  if (error instanceof GitHubAppConfigurationError) {
+    return new HTTPException(409, { message: "GitHub App is not configured" });
+  }
+  if (error instanceof GitHubAppApiError) {
+    if (error.status === 429) {
+      return new HTTPException(503, { message: "GitHub is temporarily rate limited" });
+    }
+    if (error.status === 401 || error.status === 403 || error.status === 404) {
+      return new HTTPException(409, {
+        message: "GitHub repository access changed; refresh and try again",
+      });
+    }
+    return new HTTPException(502, { message: "GitHub branch discovery is unavailable" });
+  }
+  return new HTTPException(502, { message: "GitHub branch discovery is unavailable" });
+}
+
+export function requirePublicGitHubRepositoryVerificationPermission(
+  grant: Pick<AccessGrant, "permissions">,
+): void {
+  if (
+    hasPermission(grant.permissions, "sessions:create") ||
+    hasPermission(grant.permissions, "sessions:control")
+  ) {
+    return;
+  }
+  throw new HTTPException(403, {
+    message: "missing permission: sessions:create or sessions:control",
+  });
+}
+
 function isSecureRequest(c: Context, deps: ApiRouteDeps): boolean {
   return (
     deps.settings.publicBaseUrl?.startsWith("https://") ||
@@ -775,15 +884,15 @@ function githubInstallationChooserHtml(
 ): string {
   const action = `${baseUrl}/v1/workspaces/${encodeURIComponent(workspaceId)}/github/installations/select`;
   const options = candidates
-    .map(({ installation, authorityKind }) => {
+    .map(({ installation, authorityKind }, index) => {
       const account = escapeHtml(
         installation.accountLogin ?? `installation ${installation.installationId}`,
       );
       const label = authorityKind === "personal_owner" ? "Personal account" : "Organization owner";
-      return `<label class="option"><input type="radio" name="installation_id" value="${installation.installationId}" required><span><strong>${account}</strong><small>${label}</small></span></label>`;
+      return `<label class="option"><input type="radio" name="installation_id" value="${installation.installationId}" required${candidates.length === 1 && index === 0 ? " checked" : ""}><span><strong>${account}</strong><small>${label}</small></span></label>`;
     })
     .join("");
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Choose GitHub installation</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:12px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px}p{margin:0 0 18px;color:#d4d4d8}.options{display:grid;gap:8px;margin-bottom:18px}.option{display:flex;align-items:center;gap:12px;border:1px solid #3f3f46;border-radius:8px;padding:12px;cursor:pointer}.option span{display:grid;gap:2px}.option small{color:#a1a1aa}button{min-height:38px;border-radius:7px;border:1px solid #3f3f46;padding:0 14px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}.secondary{margin-left:8px;background:transparent;color:#f4f4f5}</style></head><body><main><h1>Choose a GitHub account</h1><p>Only installations where GitHub proved you are the personal owner or an active organization owner are shown.</p><form method="get" action="${escapeHtml(action)}"><input type="hidden" name="state" value="${escapeHtml(state)}"><div class="options">${options}</div><button type="submit">Connect selected</button><button class="secondary" type="submit" name="installation_id" value="new" formnovalidate>Install on another account</button></form></main></body></html>`;
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Choose GitHub installation</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:12px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px}p{margin:0 0 18px;color:#d4d4d8}.options{display:grid;gap:8px;margin-bottom:18px}.option{display:flex;align-items:center;gap:12px;border:1px solid #3f3f46;border-radius:8px;padding:12px;cursor:pointer}.option span{display:grid;gap:2px}.option small{color:#a1a1aa}button{min-height:38px;border-radius:7px;border:1px solid #3f3f46;padding:0 14px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}.secondary{margin-left:8px;background:transparent;color:#f4f4f5}</style></head><body><main><h1>Choose a GitHub account</h1><p>These accounts already have the OpenGeni GitHub App installed and GitHub proved you are the personal owner or an active organization owner.</p><form method="get" action="${escapeHtml(action)}"><input type="hidden" name="state" value="${escapeHtml(state)}"><div class="options">${options}</div><button type="submit">Connect selected</button><button class="secondary" type="submit" name="installation_id" value="new" formnovalidate>Install on another account</button></form></main></body></html>`;
 }
 
 function githubSetupPendingHtml(): string {

package/src/routes/organization-memberships.ts

@@ -1,5 +1,7 @@
 import {
   AcceptOrganizationInvitationRequest,
+  CreateAdditionalOrganizationRequest,
+  CreateAdditionalOrganizationResponse,
   CreateOrganizationRequest,
   CreateOrganizationResponse,
   CreateOrganizationWorkspaceRequest,
@@ -40,6 +42,7 @@ import {
   acceptOrganizationInvitation,
   bindPendingOrganizationInvitationsForVerifiedEmail,
   claimOrganizationUserSetupDelivery,
+  createAdditionalManagedOrganization,
   createManagedOrganization,
   createOrganizationWorkspace,
   createOrganizationInvitation,
@@ -68,6 +71,7 @@ import {
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
+import { deleteWorkspaceForRequest } from "../workspace-deletion";
 
 import {
   assertOrganizationUserSetupDeliveryConfigured,
@@ -117,7 +121,9 @@ async function requireOrganizationAdministrator(
     );
     return { subjectId };
   }
-  throw new HTTPException(401, { message: "organization administrator session required" });
+  throw new HTTPException(401, {
+    message: "organization administrator session required",
+  });
 }
 
 async function parseBody<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
@@ -136,8 +142,14 @@ function parseId(schema: z.ZodString, value: string, label: string): string {
   return parsed.data;
 }
 
-function rethrowMembershipError(error: unknown): never {
-  const status = organizationMembershipHttpStatus(nestedPostgresSqlState(error));
+function rethrowMembershipError(error: unknown, resourceLimitMessage?: string): never {
+  const sqlState = nestedPostgresSqlState(error);
+  if (sqlState === "54000" && resourceLimitMessage) {
+    throw new HTTPException(409, {
+      message: resourceLimitMessage,
+    });
+  }
+  const status = organizationMembershipHttpStatus(sqlState);
   if (status !== null) {
     throw new HTTPException(status, {
       message:
@@ -173,6 +185,25 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
     }
   });
 
+  app.post("/v1/organizations/additional", async (context) => {
+    const { session, subjectId } = await requireManagedHuman(context, deps);
+    const payload = await parseBody(context, CreateAdditionalOrganizationRequest);
+    try {
+      return context.json(
+        CreateAdditionalOrganizationResponse.parse(
+          await createAdditionalManagedOrganization(deps.db, {
+            subjectId,
+            subjectLabel: session.user.email || session.user.name,
+            ...payload,
+          }),
+        ),
+        201,
+      );
+    } catch (error) {
+      rethrowMembershipError(error, "additional organization limit reached");
+    }
+  });
+
   app.get("/v1/organization-memberships", async (context) => {
     const { session } = await requireManagedHuman(context, deps);
     try {
@@ -328,6 +359,22 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
     }
   });
 
+  app.delete("/v1/organizations/:organizationId/workspaces/:workspaceId", async (context) => {
+    const organizationId = parseId(
+      OrganizationId,
+      context.req.param("organizationId"),
+      "organization id",
+    );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId);
+    const workspaceId = parseId(WorkspaceId, context.req.param("workspaceId"), "workspace id");
+    await deleteWorkspaceForRequest(deps, {
+      accountId: organizationId,
+      workspaceId,
+      organizationAdministratorSubjectId: subjectId,
+    });
+    return context.body(null, 204);
+  });
+
   app.patch(
     "/v1/organizations/:organizationId/workspaces/:workspaceId/settings",
     async (context) => {