@opengeni/api-router 2.6.4 → 2.10.0-canary.0

package/src/codemode.ts

@@ -61,6 +61,15 @@ export class CodemodeCatalogNotReadyError extends Error {
   }
 }
 
+export class CodemodeCatalogStaleError extends Error {
+  readonly code = "codemode_catalog_stale";
+
+  constructor() {
+    super("Codemode tool catalog is stale for the active execution attempt");
+    this.name = "CodemodeCatalogStaleError";
+  }
+}
+
 export function codemodeAuthorityForGrant(grant: AccessGrant): CodemodeGrantAuthority | null {
   const metadata = grant.metadata;
   if (
@@ -153,6 +162,7 @@ export async function submitAndDispatchCodemodeCall(
 ): Promise<CodemodeCallSubmissionValue> {
   const request = CodemodeCallRequest.parse(rawRequest);
   const { authority, catalog } = await requireActiveCodemodeCatalog(deps, grant);
+  if (request.catalogDigest !== catalog.digest) throw new CodemodeCatalogStaleError();
   const submitted = await submitCodemodeOperation(deps.db, {
     ...authority,
     call: {
@@ -166,7 +176,7 @@ export async function submitAndDispatchCodemodeCall(
     : operation.state === "running"
       ? "already_running"
       : "unavailable";
-  if (operation.state === "queued") {
+  if (codemodeOperationNeedsDispatch(operation)) {
     try {
       const reply = await deps.bus.request(
         codemodeDispatchSubject(authority.workspaceId, authority.attemptId),
@@ -181,13 +191,14 @@ export async function submitAndDispatchCodemodeCall(
     } catch {
       dispatch = "unavailable";
     }
-    operation =
-      (await getCodemodeOperation(deps.db, {
+    operation = await refreshAdmittedCodemodeOperation(operation, () =>
+      getCodemodeOperation(deps.db, {
         accountId: authority.accountId,
         workspaceId: authority.workspaceId,
         attemptId: authority.attemptId,
         operationId: operation.operationId,
-      })) ?? operation;
+      }),
+    );
     if (terminal(operation)) dispatch = "terminal";
     else if (operation.state === "running" && dispatch === "unavailable") {
       dispatch = "already_running";
@@ -196,6 +207,10 @@ export async function submitAndDispatchCodemodeCall(
   return CodemodeCallSubmission.parse({ operation, dispatch });
 }
 
+export function codemodeOperationNeedsDispatch(operation: CodemodeOperation): boolean {
+  return operation.state === "queued" || operation.state === "running";
+}
+
 export async function readCodemodeOperation(
   deps: ApiRouteDeps,
   grant: AccessGrant,
@@ -214,3 +229,17 @@ export async function readCodemodeOperation(
 function terminal(operation: CodemodeOperation): boolean {
   return ["completed", "failed", "outcome_unknown", "cancelled"].includes(operation.state);
 }
+
+export async function refreshAdmittedCodemodeOperation(
+  admitted: CodemodeOperation,
+  read: () => Promise<CodemodeOperation | null>,
+): Promise<CodemodeOperation> {
+  try {
+    return (await read()) ?? admitted;
+  } catch {
+    // Admission is already durable. Returning the known row lets the client
+    // continue with the same operation id instead of turning a refresh outage
+    // into an unmarked post-commit failure.
+    return admitted;
+  }
+}

package/src/github-access.ts

@@ -1,15 +1,61 @@
 import type {
+  GitHubAppRepositoryBranchPage,
   GitHubBindingStatus,
   GitHubInstallationBinding,
   GitHubRepository,
 } from "@opengeni/contracts";
 import {
+  GitHubRepositoryBranchesResponse as GitHubRepositoryBranchesResponseSchema,
+  type GitHubRepositoryBranchesResponse,
+  type ListGitHubRepositoryBranchesQuery,
+} from "@opengeni/contracts/github-repository-contracts";
+import {
+  areGitHubRepositoriesAllowedForWorkspace,
   hasAuditableGitHubInstallationAuthority,
   listGitHubInstallationAccessForWorkspace,
 } from "@opengeni/db";
-import { listGitHubAppInstallationSummaries, listGitHubAppRepositories } from "@opengeni/github";
+import {
+  GitHubAppApiError,
+  listGitHubAppInstallationSummaries,
+  listGitHubAppRepositories,
+  listGitHubAppRepositoryBranches,
+} from "@opengeni/github";
 import type { ApiRouteDeps } from "@opengeni/core";
 
+export type GitHubRepositoryBranchAuthorityErrorCode = "changed" | "not_authorized";
+
+export class GitHubRepositoryBranchAuthorityError extends Error {
+  constructor(readonly code: GitHubRepositoryBranchAuthorityErrorCode) {
+    super(code);
+    this.name = "GitHubRepositoryBranchAuthorityError";
+  }
+}
+
+export type WorkspaceGitHubRepositoryBranchServices = {
+  listInstallationAccess: typeof listGitHubInstallationAccessForWorkspace;
+  areRepositoriesAllowed: typeof areGitHubRepositoriesAllowedForWorkspace;
+  listProviderBranches: (
+    deps: ApiRouteDeps,
+    input: {
+      installationId: number;
+      repositoryId: number;
+      page: number;
+      limit: number;
+    },
+  ) => Promise<GitHubAppRepositoryBranchPage | null>;
+};
+
+const workspaceGitHubRepositoryBranchServices: WorkspaceGitHubRepositoryBranchServices = {
+  listInstallationAccess: listGitHubInstallationAccessForWorkspace,
+  areRepositoriesAllowed: areGitHubRepositoriesAllowedForWorkspace,
+  listProviderBranches: async (deps, input) =>
+    deps.githubAppApi?.listRepositoryBranches
+      ? await deps.githubAppApi.listRepositoryBranches(input)
+      : deps.githubAppApi
+        ? null
+        : await listGitHubAppRepositoryBranches(deps.settings, input),
+};
+
 export async function listWorkspaceGitHubInstallationBindings(
   deps: ApiRouteDeps,
   workspaceId: string,
@@ -153,3 +199,73 @@ export async function listWorkspaceGitHubRepositories(
     return installation.repositoryIds.includes(repository.id);
   });
 }
+
+export async function listWorkspaceGitHubRepositoryBranches(
+  deps: ApiRouteDeps,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    installationId: number;
+    repositoryId: number;
+    query: ListGitHubRepositoryBranchesQuery;
+  },
+  services: WorkspaceGitHubRepositoryBranchServices = workspaceGitHubRepositoryBranchServices,
+): Promise<GitHubRepositoryBranchesResponse> {
+  const installations = await services.listInstallationAccess(deps.db, input.workspaceId);
+  const installation = installations.find(
+    (candidate) => candidate.installationId === input.installationId,
+  );
+  if (
+    !installation ||
+    installation.accountId !== input.accountId ||
+    !hasAuditableGitHubInstallationAuthority(installation) ||
+    !installation.repositoryIds.includes(input.repositoryId)
+  ) {
+    throw new GitHubRepositoryBranchAuthorityError("not_authorized");
+  }
+  if (
+    !(await services.areRepositoriesAllowed(deps.db, input.workspaceId, input.installationId, [
+      input.repositoryId,
+    ]))
+  ) {
+    throw new GitHubRepositoryBranchAuthorityError("changed");
+  }
+  const page = await services.listProviderBranches(deps, {
+    installationId: input.installationId,
+    repositoryId: input.repositoryId,
+    page: input.query.cursor,
+    limit: input.query.limit,
+  });
+  if (!page) {
+    throw new GitHubAppApiError(
+      "The configured GitHub provider cannot list exact repository branches",
+    );
+  }
+  if (
+    page.installationId !== input.installationId ||
+    page.repositoryId !== input.repositoryId ||
+    page.branches.length > input.query.limit ||
+    (page.nextPage !== null && page.nextPage !== input.query.cursor + 1) ||
+    (page.branches.length < input.query.limit && page.nextPage !== null)
+  ) {
+    throw new GitHubAppApiError("GitHub returned an invalid repository branches page");
+  }
+  const response = GitHubRepositoryBranchesResponseSchema.safeParse({
+    branches: page.branches.map((name) => ({
+      name,
+      isDefault: name === page.defaultBranch,
+    })),
+    nextCursor: page.nextPage,
+  });
+  if (!response.success) {
+    throw new GitHubAppApiError("GitHub returned an invalid repository branches page");
+  }
+  if (
+    !(await services.areRepositoriesAllowed(deps.db, input.workspaceId, input.installationId, [
+      input.repositoryId,
+    ]))
+  ) {
+    throw new GitHubRepositoryBranchAuthorityError("changed");
+  }
+  return response.data;
+}

package/src/http/auth.ts

@@ -2,6 +2,11 @@ import { resolveFirstPartyDelegationSecret, type Settings } from "@opengeni/conf
 import { verifyDelegatedAccessToken } from "@opengeni/contracts";
 import type { Context, MiddlewareHandler } from "hono";
 import { installExactPaths, isInstallRedirectPath } from "../routes/install";
+import {
+  isMcpOAuthPublicProtocolPath,
+  isMcpOAuthResourcePath,
+  mcpOAuthBearerToken,
+} from "../mcp-oauth";
 
 const githubConnectPathPattern = /^\/v1\/workspaces\/[^/]+\/github\/connect$/;
 const githubInstallationLinkPathPattern = /^\/v1\/workspaces\/[^/]+\/github\/installations$/;
@@ -33,6 +38,12 @@ function isAuthExempt(c: Context, settings: Settings): boolean {
     return true;
   }
   const path = new URL(c.req.url).pathname;
+  if (settings.mcpOauthEnabled && isMcpOAuthPublicProtocolPath(path)) {
+    return true;
+  }
+  if (settings.mcpOauthEnabled && isMcpOAuthResourcePath(path) && mcpOAuthBearerToken(c.req.raw)) {
+    return true;
+  }
   if (path === "/v1/config/client") {
     return true;
   }

package/src/http/request-source.ts

@@ -0,0 +1,37 @@
+import type { Context } from "hono";
+
+const TRANSPORT_PEER_ADDRESS_BINDING = "opengeniTransportPeerAddress";
+
+type ApiRequestBindings = {
+  [TRANSPORT_PEER_ADDRESS_BINDING]?: string | null;
+};
+
+export function apiRequestBindingsForTransportPeer(
+  address: string | null | undefined,
+): ApiRequestBindings {
+  return { [TRANSPORT_PEER_ADDRESS_BINDING]: address ?? null };
+}
+
+/**
+ * Resolve a quota/audit source from the server-owned transport peer. Forwarded
+ * values are considered only when the operator declares an exact trusted proxy
+ * hop count; the chain is then walked from the server side so caller-prepended
+ * values cannot replace the address inserted by the trusted edge.
+ */
+export function trustedRequestSourceAddress(c: Context, trustedProxyHops: number): string {
+  const bindings = c.env as ApiRequestBindings | undefined;
+  const peer = normalizedAddress(bindings?.[TRANSPORT_PEER_ADDRESS_BINDING]) ?? "unknown";
+  if (trustedProxyHops <= 0 || peer === "unknown") return peer;
+
+  const forwarded = (c.req.header("x-forwarded-for") ?? "")
+    .split(",")
+    .map(normalizedAddress)
+    .filter((value): value is string => value !== null);
+  const sourceIndex = forwarded.length - trustedProxyHops;
+  return sourceIndex >= 0 ? forwarded[sourceIndex]! : peer;
+}
+
+function normalizedAddress(value: string | null | undefined): string | null {
+  const normalized = value?.trim();
+  return normalized ? normalized.slice(0, 128) : null;
+}

package/src/http/sse.ts

@@ -10,12 +10,11 @@ import {
   type Database,
 } from "@opengeni/db";
 import {
-  coalesceSessionEventDeltas,
+  coalesceSessionEventDeltasWithCoverage,
   formatSessionEventSse,
   formatWorkspaceControlEventSse,
   requireSessionEventDurableFanoutCapability,
   SESSION_EVENT_SSE_FRAME_MAX_BYTES,
-  sessionEventResumeSequence,
   type EventBus,
 } from "@opengeni/events";
 import type { Observability } from "@opengeni/observability";
@@ -295,8 +294,14 @@ export async function sseSessionStream(
       limit: SESSION_REPLAY_PAGE_SIZE,
     });
     await options.reauthorize?.();
+    const compactProjection = coalesceSessionEventDeltasWithCoverage(events);
     return finiteSseBatchResponse(
-      coalesceSessionEventDeltas(events).map(formatSessionEventSse),
+      compactProjection.events.map((event) =>
+        formatSessionEventSse(
+          event,
+          compactProjection.coveredThroughBySequence.get(event.sequence) ?? event.sequence,
+        ),
+      ),
       options,
     );
   }
@@ -378,9 +383,12 @@ export async function sseSessionStream(
       // adjacent text deltas into bounded frames carrying `coalescedUntil`, so
       // a long answer cannot create thousands of React renders and starve
       // command acknowledgements behind its own token stream.
-      for (const projected of coalesceSessionEventDeltas(eligible)) {
-        await writeFrame(formatSessionEventSse(projected));
-        lastSent = sessionEventResumeSequence(projected);
+      const compactProjection = coalesceSessionEventDeltasWithCoverage(eligible);
+      for (const projected of compactProjection.events) {
+        const coveredThrough =
+          compactProjection.coveredThroughBySequence.get(projected.sequence) ?? projected.sequence;
+        await writeFrame(formatSessionEventSse(projected, coveredThrough));
+        lastSent = coveredThrough;
       }
       if (lastSent <= previousLastSent) {
         throw new Error(`Session event replay made no progress after sequence ${lastSent}`);
@@ -432,7 +440,7 @@ export async function sseSessionStream(
     drainReconnectReconciliation();
   };
   const send = async (event: SessionEvent) => {
-    const targetSequence = sessionEventResumeSequence(event);
+    const targetSequence = event.sequence;
     if (targetSequence <= lastSent) return;
     await reconcileDurableThrough(targetSequence);
   };

package/src/index.ts

@@ -28,7 +28,10 @@ import {
 } from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { isArtifactRuntimeConfigured } from "@opengeni/artifact-tool/runtime/development";
-import { SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID } from "@opengeni/core";
+import {
+  resolveCatalogSettings,
+  SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID,
+} from "@opengeni/core";
 import {
   Connection,
   Client as TemporalClient,
@@ -51,6 +54,7 @@ import {
 } from "./editable-artifact-websocket";
 import type { ApiWebSocketConnection } from "./api-websocket";
 import { InteractionFrameProxyTransport } from "./interaction-frame-proxy";
+import { apiRequestBindingsForTransportPeer } from "./http/request-source";
 import {
   createStandaloneEditableArtifactApplication,
   type StandaloneEditableArtifactApplication,
@@ -357,6 +361,15 @@ export async function startApi(
       () => assertRuntimeDatabasePosture(dbClient.db, databasePosture),
       { ...retryOptions, onRetry },
     );
+    const resolvedCatalog = await retryStartupDependency(
+      "model catalog",
+      () => resolveCatalogSettings(dbClient.db, settings),
+      { ...retryOptions, onRetry },
+    );
+    observability.info("OpenGeni model catalog resolved", {
+      catalogSource: resolvedCatalog.source,
+      catalogVersion: resolvedCatalog.version,
+    });
     bus = await retryStartupDependency(
       "NATS",
       () =>
@@ -443,7 +456,10 @@ export async function startApi(
       if (artifactWebSockets.handles(request)) {
         return artifactWebSockets.upgrade(request, bunServer);
       }
-      return app.fetch(request);
+      return app.fetch(
+        request,
+        apiRequestBindingsForTransportPeer(bunServer.requestIP(request)?.address),
+      );
     },
     websocket: {
       maxPayloadLength: EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES,