@opengeni/api-router 2.6.4 → 2.10.0-canary.0

package/src/routes/workspace-artifacts.ts

@@ -3,22 +3,32 @@ import {
   CreateWorkspaceArtifactRequest,
   PublishWorkspaceArtifactVersionRequest,
   RollbackWorkspaceArtifactRequest,
+  SetWorkspaceArtifactStatusRequest,
   WorkspaceArtifactContentResponse,
   WorkspaceArtifactDetailResponse,
   WorkspaceArtifactListQuery,
   WorkspaceArtifactListResponse,
   WorkspaceArtifactMutationResponse,
   normalizeWorkspaceArtifactSlug,
+  type AccessGrant,
 } from "@opengeni/contracts";
-import { requireAccessGrant, type ApiRouteDeps } from "@opengeni/core";
-import { retryWhileMissing } from "@opengeni/storage";
+import {
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  requireSessionAuthorization,
+  SessionAuthorizationDeniedError,
+  SessionAuthorizationUnavailableError,
+  type ApiRouteDeps,
+} from "@opengeni/core";
 import {
   createWorkspaceArtifact,
   getWorkspaceArtifact,
   getWorkspaceArtifactContentRef,
   listWorkspaceArtifacts,
+  nestedPostgresSqlState,
   publishWorkspaceArtifactVersion,
   rollbackWorkspaceArtifact,
+  setWorkspaceArtifactStatus,
   WorkspaceArtifactConflictError,
   WorkspaceArtifactNotFoundError,
   WorkspaceArtifactOperationError,
@@ -26,10 +36,17 @@ import {
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
+import {
+  prepareWorkspaceArtifactContent,
+  readWorkspaceArtifactContent,
+} from "../workspace-artifact-content";
+import {
+  projectWorkspaceArtifactDetailProvenance,
+  projectWorkspaceArtifactMutationProvenance,
+  redactWorkspaceArtifactListProvenance,
+} from "../workspace-artifact-provenance";
 
 const ArtifactId = z.string().uuid();
-const encoder = new TextEncoder();
-const decoder = new TextDecoder("utf-8", { fatal: true });
 
 async function body<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
@@ -43,7 +60,7 @@ function artifactId(context: Context): string {
   return parsed.data;
 }
 
-function errorResponse(context: Context, error: unknown): Response {
+export function workspaceArtifactErrorResponse(context: Context, error: unknown): Response {
   if (error instanceof WorkspaceArtifactNotFoundError) {
     return context.json({ code: "WORKSPACE_ARTIFACT_NOT_FOUND", message: error.message }, 404);
   }
@@ -63,41 +80,28 @@ function errorResponse(context: Context, error: unknown): Response {
       422,
     );
   }
-  if (typeof error === "object" && error !== null && "code" in error && error.code === "23505") {
+  if (nestedPostgresSqlState(error) === "23505") {
     return context.json(
-      { code: "WORKSPACE_ARTIFACT_CONFLICT", message: "Artifact slug or operation already exists" },
+      {
+        code: "WORKSPACE_ARTIFACT_CONFLICT",
+        message: "Artifact slug or operation already exists",
+      },
       409,
     );
   }
   throw error;
 }
 
-function contentMetadata(workspaceId: string, html: string) {
-  const bytes = encoder.encode(html);
-  const sha256 = createHash("sha256").update(bytes).digest("hex");
-  return {
-    bytes,
-    contentSha256: sha256,
-    sizeBytes: bytes.byteLength,
-    contentKey: `workspaces/${workspaceId}/workspace-artifacts/blobs/${sha256}.html`,
-  };
-}
-
-function prepareHtml(deps: ApiRouteDeps, workspaceId: string, html: string) {
+function prepareContent(
+  deps: ApiRouteDeps,
+  workspaceId: string,
+  input: Parameters<typeof prepareWorkspaceArtifactContent>[2],
+) {
   if (!deps.objectStorage)
-    throw new HTTPException(503, { message: "Object storage is not configured" });
-  const content = contentMetadata(workspaceId, html);
-  return {
-    ...content,
-    persistContent: async () => {
-      await deps.objectStorage!.putObject({
-        key: content.contentKey,
-        contentType: "text/html; charset=utf-8",
-        body: content.bytes,
-        sha256: content.contentSha256,
-      });
-    },
-  };
+    throw new HTTPException(503, {
+      message: "Object storage is not configured",
+    });
+  return prepareWorkspaceArtifactContent(deps.objectStorage, workspaceId, input);
 }
 
 function provenance(subjectId: string, idempotencyKey: string) {
@@ -112,6 +116,41 @@ function provenance(subjectId: string, idempotencyKey: string) {
   };
 }
 
+async function canReadProvenanceSession(
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  sessionId: string,
+): Promise<boolean> {
+  try {
+    await requireSessionAuthorization(deps, grant, {
+      sessionId,
+      operation: "session.read",
+      surface: "http",
+    });
+    return true;
+  } catch (error) {
+    if (error instanceof SessionAuthorizationDeniedError) return false;
+    if (error instanceof SessionAuthorizationUnavailableError) {
+      throw new HTTPException(503, {
+        message: "Session authorization is unavailable",
+      });
+    }
+    throw error;
+  }
+}
+
+async function mutationResponse(
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  response: WorkspaceArtifactMutationResponse,
+): Promise<WorkspaceArtifactMutationResponse> {
+  return WorkspaceArtifactMutationResponse.parse(
+    await projectWorkspaceArtifactMutationProvenance(response, (sessionId) =>
+      canReadProvenanceSession(deps, grant, sessionId),
+    ),
+  );
+}
+
 export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps): void {
   // `published-artifacts` deliberately avoids the existing `/artifacts/:id`
   // retained-output API. The product route remains simply `/artifacts`.
@@ -123,38 +162,55 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
     const query = WorkspaceArtifactListQuery.safeParse({
       limit: context.req.query("limit"),
       cursor: context.req.query("cursor"),
+      status: context.req.query("status"),
     });
     if (!query.success) throw new HTTPException(422, { message: "Invalid artifact list query" });
     try {
       return context.json(
         WorkspaceArtifactListResponse.parse(
-          await listWorkspaceArtifacts(deps.db, workspaceId, {
-            limit: query.data.limit,
-            ...(query.data.cursor ? { cursor: query.data.cursor } : {}),
-          }),
+          redactWorkspaceArtifactListProvenance(
+            await listWorkspaceArtifacts(deps.db, workspaceId, {
+              limit: query.data.limit,
+              ...(query.data.cursor ? { cursor: query.data.cursor } : {}),
+              ...(query.data.status ? { status: query.data.status } : {}),
+            }),
+          ),
         ),
       );
     } catch (error) {
-      return errorResponse(context, error);
+      return workspaceArtifactErrorResponse(context, error);
     }
   });
 
   app.post(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:publish");
+    const authorization = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "artifacts:publish",
+    );
+    const grant = authorization.grant;
     const request = await body(context, CreateWorkspaceArtifactRequest);
     const id = crypto.randomUUID();
     const slugBase = request.slug ?? (normalizeWorkspaceArtifactSlug(request.title) || "artifact");
     const slug = request.slug ?? `${slugBase.slice(0, 87)}-${id.slice(0, 8)}`;
-    const content = prepareHtml(deps, workspaceId, request.html);
+    const content = prepareContent(deps, workspaceId, {
+      html: request.html,
+      ...(request.source ? { source: request.source } : {}),
+      ...(request.requestedTools ? { requestedTools: request.requestedTools } : {}),
+    });
     try {
       return context.json(
-        WorkspaceArtifactMutationResponse.parse(
+        await mutationResponse(
+          deps,
+          grant,
           await createWorkspaceArtifact(deps.db, {
             accountId: grant.accountId,
             workspaceId,
             artifactId: id,
             slug,
+            requestedSlug: request.slug ?? null,
             title: request.title,
             description: request.description ?? null,
             ...content,
@@ -164,21 +220,24 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         201,
       );
     } catch (error) {
-      return errorResponse(context, error);
+      return workspaceArtifactErrorResponse(context, error);
     }
   });
 
   app.get(`${base}/:artifactId`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     try {
+      const detail = await getWorkspaceArtifact(deps.db, workspaceId, artifactId(context));
       return context.json(
         WorkspaceArtifactDetailResponse.parse(
-          await getWorkspaceArtifact(deps.db, workspaceId, artifactId(context)),
+          await projectWorkspaceArtifactDetailProvenance(detail, (sessionId) =>
+            canReadProvenanceSession(deps, grant, sessionId),
+          ),
         ),
       );
     } catch (error) {
-      return errorResponse(context, error);
+      return workspaceArtifactErrorResponse(context, error);
     }
   });
 
@@ -186,7 +245,9 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
-      throw new HTTPException(503, { message: "Object storage is not configured" });
+      throw new HTTPException(503, {
+        message: "Object storage is not configured",
+      });
     const parsedVersion = context.req.query("versionId");
     if (parsedVersion && !ArtifactId.safeParse(parsedVersion).success) {
       throw new HTTPException(422, { message: "Invalid artifact version id" });
@@ -198,19 +259,14 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         artifactId(context),
         parsedVersion,
       );
-      const object = await retryWhileMissing(async () =>
-        deps.objectStorage!.getObjectBytes(ref.contentKey),
-      );
-      if (!object) throw new HTTPException(503, { message: "Artifact content is unavailable" });
-      const actualHash = createHash("sha256").update(object.bytes).digest("hex");
-      if (actualHash !== ref.version.contentSha256) {
-        throw new HTTPException(503, { message: "Artifact content failed integrity verification" });
-      }
-      let html: string;
+      let content: Awaited<ReturnType<typeof readWorkspaceArtifactContent>>;
       try {
-        html = decoder.decode(object.bytes);
-      } catch {
-        throw new HTTPException(503, { message: "Artifact content is not valid UTF-8" });
+        content = await readWorkspaceArtifactContent(deps.objectStorage, ref);
+      } catch (error) {
+        throw new HTTPException(503, {
+          message: error instanceof Error ? error.message : "Artifact content is unavailable",
+          cause: error,
+        });
       }
       return context.json(
         WorkspaceArtifactContentResponse.parse({
@@ -218,23 +274,35 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
           versionId: ref.version.id,
           contentType: "text/html",
           contentSha256: ref.version.contentSha256,
-          html,
+          ...content,
         }),
       );
     } catch (error) {
-      return errorResponse(context, error);
+      return workspaceArtifactErrorResponse(context, error);
     }
   });
 
   app.post(`${base}/:artifactId/versions`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:publish");
+    const authorization = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "artifacts:publish",
+    );
+    const grant = authorization.grant;
     const request = await body(context, PublishWorkspaceArtifactVersionRequest);
     const id = artifactId(context);
-    const content = prepareHtml(deps, workspaceId, request.html);
+    const content = prepareContent(deps, workspaceId, {
+      html: request.html,
+      ...(request.source ? { source: request.source } : {}),
+      ...(request.requestedTools ? { requestedTools: request.requestedTools } : {}),
+    });
     try {
       return context.json(
-        WorkspaceArtifactMutationResponse.parse(
+        await mutationResponse(
+          deps,
+          grant,
           await publishWorkspaceArtifactVersion(deps.db, {
             accountId: grant.accountId,
             workspaceId,
@@ -248,21 +316,30 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         ),
       );
     } catch (error) {
-      return errorResponse(context, error);
+      return workspaceArtifactErrorResponse(context, error);
     }
   });
 
   app.post(`${base}/:artifactId/rollback`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:publish");
+    const authorization = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "artifacts:publish",
+    );
+    const grant = authorization.grant;
     const request = await body(context, RollbackWorkspaceArtifactRequest);
+    const id = artifactId(context);
     try {
       return context.json(
-        WorkspaceArtifactMutationResponse.parse(
+        await mutationResponse(
+          deps,
+          grant,
           await rollbackWorkspaceArtifact(deps.db, {
             accountId: grant.accountId,
             workspaceId,
-            artifactId: artifactId(context),
+            artifactId: id,
             versionId: request.versionId,
             expectedCurrentVersionId: request.expectedCurrentVersionId,
             reason: request.reason,
@@ -271,7 +348,39 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         ),
       );
     } catch (error) {
-      return errorResponse(context, error);
+      return workspaceArtifactErrorResponse(context, error);
+    }
+  });
+
+  app.patch(`${base}/:artifactId/status`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "artifacts:publish",
+    );
+    const grant = authorization.grant;
+    const request = await body(context, SetWorkspaceArtifactStatusRequest);
+    const id = artifactId(context);
+    try {
+      return context.json(
+        await mutationResponse(
+          deps,
+          grant,
+          await setWorkspaceArtifactStatus(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            artifactId: id,
+            status: request.status,
+            expectedCurrentVersionId: request.expectedCurrentVersionId,
+            reason: request.reason,
+            ...provenance(grant.subjectId, request.idempotencyKey),
+          }),
+        ),
+      );
+    } catch (error) {
+      return workspaceArtifactErrorResponse(context, error);
     }
   });
 }