@opengeni/api-router 2.6.4 → 2.8.1-canary.0

package/src/routes/organization-model-providers.ts

@@ -0,0 +1,231 @@
+import {
+  CreateOrganizationProviderCustomModelRequest,
+  DeleteOrganizationProviderCustomModelRequest,
+  OrganizationModelProviderConnectionResponse,
+  OrganizationModelProviderKind,
+  OrganizationProviderCustomModel,
+  OrganizationProviderCustomModelsResponse,
+  RevokeOrganizationModelProviderConnectionRequest,
+  UpsertOrganizationModelProviderConnectionRequest,
+} from "@opengeni/contracts";
+import { requireEnvironmentEncryption, type ApiRouteDeps } from "@opengeni/core";
+import {
+  createOrganizationModelProviderCustomModel,
+  encryptEnvironmentValue,
+  getOrganizationModelProviderConnection,
+  listOrganizationModelProviderCustomModels,
+  organizationModelProviderCredentialDigest,
+  OrganizationModelProviderConflictError,
+  OrganizationModelProviderLimitError,
+  retireOrganizationModelProviderCustomModel,
+  revokeOrganizationModelProviderConnection,
+  upsertOrganizationModelProviderConnection,
+} from "@opengeni/db";
+import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+
+import { requireOrganizationCodexHuman, requireSameOriginBrowserMutation } from "./codex";
+
+const OrganizationId = z.string().uuid();
+
+function parseOrganizationId(value: string): string {
+  const parsed = OrganizationId.safeParse(value);
+  if (!parsed.success) throw new HTTPException(404, { message: "organization not found" });
+  return parsed.data;
+}
+
+async function jsonBody<T>(c: Context, schema: z.ZodType<T>, message: string): Promise<T> {
+  const parsed = schema.safeParse(await c.req.json().catch(() => null));
+  if (!parsed.success) throw new HTTPException(422, { message });
+  return parsed.data;
+}
+
+function providerKind(value: string) {
+  const parsed = OrganizationModelProviderKind.safeParse(value);
+  if (!parsed.success) throw new HTTPException(404, { message: "model provider not found" });
+  return parsed.data;
+}
+
+function connectionJson(connection: {
+  providerKind: "vercel_gateway" | "openrouter";
+  status: "active" | "revoked";
+  version: number;
+  createdAt: Date;
+  updatedAt: Date;
+}) {
+  return OrganizationModelProviderConnectionResponse.parse({
+    ...connection,
+    createdAt: connection.createdAt.toISOString(),
+    updatedAt: connection.updatedAt.toISOString(),
+  });
+}
+
+function modelJson(model: {
+  id: string;
+  upstreamModelId: string;
+  label: string | null;
+  version: number;
+  createdAt: Date;
+  updatedAt: Date;
+}) {
+  return OrganizationProviderCustomModel.parse({
+    ...model,
+    createdAt: model.createdAt.toISOString(),
+    updatedAt: model.updatedAt.toISOString(),
+  });
+}
+
+function conflict(error: unknown): never {
+  if (error instanceof OrganizationModelProviderConflictError) {
+    throw new HTTPException(409, { message: "organization model provider version conflict" });
+  }
+  if (error instanceof OrganizationModelProviderLimitError) {
+    throw new HTTPException(409, { message: "organization custom model limit reached" });
+  }
+  throw error;
+}
+
+export function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRouteDeps): void {
+  app.get("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
+    c.header("cache-control", "private, no-store");
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const connection = await getOrganizationModelProviderConnection(deps.db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+      providerKind: providerKind(c.req.param("providerKind")),
+    });
+    return connection ? c.json(connectionJson(connection)) : c.json(null);
+  });
+
+  app.put("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
+    c.header("cache-control", "private, no-store");
+    requireSameOriginBrowserMutation(c, deps);
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const payload = await jsonBody(
+      c,
+      UpsertOrganizationModelProviderConnectionRequest,
+      "invalid organization model provider connection",
+    );
+    try {
+      const connection = await upsertOrganizationModelProviderConnection(deps.db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        providerKind: providerKind(c.req.param("providerKind")),
+        credentialEncrypted: encryptEnvironmentValue(
+          requireEnvironmentEncryption(deps.settings),
+          payload.apiKey,
+        ),
+        credentialDigest: organizationModelProviderCredentialDigest(payload.apiKey),
+        operationId: payload.operationId,
+        ...(payload.expectedVersion === undefined
+          ? {}
+          : { expectedVersion: payload.expectedVersion }),
+      });
+      return c.json(connectionJson(connection));
+    } catch (error) {
+      conflict(error);
+    }
+  });
+
+  app.delete("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
+    c.header("cache-control", "private, no-store");
+    requireSameOriginBrowserMutation(c, deps);
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const payload = await jsonBody(
+      c,
+      RevokeOrganizationModelProviderConnectionRequest,
+      "invalid organization model provider disconnect",
+    );
+    try {
+      const connection = await revokeOrganizationModelProviderConnection(deps.db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        providerKind: providerKind(c.req.param("providerKind")),
+        ...payload,
+      });
+      return c.json(connectionJson(connection));
+    } catch (error) {
+      conflict(error);
+    }
+  });
+
+  app.get(
+    "/v1/organizations/:organizationId/model-providers/:providerKind/custom-models",
+    async (c) => {
+      c.header("cache-control", "private, no-store");
+      const organizationId = parseOrganizationId(c.req.param("organizationId"));
+      const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+      const models = await listOrganizationModelProviderCustomModels(deps.db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        providerKind: providerKind(c.req.param("providerKind")),
+      });
+      return c.json(
+        OrganizationProviderCustomModelsResponse.parse({ models: models.map(modelJson) }),
+      );
+    },
+  );
+
+  app.post(
+    "/v1/organizations/:organizationId/model-providers/:providerKind/custom-models",
+    async (c) => {
+      c.header("cache-control", "private, no-store");
+      requireSameOriginBrowserMutation(c, deps);
+      const organizationId = parseOrganizationId(c.req.param("organizationId"));
+      const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+      const payload = await jsonBody(
+        c,
+        CreateOrganizationProviderCustomModelRequest,
+        "invalid organization custom model",
+      );
+      try {
+        const model = await createOrganizationModelProviderCustomModel(deps.db, {
+          organizationId,
+          actorSubjectId: human.subjectId,
+          providerKind: providerKind(c.req.param("providerKind")),
+          operationId: payload.operationId,
+          upstreamModelId: payload.upstreamModelId,
+          ...(payload.label === undefined ? {} : { label: payload.label }),
+        });
+        return c.json(modelJson(model), 201);
+      } catch (error) {
+        conflict(error);
+      }
+    },
+  );
+
+  app.delete(
+    "/v1/organizations/:organizationId/model-providers/:providerKind/custom-models/:customModelId",
+    async (c) => {
+      c.header("cache-control", "private, no-store");
+      requireSameOriginBrowserMutation(c, deps);
+      const organizationId = parseOrganizationId(c.req.param("organizationId"));
+      const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+      const payload = await jsonBody(
+        c,
+        DeleteOrganizationProviderCustomModelRequest,
+        "invalid organization custom model deletion",
+      );
+      const customModelId = z.string().uuid().safeParse(c.req.param("customModelId"));
+      if (!customModelId.success) {
+        throw new HTTPException(422, { message: "invalid organization custom model id" });
+      }
+      try {
+        const model = await retireOrganizationModelProviderCustomModel(deps.db, {
+          organizationId,
+          actorSubjectId: human.subjectId,
+          providerKind: providerKind(c.req.param("providerKind")),
+          customModelId: customModelId.data,
+          ...payload,
+        });
+        return c.json(modelJson(model));
+      } catch (error) {
+        conflict(error);
+      }
+    },
+  );
+}

package/src/routes/packs.ts

@@ -277,6 +277,7 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
           sourcePath: inline.sourcePath,
           name: inline.name,
           description: inline.description,
+          activationMode: inline.activationMode,
           contentSha256: inline.contentSha256,
           totalBytes: inline.totalBytes,
           files: inline.files,

package/src/routes/personal-github.ts

@@ -3,10 +3,15 @@ import {
   ListPersonalGitHubRepositoriesResponse,
   PersonalGitHubConnectionStatusResponse,
   PersonalGitHubOAuthStartRequest,
+  PersonalGitHubRepositoryId,
   PersonalGitHubRepositorySelectionState,
   ReplacePersonalGitHubRepositorySelectionsRequest,
   VerifyPersonalGitHubRepositorySelectionsRequest,
 } from "@opengeni/contracts/personal-github";
+import {
+  ListGitHubRepositoryBranchesQuery,
+  GitHubRepositoryBranchesResponse,
+} from "@opengeni/contracts/github-repository-contracts";
 import {
   requireAccessGrant,
   requireAccessGrantAuthorization,
@@ -31,6 +36,7 @@ import {
   startPersonalGitHubOAuth,
 } from "../integrations/personal-github";
 import {
+  listLivePersonalGitHubRepositoryBranches,
   listLivePersonalGitHubRepositories,
   personalGitHubRepositoryProviderHttpError,
   PersonalGitHubRepositoryProviderError,
@@ -187,6 +193,39 @@ export function registerPersonalGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
     },
   );
 
+  app.get(
+    "/v1/workspaces/:workspaceId/connections/:connectionId/github/repositories/:repositoryId/branches",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const connectionId = c.req.param("connectionId");
+      const access = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "connections:read",
+      );
+      assertPersonalConnectionOwnerPrincipal(access, "My GitHub repositories");
+      const query = ListGitHubRepositoryBranchesQuery.parse(c.req.query());
+      const repositoryId = PersonalGitHubRepositoryId.parse(c.req.param("repositoryId"));
+      try {
+        return c.json(
+          GitHubRepositoryBranchesResponse.parse(
+            await listLivePersonalGitHubRepositoryBranches(deps, {
+              accountId: access.grant.accountId,
+              workspaceId,
+              subjectId: access.grant.subjectId,
+              connectionId,
+              repositoryId,
+              query,
+            }),
+          ),
+        );
+      } catch (error) {
+        throw personalGitHubRepositoryRouteError(error);
+      }
+    },
+  );
+
   app.post(
     "/v1/workspaces/:workspaceId/connections/:connectionId/github/repositories/verify",
     async (c) => {

package/src/routes/pr-review.ts

@@ -13,12 +13,15 @@ import {
   canonicalConfiguredModel,
   defaultPrReviewProviderBaseUrl,
   getCapabilityPack,
+  workspaceCustomModelReference,
+  lockActiveCustomModelForAdmission,
   prReviewWebhookAuthKind,
   normalizePrReviewProviderBaseUrl,
   prReviewPackConnectorId,
   PR_REVIEW_AUTOMATION_TEMPLATE_ID,
   requireAccessGrant,
   requirePermission,
+  resolveWorkspaceCatalogSettings,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import {
@@ -385,10 +388,24 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
         throw error;
       }
     }
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
     const model = payload.model
-      ? (canonicalConfiguredModel(settings, payload.model) ?? null)
+      ? (canonicalConfiguredModel(catalogSettings, payload.model) ?? null)
       : null;
-    if (model) await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
+    if (model) await assertWorkspaceModelPolicyAllows(db, catalogSettings, workspaceId, model);
+    const beforeCreateCommit = model
+      ? prReviewCustomModelCommitGuard({
+          settings: catalogSettings,
+          accountId: grant.accountId,
+          workspaceId,
+          modelId: model,
+        })
+      : undefined;
     const template = getCapabilityPack(OPENGENI_PR_REVIEW_PACK_ID)?.automationTemplates?.find(
       (candidate) => candidate.id === PR_REVIEW_AUTOMATION_TEMPLATE_ID,
     );
@@ -417,6 +434,7 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
         eventTypes: template.eventTypes,
         configuration: template.configuration,
         sessionTemplate: template.sessionTemplate,
+        ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
       }),
       "This repository is already bound to the selected PR Review registration",
     );
@@ -441,13 +459,40 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     await requirePrReviewPackActive(db, workspaceId);
     const payload = UpdatePrReviewRepositoryBindingRequest.parse(await c.req.json());
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
     const model =
       payload.model === undefined
         ? undefined
         : payload.model === null
           ? null
-          : (canonicalConfiguredModel(settings, payload.model) ?? null);
-    if (model) await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
+          : (canonicalConfiguredModel(catalogSettings, payload.model) ?? null);
+    if (model) await assertWorkspaceModelPolicyAllows(db, catalogSettings, workspaceId, model);
+    const beforeUpdateCommit = async (
+      tx: ApiRouteDeps["db"],
+      context: {
+        currentModel: string | null;
+        currentStatus: "active" | "disabled";
+        nextModel: string | null;
+        nextStatus: "active" | "disabled";
+      },
+    ): Promise<void> => {
+      const materialExecutionChange =
+        payload.model !== undefined ||
+        payload.additionalInstructions !== undefined ||
+        (context.currentStatus === "disabled" && context.nextStatus === "active");
+      if (!materialExecutionChange || !context.nextModel) return;
+      await prReviewCustomModelCommitGuard({
+        settings: catalogSettings,
+        accountId: grant.accountId,
+        workspaceId,
+        modelId: context.nextModel,
+      })?.(tx);
+    };
     const binding = await updatePrReviewRepositoryBinding(db, {
       accountId: grant.accountId,
       workspaceId,
@@ -458,6 +503,7 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
         ? { additionalInstructions: payload.additionalInstructions }
         : {}),
       ...(payload.status !== undefined ? { status: payload.status } : {}),
+      beforeUpdateCommit,
     });
     if (!binding)
       throw new HTTPException(404, {
@@ -501,6 +547,28 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 }
 
+function prReviewCustomModelCommitGuard(input: {
+  settings: ApiRouteDeps["settings"];
+  accountId: string;
+  workspaceId: string;
+  modelId: string;
+}): ((tx: ApiRouteDeps["db"]) => Promise<void>) | undefined {
+  const reference = workspaceCustomModelReference(input.settings, input.modelId);
+  if (!reference) return undefined;
+  return async (tx): Promise<void> => {
+    const active = await lockActiveCustomModelForAdmission(tx, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      reference,
+    });
+    if (!active) {
+      throw new HTTPException(422, {
+        message: `model is not available: ${input.modelId}`,
+      });
+    }
+  };
+}
+
 function assertPrReviewSandboxBackend(deps: ApiRouteDeps): void {
   if (deps.settings.sandboxBackend === "selfhosted") {
     throw new HTTPException(409, {

package/src/routes/scheduled-tasks.ts

@@ -6,7 +6,7 @@ import {
 import { listScheduledTaskRuns, listScheduledTasks } from "@opengeni/db";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { requireAccessGrant } from "@opengeni/core";
+import { requireAccessGrant, resolveWorkspaceCatalogSettings } from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
@@ -30,7 +30,7 @@ import { boundedLimit } from "../http/common";
 import { deleteScheduledTaskWithDurableCleanup } from "../scheduled-task-deletion";
 
 export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void {
-  const { settings, db, workflowClient, objectStorage } = deps;
+  const { db, workflowClient, objectStorage } = deps;
 
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -43,6 +43,12 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       });
     }
     const payload = parsedPayload.data;
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
     await requireLimit(deps, {
       accountId: grant.accountId,
       workspaceId,
@@ -50,7 +56,7 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       quantity: 1,
     });
     const task = await createValidatedScheduledTask({
-      settings,
+      settings: catalogSettings,
       db,
       objectStorage,
       grant,
@@ -91,8 +97,14 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       });
     }
     const payload = parsedPayload.data;
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
     const update = await validatedScheduledTaskUpdate({
-      settings,
+      settings: catalogSettings,
       db,
       objectStorage,
       grant,
@@ -124,8 +136,14 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     const existing = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     const previous = await captureScheduledTaskRestoreState(db, existing);
+    const catalogSettings = (
+      await resolveWorkspaceCatalogSettings(db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+      })
+    ).settings;
     const update = await validatedScheduledTaskUpdate({
-      settings,
+      settings: catalogSettings,
       db,
       objectStorage,
       grant,
@@ -146,6 +164,12 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     // recognised as codex-billed and skip the credit/cost gates at the edge.
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     if (task.action.kind === "agent_turn") {
+      const catalogSettings = (
+        await resolveWorkspaceCatalogSettings(db, deps.settings, {
+          accountId: grant.accountId,
+          workspaceId,
+        })
+      ).settings;
       await validateScheduledTaskTarget({
         db,
         sessionAuthorization: deps.sessionAuthorization,
@@ -159,20 +183,23 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
         missingTargetStatus: 404,
       });
       await validateScheduledTaskMachineTarget({
-        settings,
+        settings: catalogSettings,
         db,
         grant,
         runMode: task.runMode,
         agentConfig: task.agentConfig,
         requireOnline: true,
       });
-      await requireLimit(deps, {
-        accountId: grant.accountId,
-        workspaceId,
-        action: "agent_run:create",
-        quantity: 1,
-        model: task.agentConfig.model ?? deps.settings.openaiModel,
-      });
+      await requireLimit(
+        { ...deps, settings: catalogSettings },
+        {
+          accountId: grant.accountId,
+          workspaceId,
+          action: "agent_run:create",
+          quantity: 1,
+          model: task.agentConfig.model ?? catalogSettings.openaiModel,
+        },
+      );
     }
     // Body is optional (a bare POST is still a valid trigger); only a present,
     // non-empty body must parse against the contract.