@opengeni/api-router 2.6.4 → 2.8.1-canary.0

package/src/routes/connections.ts

@@ -1,4 +1,10 @@
-import { createHash } from "node:crypto";
+import { createHash, createHmac } from "node:crypto";
+import {
+  WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
+  WORKSPACE_OPENROUTER_CONNECTION_ROLE,
+  VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
+  VERCEL_AI_GATEWAY_CONNECTION_ROLE,
+} from "@opengeni/config";
 import {
   ATLASSIAN_PROVIDER_DOMAIN,
   AtlassianConnectionMetadata,
@@ -21,11 +27,16 @@ import {
   IntegrationClientMetadata,
   ListSlackInstallationBindingsResponse,
   ListConnectionsResponse,
+  OPENROUTER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY,
+  OPENROUTER_CREDENTIAL_OPERATION_ID_METADATA_KEY,
   OpenGeniSlackBotInstallRequest,
   OpenGeniSlackBotInstallStart,
   OAuthStartRequest,
   OAuthStartResponse,
   UpdateConnectionRequest,
+  VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY,
+  VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_ID_METADATA_KEY,
+  stableJson,
 } from "@opengeni/contracts";
 import {
   bindConnectorDocumentDestination,
@@ -69,11 +80,17 @@ import {
   persistSlackBotInstallationWithSuccessAudit,
   recordSlackBotInstallCallbackFailure,
   revokeConnection,
+  revokeWorkspaceOpenRouterConnections,
+  revokeWorkspaceVercelAiGatewayConnections,
   revokeConnectionWithSlackBotSuccessAudit,
+  rotateWorkspaceVercelAiGatewayConnection,
+  rotateWorkspaceOpenRouterConnection,
   SlackBotLifecycleSuccessAuditError,
   SlackInstallationBindingConflictError,
   updateConnection,
   updateSlackBotDocumentDestination,
+  upsertWorkspaceVercelAiGatewayConnection,
+  upsertWorkspaceOpenRouterConnection,
   type SlackBotInstallCallbackFailureReason,
   type SlackBotInstallCallbackFailureStage,
 } from "@opengeni/db";
@@ -193,18 +210,69 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     assertNotDirectGoogleDriveOAuth(providerDomain, payload.kind, payload.metadata);
     assertNotDirectAtlassianOAuth(providerDomain, payload.kind, payload.metadata);
     assertNotDirectPersonalGitHubOAuth(providerDomain, payload.kind, payload.metadata);
-    const connection = await createConnection(db, {
-      accountId: grant.accountId,
-      workspaceId,
+    const credentialEncrypted = encryptCredentialBundle(key, payload.credential);
+    const workspaceProviderKind = workspaceProviderApiKeyConnectionKind({
       subjectId,
       providerDomain,
       kind: payload.kind,
-      credentialEncrypted: encryptCredentialBundle(key, payload.credential),
-      grantedScopes: payload.grantedScopes,
-      expiresAt: payload.expiresAt ? new Date(payload.expiresAt) : null,
       metadata: payload.metadata,
-      createdBySubjectId: grant.subjectId,
     });
+    const connection = workspaceProviderKind
+      ? await (async () => {
+          const provider = workspaceProviderApiKeyConnectionSpec(workspaceProviderKind);
+          if (!payload.operationId) {
+            throw new HTTPException(400, {
+              message: `connecting ${provider.label} requires an operationId`,
+            });
+          }
+          const expiresAt = payload.expiresAt ? new Date(payload.expiresAt) : null;
+          const metadata = workspaceProviderCredentialMetadata(
+            workspaceProviderKind,
+            payload.metadata,
+          );
+          const input = {
+            accountId: grant.accountId,
+            workspaceId,
+            operationId: payload.operationId,
+            requestDigest: workspaceProviderCredentialRequestDigest(key, {
+              action: "create",
+              providerDomain,
+              kind: payload.kind,
+              subjectId,
+              credential: payload.credential,
+              grantedScopes: payload.grantedScopes,
+              expiresAt: expiresAt?.toISOString() ?? null,
+              metadata,
+            }),
+            credentialEncrypted,
+            grantedScopes: payload.grantedScopes,
+            expiresAt,
+            metadata,
+            updatedBySubjectId: grant.subjectId,
+          };
+          const created =
+            workspaceProviderKind === "vercel_gateway"
+              ? await upsertWorkspaceVercelAiGatewayConnection(db, input)
+              : await upsertWorkspaceOpenRouterConnection(db, input);
+          if (!created || created.status === "revoked") {
+            throw new HTTPException(409, {
+              message: `${provider.label} is already connected; reload before replacing its key`,
+            });
+          }
+          return created;
+        })()
+      : await createConnection(db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId,
+          providerDomain,
+          kind: payload.kind,
+          credentialEncrypted,
+          grantedScopes: payload.grantedScopes,
+          expiresAt: payload.expiresAt ? new Date(payload.expiresAt) : null,
+          metadata: payload.metadata,
+          createdBySubjectId: grant.subjectId,
+        });
     return c.json(ConnectionResponse.parse({ connection }), 201);
   });
 
@@ -794,6 +862,24 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
         payload.providerDomain ?? existing.providerDomain,
       );
       const kind = payload.kind ?? existing.kind;
+      const subjectId =
+        payload.subjectId === undefined
+          ? existing.subjectId
+          : writableSubjectId(payload.subjectId, grant.subjectId);
+      const targetWorkspaceProviderKind = workspaceProviderApiKeyConnectionKind({
+        subjectId,
+        providerDomain,
+        kind,
+        metadata: payload.metadata ?? existing.metadata,
+      });
+      if (!workspaceProviderApiKeyConnectionKind(existing) && targetWorkspaceProviderKind) {
+        throw new HTTPException(422, {
+          message:
+            targetWorkspaceProviderKind === "vercel_gateway"
+              ? "use the Vercel AI Gateway connect flow to create this connection"
+              : "use the OpenRouter connect flow to create this connection",
+        });
+      }
       assertNotDirectPersonalSlackOAuth(providerDomain, kind);
       assertNotDirectGoogleDriveOAuth(providerDomain, kind, payload.metadata ?? existing.metadata);
       assertNotDirectAtlassianOAuth(providerDomain, kind, payload.metadata ?? existing.metadata);
@@ -819,6 +905,86 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
         });
       }
     }
+    const existingWorkspaceProviderKind = existing
+      ? workspaceProviderApiKeyConnectionKind(existing)
+      : null;
+    if (existing && existingWorkspaceProviderKind) {
+      const provider = workspaceProviderApiKeyConnectionSpec(existingWorkspaceProviderKind);
+      const providerDomain = canonicalProviderDomain(
+        payload.providerDomain ?? existing.providerDomain,
+      );
+      const subjectId =
+        payload.subjectId === undefined
+          ? existing.subjectId
+          : writableSubjectId(payload.subjectId, grant.subjectId);
+      const kind = payload.kind ?? existing.kind;
+      if (
+        subjectId !== null ||
+        providerDomain !== provider.providerDomain ||
+        kind !== "api_key" ||
+        (payload.metadata?.credentialRole !== undefined &&
+          payload.metadata.credentialRole !== provider.credentialRole)
+      ) {
+        throw new HTTPException(422, {
+          message: `${provider.label} connection identity cannot be changed`,
+        });
+      }
+      if (payload.credential === undefined) {
+        throw new HTTPException(400, {
+          message: `updating a ${provider.label} connection requires a new credential`,
+        });
+      }
+      if (payload.expectedVersion === undefined || payload.operationId === undefined) {
+        throw new HTTPException(400, {
+          message: `updating a ${provider.label} connection requires expectedVersion and operationId`,
+        });
+      }
+      const key = requireEnvironmentEncryption(settings);
+      const grantedScopes = payload.grantedScopes ?? existing.grantedScopes;
+      const expiresAt =
+        payload.expiresAt !== undefined
+          ? payload.expiresAt
+            ? new Date(payload.expiresAt)
+            : null
+          : existing.expiresAt
+            ? new Date(existing.expiresAt)
+            : null;
+      const metadata = workspaceProviderCredentialMetadata(existingWorkspaceProviderKind, {
+        ...existing.metadata,
+        ...(payload.metadata ?? {}),
+      });
+      const input = {
+        accountId: grant.accountId,
+        workspaceId,
+        connectionId: existing.id,
+        expectedVersion: payload.expectedVersion,
+        operationId: payload.operationId,
+        requestDigest: workspaceProviderCredentialRequestDigest(key, {
+          action: "rotate",
+          connectionId: existing.id,
+          expectedVersion: payload.expectedVersion,
+          credential: payload.credential,
+          grantedScopes,
+          expiresAt: expiresAt?.toISOString() ?? null,
+          metadata,
+        }),
+        credentialEncrypted: encryptCredentialBundle(key, payload.credential),
+        grantedScopes,
+        expiresAt,
+        metadata,
+        updatedBySubjectId: grant.subjectId,
+      };
+      const connection =
+        existingWorkspaceProviderKind === "vercel_gateway"
+          ? await rotateWorkspaceVercelAiGatewayConnection(db, input)
+          : await rotateWorkspaceOpenRouterConnection(db, input);
+      if (!connection) {
+        throw new HTTPException(409, {
+          message: `${provider.label} connection changed; reload before replacing its key`,
+        });
+      }
+      return c.json(ConnectionResponse.parse({ connection }));
+    }
     const key = payload.credential === undefined ? null : requireEnvironmentEncryption(settings);
     const subjectId =
       payload.subjectId === undefined
@@ -879,6 +1045,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       existing.providerDomain === ATLASSIAN_PROVIDER_DOMAIN &&
       existing.kind === "oauth2" &&
       AtlassianConnectionMetadata.safeParse(existing.metadata).success;
+    const workspaceProviderKind = workspaceProviderApiKeyConnectionKind(existing);
     const disconnectPayload = await c.req.json().catch(() => null);
     const googleDriveDisconnect = isGoogleDrive
       ? GoogleDriveDisconnectRequest.safeParse(disconnectPayload)
@@ -909,7 +1076,13 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
           "invalid personal GitHub disconnect request",
       });
     }
-    if (existing.status === "revoked" && !isGoogleDrive && !isAtlassian && !isPersonalGitHub) {
+    if (
+      existing.status === "revoked" &&
+      !isGoogleDrive &&
+      !isAtlassian &&
+      !isPersonalGitHub &&
+      !workspaceProviderKind
+    ) {
       return c.json(ConnectionResponse.parse({ connection: existing }));
     }
     const connection = isGoogleDrive
@@ -944,13 +1117,29 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
                 credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
                 slackTeamId: openGeniSlackBotMetadata(existing.metadata)!.slackTeamId,
               })
-            : await revokeConnection(
-                db,
-                workspaceId,
-                connectionId,
-                grant.subjectId,
-                existing.version,
-              );
+            : workspaceProviderKind
+              ? workspaceProviderKind === "vercel_gateway"
+                ? await revokeWorkspaceVercelAiGatewayConnections(db, {
+                    accountId: grant.accountId,
+                    workspaceId,
+                    connectionId,
+                    expectedVersion: existing.version,
+                    updatedBySubjectId: grant.subjectId,
+                  })
+                : await revokeWorkspaceOpenRouterConnections(db, {
+                    accountId: grant.accountId,
+                    workspaceId,
+                    connectionId,
+                    expectedVersion: existing.version,
+                    updatedBySubjectId: grant.subjectId,
+                  })
+              : await revokeConnection(
+                  db,
+                  workspaceId,
+                  connectionId,
+                  grant.subjectId,
+                  existing.version,
+                );
     if (!connection) {
       throw new HTTPException(409, { message: "connection changed during disconnect; try again" });
     }
@@ -1367,6 +1556,51 @@ function assertNotReservedPersonalGitHubMetadata(
   }
 }
 
+type WorkspaceProviderApiKeyConnectionKind = "vercel_gateway" | "openrouter";
+
+function workspaceProviderApiKeyConnectionSpec(
+  providerKind: WorkspaceProviderApiKeyConnectionKind,
+): {
+  providerDomain: string;
+  credentialRole: string;
+  label: string;
+} {
+  return providerKind === "vercel_gateway"
+    ? {
+        providerDomain: VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
+        credentialRole: VERCEL_AI_GATEWAY_CONNECTION_ROLE,
+        label: "Vercel AI Gateway",
+      }
+    : {
+        providerDomain: WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
+        credentialRole: WORKSPACE_OPENROUTER_CONNECTION_ROLE,
+        label: "OpenRouter",
+      };
+}
+
+function workspaceProviderApiKeyConnectionKind(input: {
+  subjectId?: string | null;
+  providerDomain: string;
+  kind: string;
+  metadata?: Record<string, unknown>;
+}): WorkspaceProviderApiKeyConnectionKind | null {
+  if (input.subjectId != null || input.kind !== "api_key") return null;
+  const providerDomain = input.providerDomain.toLowerCase();
+  if (
+    providerDomain === VERCEL_AI_GATEWAY_CONNECTION_DOMAIN &&
+    input.metadata?.credentialRole === VERCEL_AI_GATEWAY_CONNECTION_ROLE
+  ) {
+    return "vercel_gateway";
+  }
+  if (
+    providerDomain === WORKSPACE_OPENROUTER_CONNECTION_DOMAIN &&
+    input.metadata?.credentialRole === WORKSPACE_OPENROUTER_CONNECTION_ROLE
+  ) {
+    return "openrouter";
+  }
+  return null;
+}
+
 function assertNotReservedSlackBotMetadata(metadata: Record<string, unknown> | undefined): void {
   if (hasReservedOpenGeniSlackBotMetadata(metadata)) {
     throw new HTTPException(422, {
@@ -1426,6 +1660,27 @@ function encryptCredentialBundle(key: Uint8Array, credential: Record<string, unk
   return encryptEnvironmentValue(key, JSON.stringify(credential));
 }
 
+function workspaceProviderCredentialMetadata(
+  providerKind: WorkspaceProviderApiKeyConnectionKind,
+  metadata: Record<string, unknown> | undefined,
+): Record<string, unknown> {
+  const {
+    [OPENROUTER_CREDENTIAL_OPERATION_ID_METADATA_KEY]: _openRouterOperationId,
+    [OPENROUTER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY]: _openRouterOperationDigest,
+    [VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_ID_METADATA_KEY]: _operationId,
+    [VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY]: _operationDigest,
+    ...effectiveMetadata
+  } = metadata ?? {};
+  return {
+    ...effectiveMetadata,
+    credentialRole: workspaceProviderApiKeyConnectionSpec(providerKind).credentialRole,
+  };
+}
+
+function workspaceProviderCredentialRequestDigest(key: Uint8Array, value: unknown): string {
+  return createHmac("sha256", key).update(stableJson(value), "utf8").digest("hex");
+}
+
 function slackBotCredentialBundle(token: string): Record<string, unknown> {
   const headerName = ["author", "ization"].join("");
   const scheme = ["Bear", "er"].join("");

package/src/routes/github.ts

@@ -4,6 +4,11 @@ import {
   type GitHubInstallationBindingCandidate,
   type GitHubInstallationBindingProof,
 } from "@opengeni/contracts";
+import {
+  ListGitHubRepositoryBranchesQuery,
+  VerifyPublicGitHubRepositoryRefRequest,
+} from "@opengeni/contracts/github-repository-contracts";
+import { parseCanonicalGitHubRepositoryUrl } from "@opengeni/contracts/github-repository";
 import {
   bindAuthorizedGitHubInstallationRepositories,
   deleteGitHubInstallationBinding,
@@ -19,12 +24,14 @@ import {
   GitHubAppApiError,
   GitHubAppConfigurationError,
   GitHubInstallationAuthorityError,
+  GitHubPublicRepositoryVerificationError,
   githubAppMissingSettings,
   githubOAuthAuthorizeUrl,
   organizationAppManifestUrl,
   personalAppManifestUrl,
   readSignedState,
   stateMaxAgeSeconds,
+  verifyPublicGitHubRepositoryRef,
   type GitHubSignedStatePayload,
   verifySignedState,
 } from "@opengeni/github";
@@ -42,7 +49,9 @@ import {
 } from "../github-browser-flow";
 import {
   githubBindingStatus,
+  GitHubRepositoryBranchAuthorityError,
   listWorkspaceGitHubInstallationBindings,
+  listWorkspaceGitHubRepositoryBranches,
   listWorkspaceGitHubRepositories,
 } from "../github-access";
 
@@ -177,6 +186,65 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
   });
 
+  app.post("/v1/workspaces/:workspaceId/github/public-repositories/verify", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId);
+    requirePublicGitHubRepositoryVerificationPermission(grant);
+    const request = VerifyPublicGitHubRepositoryRefRequest.parse(await c.req.json());
+    let repository: ReturnType<typeof parseCanonicalGitHubRepositoryUrl>;
+    try {
+      repository = parseCanonicalGitHubRepositoryUrl(request.url);
+    } catch (error) {
+      throw new HTTPException(422, {
+        message: error instanceof Error ? error.message : "GitHub repository URL is invalid.",
+      });
+    }
+    try {
+      return c.json(
+        await verifyPublicGitHubRepositoryRef(
+          { repository, ref: request.ref },
+          deps.githubAnonymousFetch ?? fetch,
+        ),
+      );
+    } catch (error) {
+      if (error instanceof GitHubPublicRepositoryVerificationError) {
+        throw new HTTPException(error.code === "provider_unavailable" ? 503 : 422, {
+          message: error.message,
+        });
+      }
+      throw new HTTPException(503, {
+        message: "GitHub public repository verification is temporarily unavailable.",
+      });
+    }
+  });
+
+  app.get(
+    "/v1/workspaces/:workspaceId/github/installations/:installationId/repositories/:repositoryId/branches",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "github:use");
+      const installationId = parsePositiveInteger(c.req.param("installationId"));
+      const repositoryId = parsePositiveInteger(c.req.param("repositoryId"));
+      if (installationId === null || repositoryId === null) {
+        throw new HTTPException(400, { message: "invalid GitHub repository identity" });
+      }
+      const query = ListGitHubRepositoryBranchesQuery.parse(c.req.query());
+      try {
+        return c.json(
+          await listWorkspaceGitHubRepositoryBranches(deps, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            installationId,
+            repositoryId,
+            query,
+          }),
+        );
+      } catch (error) {
+        throw githubRepositoryBranchesRouteError(error);
+      }
+    },
+  );
+
   app.delete("/v1/workspaces/:workspaceId/github/installations/:installationId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "github:manage");
@@ -184,14 +252,11 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (installationId === null) {
       throw new HTTPException(400, { message: "invalid GitHub installation id" });
     }
-    const deleted = await deleteGitHubInstallationBinding(db, {
+    await deleteGitHubInstallationBinding(db, {
       accountId: grant.accountId,
       workspaceId: grant.workspaceId,
       installationId,
     });
-    if (!deleted) {
-      throw new HTTPException(404, { message: "GitHub installation binding not found" });
-    }
     return c.body(null, 204);
   });
 
@@ -428,14 +493,6 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
       if (candidates.length === 0) {
         return redirectToGitHubInstallation(c, deps, selectionState);
       }
-      if (candidates.length === 1) {
-        return redirectToExactGitHubAuthorization(
-          c,
-          deps,
-          selectionState,
-          candidates[0]!.installation.installationId,
-        );
-      }
       setGitHubStateCookie(c, deps, selectionState);
       return c.html(
         githubInstallationChooserHtml(
@@ -757,6 +814,50 @@ function githubAuthorityHttpError(error: unknown): HTTPException {
   return new HTTPException(502, { message: "GitHub authority verification failed" });
 }
 
+function githubRepositoryBranchesRouteError(error: unknown): Error {
+  if (error instanceof HTTPException) {
+    return error;
+  }
+  if (error instanceof GitHubRepositoryBranchAuthorityError) {
+    return error.code === "not_authorized"
+      ? new HTTPException(404, {
+          message: "GitHub repository is not authorized for this workspace",
+        })
+      : new HTTPException(409, {
+          message: "GitHub repository authorization changed; refresh and try again",
+        });
+  }
+  if (error instanceof GitHubAppConfigurationError) {
+    return new HTTPException(409, { message: "GitHub App is not configured" });
+  }
+  if (error instanceof GitHubAppApiError) {
+    if (error.status === 429) {
+      return new HTTPException(503, { message: "GitHub is temporarily rate limited" });
+    }
+    if (error.status === 401 || error.status === 403 || error.status === 404) {
+      return new HTTPException(409, {
+        message: "GitHub repository access changed; refresh and try again",
+      });
+    }
+    return new HTTPException(502, { message: "GitHub branch discovery is unavailable" });
+  }
+  return new HTTPException(502, { message: "GitHub branch discovery is unavailable" });
+}
+
+export function requirePublicGitHubRepositoryVerificationPermission(
+  grant: Pick<AccessGrant, "permissions">,
+): void {
+  if (
+    hasPermission(grant.permissions, "sessions:create") ||
+    hasPermission(grant.permissions, "sessions:control")
+  ) {
+    return;
+  }
+  throw new HTTPException(403, {
+    message: "missing permission: sessions:create or sessions:control",
+  });
+}
+
 function isSecureRequest(c: Context, deps: ApiRouteDeps): boolean {
   return (
     deps.settings.publicBaseUrl?.startsWith("https://") ||
@@ -783,15 +884,15 @@ function githubInstallationChooserHtml(
 ): string {
   const action = `${baseUrl}/v1/workspaces/${encodeURIComponent(workspaceId)}/github/installations/select`;
   const options = candidates
-    .map(({ installation, authorityKind }) => {
+    .map(({ installation, authorityKind }, index) => {
       const account = escapeHtml(
         installation.accountLogin ?? `installation ${installation.installationId}`,
       );
       const label = authorityKind === "personal_owner" ? "Personal account" : "Organization owner";
-      return `<label class="option"><input type="radio" name="installation_id" value="${installation.installationId}" required><span><strong>${account}</strong><small>${label}</small></span></label>`;
+      return `<label class="option"><input type="radio" name="installation_id" value="${installation.installationId}" required${candidates.length === 1 && index === 0 ? " checked" : ""}><span><strong>${account}</strong><small>${label}</small></span></label>`;
     })
     .join("");
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Choose GitHub installation</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:12px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px}p{margin:0 0 18px;color:#d4d4d8}.options{display:grid;gap:8px;margin-bottom:18px}.option{display:flex;align-items:center;gap:12px;border:1px solid #3f3f46;border-radius:8px;padding:12px;cursor:pointer}.option span{display:grid;gap:2px}.option small{color:#a1a1aa}button{min-height:38px;border-radius:7px;border:1px solid #3f3f46;padding:0 14px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}.secondary{margin-left:8px;background:transparent;color:#f4f4f5}</style></head><body><main><h1>Choose a GitHub account</h1><p>Only installations where GitHub proved you are the personal owner or an active organization owner are shown.</p><form method="get" action="${escapeHtml(action)}"><input type="hidden" name="state" value="${escapeHtml(state)}"><div class="options">${options}</div><button type="submit">Connect selected</button><button class="secondary" type="submit" name="installation_id" value="new" formnovalidate>Install on another account</button></form></main></body></html>`;
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Choose GitHub installation</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:12px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px}p{margin:0 0 18px;color:#d4d4d8}.options{display:grid;gap:8px;margin-bottom:18px}.option{display:flex;align-items:center;gap:12px;border:1px solid #3f3f46;border-radius:8px;padding:12px;cursor:pointer}.option span{display:grid;gap:2px}.option small{color:#a1a1aa}button{min-height:38px;border-radius:7px;border:1px solid #3f3f46;padding:0 14px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}.secondary{margin-left:8px;background:transparent;color:#f4f4f5}</style></head><body><main><h1>Choose a GitHub account</h1><p>These accounts already have the OpenGeni GitHub App installed and GitHub proved you are the personal owner or an active organization owner.</p><form method="get" action="${escapeHtml(action)}"><input type="hidden" name="state" value="${escapeHtml(state)}"><div class="options">${options}</div><button type="submit">Connect selected</button><button class="secondary" type="submit" name="installation_id" value="new" formnovalidate>Install on another account</button></form></main></body></html>`;
 }
 
 function githubSetupPendingHtml(): string {

package/src/routes/organization-memberships.ts

@@ -1,5 +1,7 @@
 import {
   AcceptOrganizationInvitationRequest,
+  CreateAdditionalOrganizationRequest,
+  CreateAdditionalOrganizationResponse,
   CreateOrganizationRequest,
   CreateOrganizationResponse,
   CreateOrganizationWorkspaceRequest,
@@ -40,6 +42,7 @@ import {
   acceptOrganizationInvitation,
   bindPendingOrganizationInvitationsForVerifiedEmail,
   claimOrganizationUserSetupDelivery,
+  createAdditionalManagedOrganization,
   createManagedOrganization,
   createOrganizationWorkspace,
   createOrganizationInvitation,
@@ -68,6 +71,7 @@ import {
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
+import { deleteWorkspaceForRequest } from "../workspace-deletion";
 
 import {
   assertOrganizationUserSetupDeliveryConfigured,
@@ -117,7 +121,9 @@ async function requireOrganizationAdministrator(
     );
     return { subjectId };
   }
-  throw new HTTPException(401, { message: "organization administrator session required" });
+  throw new HTTPException(401, {
+    message: "organization administrator session required",
+  });
 }
 
 async function parseBody<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
@@ -136,8 +142,14 @@ function parseId(schema: z.ZodString, value: string, label: string): string {
   return parsed.data;
 }
 
-function rethrowMembershipError(error: unknown): never {
-  const status = organizationMembershipHttpStatus(nestedPostgresSqlState(error));
+function rethrowMembershipError(error: unknown, resourceLimitMessage?: string): never {
+  const sqlState = nestedPostgresSqlState(error);
+  if (sqlState === "54000" && resourceLimitMessage) {
+    throw new HTTPException(409, {
+      message: resourceLimitMessage,
+    });
+  }
+  const status = organizationMembershipHttpStatus(sqlState);
   if (status !== null) {
     throw new HTTPException(status, {
       message:
@@ -173,6 +185,25 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
     }
   });
 
+  app.post("/v1/organizations/additional", async (context) => {
+    const { session, subjectId } = await requireManagedHuman(context, deps);
+    const payload = await parseBody(context, CreateAdditionalOrganizationRequest);
+    try {
+      return context.json(
+        CreateAdditionalOrganizationResponse.parse(
+          await createAdditionalManagedOrganization(deps.db, {
+            subjectId,
+            subjectLabel: session.user.email || session.user.name,
+            ...payload,
+          }),
+        ),
+        201,
+      );
+    } catch (error) {
+      rethrowMembershipError(error, "additional organization limit reached");
+    }
+  });
+
   app.get("/v1/organization-memberships", async (context) => {
     const { session } = await requireManagedHuman(context, deps);
     try {
@@ -328,6 +359,22 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
     }
   });
 
+  app.delete("/v1/organizations/:organizationId/workspaces/:workspaceId", async (context) => {
+    const organizationId = parseId(
+      OrganizationId,
+      context.req.param("organizationId"),
+      "organization id",
+    );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId);
+    const workspaceId = parseId(WorkspaceId, context.req.param("workspaceId"), "workspace id");
+    await deleteWorkspaceForRequest(deps, {
+      accountId: organizationId,
+      workspaceId,
+      organizationAdministratorSubjectId: subjectId,
+    });
+    return context.body(null, 204);
+  });
+
   app.patch(
     "/v1/organizations/:organizationId/workspaces/:workspaceId/settings",
     async (context) => {